The GDPR has been with us since 2018, and for most growing companies it is still a source of unease rather than confidence. Not because the rules are impenetrable, but because they are rarely broken down into something you can actually do on a Monday morning. This guide does that. It is written for the person carrying data protection responsibility in a Swedish company without being a lawyer, who wants to know what is required, in what order, and where it is fine to keep things simple.
The principle: the GDPR is a way of working, not a binder
The most common mistake is to treat the GDPR as a project with an end point. It is not. The GDPR is about being able to show that you handle personal data responsibly, continuously. IMY, the Swedish data protection authority, rarely asks “do you have a policy?”. It asks “can you show how you do this, and why?”. That is accountability, and it is the whole point: document your choices and be able to stand behind them.
The good news in that is that the requirements become manageable once you stop looking for a perfect finished product and instead build a simple, repeating routine.
Step 1: know what personal data you hold
Everything starts with an overview. What personal data do you collect, about customers, suppliers, employees, visitors? Where is it stored, who has access, and how long do you keep it?
That inventory turns into your record of processing activities. It is not only a requirement in itself, it is the foundation everything else rests on. Without it you do not know what risks you carry, which agreements you need, or how to answer when someone asks for their data.
Plenty of companies make the record harder than it needs to be. We have written about how to make it useful rather than bureaucratic in the record of processing activities.
Step 2: have a legal basis for each processing activity
Every processing activity needs a legal basis. The common ones for a smaller company are:
- Contract: you need the data to perform a contract with the person, delivering an order, for instance.
- Legal obligation: the law requires it, as with bookkeeping.
- Legitimate interest: you have a genuine need that outweighs the individual’s privacy, which calls for a balancing test you should write down.
- Consent: the person has actively said yes, and can withdraw it.
The point is not to memorise the law. It is to be able to point to which basis covers which activity, and that is exactly what the record of processing keeps straight for you.
Step 3: know your processors
Almost every company passes personal data to suppliers who process it on their behalf: cloud services, payroll, email tools, the accounting bureau. Those are your processors, and each relationship requires a data processing agreement.
It is not enough for the agreement to exist. It has to cover the right things, and this is where expensive mistakes are made. We have collected the common pitfalls in data processing agreements: a template and 5 pitfalls. The rule of thumb: know which processors you have, they are listed in your record of processing, and make sure an agreement exists and says the right things.
Step 4: be able to handle data subject rights
People whose data you hold have rights: access (being told what you hold about them), rectification, erasure, and in some cases portability and objection. You have to be able to answer such a request within a reasonable time, normally one month.
The practical requirement is not to memorise every right. It is to have a simple routine: who receives the request, where they look up what you hold (the record of processing again), and how you answer in time. A request you cannot answer within a month is a risk you can remove with half a day of preparation.
Step 5: be ready for a personal data breach
Sooner or later something happens: a file sent to the wrong address, an intrusion, a lost laptop. A personal data breach can oblige you to notify IMY within 72 hours, and in some cases to tell the people affected.
What matters is that the routine exists before it happens, because 72 hours goes quickly once the clock starts. We have written a step-by-step playbook in incident response in 72 hours. Note also that if NIS2 applies to you, you may face parallel reporting duties: more on that in our guide to the Cybersecurity Act and NIS2.
Step 6: protect the data in practice
The GDPR requires “appropriate technical and organisational measures”. In practice: access only for those who need it, reasonable password hygiene, encryption where it is warranted, and a basic security policy that is actually followed. This overlaps with information security generally, and it does not have to be complicated. We have shown how to get it down to the essentials in the one-page security policy.
A realistic order of priority
If you want to work through this methodically without freezing:
- The record of processing activities: get the overview first, everything else hangs on it.
- Legal basis: tie a basis to each activity.
- Data processing agreements: secure the supplier side.
- A rights routine: a simple process for requests.
- An incident routine: so that 72 hours is not a panic.
- Security measures: the practical protection, kept up.
Each point is a bounded piece of work. Together they become a way of working, and that is what the GDPR asks for.
Where Polaris comes in
Polaris is building an AI-driven compliance platform for Swedish SMEs that makes this continuous work manageable: the record of processing, data processing agreements, routines and documentation in one place, so that you can show you are doing it right rather than hoping so. The platform launches during the second half of 2026.
Want to see where you stand today? Take our Health Check for a position per area and a concrete picture of your gaps.
This article is general guidance, not legal advice. How the GDPR applies depends on your particular processing of personal data. Check your own situation with your lawyer or with IMY.
