Frequently Asked Questions
Plain answers on GDPR, NIS2, IMY enforcement, and how Vakteye works.
A few practical answers.
What do we need to get started?
Start with your website address and the pages or journeys that matter. During the scope review we agree domains, monitoring frequency and review needs. Domain verification is part of activation.
How often does monitoring run?
Essentials defaults to monthly scans. Professional and Enterprise default to weekly scans. Daily monitoring can be agreed in a custom scope. Ongoing monitoring means repeated checks on that cadence, rather than an uninterrupted observation of every visit.
Who reviews findings and fixes issues?
Professional and Enterprise include human verification of lower-confidence findings by default. Your website or development team implements changes. Review coverage and any additional services follow the agreed scope.
What does a verified fix mean?
The relevant page and scenario have been checked again, the finding was not observed and the required check completed. Incomplete checks stay inconclusive. Verification applies to that check and time; it does not certify the whole website as legally compliant.
NIS2 & Cybersäkerhetslagen
When did Cybersäkerhetslagen take effect?
Sweden's Cybersecurity Act (SFS 2025:1506) entered into force on 15 January 2026 and partly implements the EU NIS2 Directive (2022/2555) in Swedish law. MCF opened the registration service on 2 February 2026 and says covered operators should register as soon as possible; if registration is not submitted within 14 days, supervisory authorities may take action. The act sets baseline cybersecurity, incident-reporting, and management-accountability obligations for covered operators in Sweden.
Who supervises NIS2 in Sweden?
Supervision is split across sector-specific authorities (tillsynsmyndigheter) coordinated by MCF (Myndigheten för civilt försvar). MCF also runs CERT-SE, the national CSIRT that receives incident notifications. The Swedish Post and Telecom Authority (PTS) supervises the digital-infrastructure sector. Other sectors map to their own regulators — energy to Energimyndigheten, healthcare to IVO, finance to Finansinspektionen, etc.
What is the difference between essential and important entities?
NIS2 Article 3 splits entities into two tiers based on sector criticality and size. Essential entities are large operators in highly critical sectors (energy, transport, banking, financial-market infrastructure, health, drinking water, waste water, digital infrastructure, ICT-service management, public administration, space). Important entities are medium-sized operators in those sectors plus operators in other critical sectors (postal, waste management, chemicals, food, manufacturing, digital providers, research). Both tiers have the same baseline security obligations under Article 21; supervision intensity and fine ceilings differ.
What incidents require reporting under NIS2 and to whom?
Article 23 requires notification of any incident with significant impact on service continuity or recipients. The clock is tight: an early warning to the CSIRT/competent authority within 24 hours of awareness, an incident notification within 72 hours, and a final report within one month. In Sweden, notifications go to CERT-SE (operated by MCF) and the relevant sector authority. 'Significant impact' is defined in Article 23(3) — disruption of service, financial loss, harm to others.
What are the maximum NIS2 fines in Sweden?
NIS2 Article 34 sets two ceilings, both transposed into Cybersäkerhetslagen. Essential entities: up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities: up to EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher. Management bodies can be held liable under Article 20 for failure to oversee implementation, and Article 32(5)(b) allows temporary prohibition of management functions.
IMY enforcement
What is the largest GDPR fine ever issued by IMY?
Spotify AB was fined 58 million SEK — the largest upheld GDPR fine from IMY (Google was initially fined 75 million SEK in 2020, later reduced to 50 million on appeal). The decision (DI-2019-6696, 12 June 2023) cited failures around the right of access under GDPR Article 15 and information transparency under Article 12. Förvaltningsrätten initially reduced the fine to 40 million SEK, but Kammarrätten reinstated the full 58 million SEK on 3 June 2025 in case 4512-24.
How does IMY decide a fine amount?
IMY follows GDPR Article 83(2), which lists eleven factors (sub-paragraphs a–k) a supervisory authority must consider. Key factors include:
- nature, gravity and duration of the infringement
- intentional or negligent character
- categories of personal data affected
- degree of responsibility
- cooperation with the authority
- mitigation actions taken
- previous infringements
- any financial benefit derived
- manner in which the infringement became known to the authority
- compliance with previously ordered measures
- adherence to approved codes of conduct or certification mechanisms
The ceiling is the higher of EUR 20 million or 4% of worldwide annual turnover for the most serious infringements (Article 83(5)) and EUR 10 million or 2% for the lesser tier (Article 83(4)).
Which Swedish web-tracking decisions should teams know?
For Meta Pixel, IMY has published several GDPR decisions: Avanza Bank AB received a 15 million SEK sanction fee in DI-2021-5544 (assessed under Article 5(1)(f) and Article 32), Apoteket AB received 37 million SEK in IMY-2022-3270 (decided 29 August 2024), Apohem AB received 8 million SEK in IMY-2022-3272, and Apotea AB received a reprimand in December 2024. The pharmacy cases were assessed mainly under GDPR Article 32 and related security/confidentiality rules. These decisions concerned inappropriate transfer or exposure of personal data through Meta Pixel. Other Swedish web-tracking cases, such as Tele2's Google Analytics transfer decision (12 million SEK, upheld by Kammarrätten October 2025), sit in the same operational risk area but should not be described as Meta Pixel cases.
Can IMY fine a foreign company operating in Sweden?
Yes, where Swedish-resident data subjects are affected. GDPR Article 56 establishes the one-stop-shop with the lead supervisory authority in the company's main establishment, but IMY can act as concerned authority in cross-border cases and as lead authority for any controller or processor with its main establishment in Sweden. Non-EU controllers offering goods or services to people in Sweden fall under GDPR Article 3(2) and IMY's territorial reach.
How long does an IMY tillsyn take?
There is no statutory time limit, though under Förvaltningslagen (2017:900) Section 12 a complainant can demand a decision within four weeks if a case has been pending longer than six months. Published decisions show wide variation: the Apoteket Meta Pixel decision (IMY-2022-3270) was issued on 29 August 2024 after an investigation opened in 2022. The Spotify access-rights case (DI-2019-6696) ran from a January 2019 noyb complaint to a 12 June 2023 decision — roughly four years. Complexity, cross-border coordination under the EDPB consistency mechanism, and respondent cooperation all affect timelines.
Vakteye scanning
What does Vakteye actually test?
Vakteye runs a suite of scanners against your site to surface compliance and security issues. The compliance set covers cookie-consent enforcement (banner detection, reject-button function, tracker-after-rejection monitoring, Google Consent Mode v2 signal validation, TCF v2.2 decoding, geo-aware scans), third-party data flow, data-residency claims, accessibility (WCAG 2.1 AA), policy presence, and form-leakage. The security set covers CVE and misconfiguration templates, passive web-application checks, hardcoded secret detection, vulnerable-library detection enriched with public CVE databases, and exposure checks. Findings are mapped to GDPR, ePrivacy, LEK, NIS2 and Cybersäkerhetslagen articles.
Is Vakteye legal to run on a website I do not own?
Run Vakteye only against sites you own or are authorised to test. Vakteye operates a public scanner-disclosure page at vakteye.com/audit explaining who we are, our User-Agent (Vakteye/1.0), and the egress IP pool we use (current list in our Data Processing Agreement). Site operators can opt out at vakteye.com/audit/opt-out — a verified, single-use email-token form that adds the domain to a server-enforced exclusion list. We honour robots.txt at scan time. The compliance-mode scanner relies on GDPR Article 6(1)(f) legitimate interest for outbound non-intrusive scanning of publicly reachable URLs; full-mode and EASM scans run only under a signed customer agreement. Vakteye performs no penetration testing and sends no active payloads in any mode.
Does Vakteye replace my consent management platform?
No. Vakteye is an independent auditor, not a CMP. We test whether the CMP you have deployed (OneTrust, Cookiebot, TrustArc, Usercentrics, Iubenda, your own implementation) actually behaves as it claims when a real visitor clicks Reject. Vakteye and your CMP are complementary: the CMP collects and signals consent; Vakteye verifies that the signals are honoured downstream and that no tracker fires before consent.
What evidence does a Vakteye report contain?
Reports connect findings to the evidence collected within the scan scope, confidence and review status. Depending on the check and available capture, evidence can include browser traces, network recordings, screenshots and references to applicable requirements. A finding awaiting review is not a verified conclusion. Export availability depends on the report and review state.
How does Vakteye handle false positives?
Findings carry confidence and review status. Automated checks help investigate the observation; findings that require human verification enter a review queue when that service is included. Reviewers can correct or dismiss findings, and your team can raise a challenge. Professional and Enterprise include human verification by default; confirm the agreed scope in your contract.
Pricing & data
Where is Vakteye scanner data stored?
The published DPA and subprocessor information describe processing functions and regions. Before signing, request the current named subprocessor list and confirm the processing locations, retention and transfer arrangements for your service in the contract.
Does Vakteye send data outside the EU?
Check the agreed processing scope and transfer arrangements in your DPA. Our public information describes regional processing and global DNS or bot-protection routing, but does not establish a blanket EU-only guarantee for every service configuration. Contact us for the current named list and contract-specific details.
Can I run Vakteye on a staging environment?
Yes. Point Vakteye at any HTTPS URL you control. Staging hosts that sit behind basic-auth, IP allowlisting, or a private network are reachable only if you allowlist our EU egress IPs (current list and rotation policy in our Data Processing Agreement) and our User-Agent (Vakteye/1.0). For sites behind a Web Application Firewall, the two-phase scan first runs an unauthenticated pass to capture the external compliance view, then a second allowlisted pass with RFC 9421 ed25519 request signing. WAF onboarding instructions are available in your dashboard.