How do I get my case file and personal data?

Authorities and organisations often know considerably more about a matter than the person affected by it. Decisions, internal notes, emails, reports, register entries and disclosures of information may be created in different parts of an organisation. If you want to understand what actually happened, you first need a reliable information base.

In Sweden there are several legally distinct ways to obtain information. They overlap in part, but they are not the same:

Party access (partsinsyn) – if you are a party to a specific administrative matter and want to see the material in that matter.
Public documents (allmän handling) – if you want to request public documents held by an authority.
Article 15 GDPR / registerutdrag – if you want to know which personal data are processed about you or your child and how those data are processed.

If your goal is to reconstruct an authority matter as completely as possible, it may be useful to use more than one route in parallel.

The key difference

Case file and procedural material

If you want to know which materials belong to a specific matter and what material the authority used when handling or deciding it, you are looking for access to the case file or procedural material.

If you are a party, Section 10 of the Swedish Administrative Procedure Act (Förvaltningslagen 2017:900) is particularly important. A party is generally entitled to access all material added to the matter. Restrictions may follow from Chapter 10, Section 3 of the Public Access to Information and Secrecy Act (Offentlighets- och sekretesslagen 2009:400).

Separately, anyone may request public documents from an authority under Chapter 2 of the Freedom of the Press Act (Tryckfrihetsförordningen). You do not generally need to be a party.

Personal data

If you want to know which personal data are processed, where they came from, why they are processed, who received them and how long they are stored, the relevant right is Article 15 GDPR.

This is not a substitute for case-file access. Article 15 concerns personal data and the supplementary information listed in the GDPR; it does not automatically give a right to every complete document in which personal data appear.

Which route should I use?

I want to understand how a specific authority matter was handled. Use party access and, where useful, also request public documents.

I want public documents from an authority even though I am not a party. Request allmänna handlingar.

I want to know which personal data are processed about me or my child. Use Article 15 GDPR.

I want to reconstruct a matter as completely as possible. A combination is often useful.

Create a request

Complete only the fields needed for your selected route. Everything stays in your browser.

Your entries are used only to generate your request directly in your browser. They are not stored, transmitted to a server or included in the URL.

The generated request is written in Swedish. Explanations and field guidance remain in English.

* Required field

What do you want to request?

GDPR Article 15

Recipient type

Controller authority or organisation

Processing context

Which matter or administrative area?

This text is inserted unchanged into the Swedish request. Please enter it in Swedish where possible.

Time scope

Period

Case file / Party access

Authority / handling unit

Also request public documents in parallel

Public documents

Public authority / body

Which public documents do you want to request?

Please enter this in Swedish where possible.

Period

Request public documents anonymously

You can generally request public documents without giving your name or explaining why you want them.

Sender

Sender name

Contact details

Before sending: remove anything that does not apply

After generation: review before sending

Depending on the selected area, the generator adds typical processing contexts. These points help the controller identify relevant data stores and processing activities. They are not a claim that every listed activity actually occurred in your case.

Remove anything that does not apply

Immediately below the generated request, the page therefore shows every included specialist module again. For each module it explains:

what the module means;
when it is typically useful;
when it should be removed.

Use “Remove” to delete a module. The Swedish request is regenerated immediately.

Important: removing a specialist module must not change the core scope. The request still covers all personal data within the matter, period or processing context you selected. The modules merely identify places where relevant data may typically appear.

Example: BBIC

If you select Social services – children and young people, the generator may add a BBIC (Barns behov i centrum) module.

Keep it where the matter concerns child/youth social services and BBIC was used or may have been used in the specific matter.

Remove it where:

the matter is not a child/youth social-services matter; or
you know BBIC was not used in that particular matter.

BBIC is a working and documentation model described by Socialstyrelsen for child and youth social services. It structures case handling, implementation, follow-up and documentation. It is not a separate legal basis for an Article 15 request.

Example: placement material

Keep the placement/care-plan/implementation-plan module only where placement or corresponding planning/follow-up actually formed part of the matter. If there was never a placement, remove it.

Example: report of concern

Keep the orosanmälan module where a report of concern was received or processed in the selected matter. If there is no such connection, remove it.

Example: system and access logs

Keep this only where the log entries may themselves constitute personal data about the data subject. Article 15 is not a general right to purely technical system information that is not personal data.

Do not remove the legal core

The statutory Article 15 components cannot be removed, including purposes, categories, recipients, storage period, source information and the copy of personal data.

The review affects only the sector-specific search and precision modules.

Why this review matters

A precise request is usually more useful than an indiscriminate list of every conceivable data type. GDPR Recital 63 expressly contemplates that where a controller processes a large quantity of information, it may ask the data subject to specify the information or processing activities to which the request relates.

The generator should therefore be neither artificially narrow nor pointlessly maximalist: broad enough for the selected matter, specific enough to show where the controller should look.

Important for GDPR: no specific form is required

An Article 15 request does not have to use a prescribed form. It can generally be made orally or in writing. For evidence and clarity, a written request, for example by email, is usually preferable.

Under Article 12(2) GDPR, the controller must facilitate the exercise of data-subject rights. A request that has already been validly made therefore does not become ineffective merely because an organisation also offers a portal, app or dedicated online service.

Such a service may be used for secure identification or secure delivery. It must not, however, reduce the substance of an already made Article 15 request to whatever options happen to be available in the portal.

Who should receive a GDPR request?

Legally, the request is addressed to the controller (personuppgiftsansvarig).

Swedish public authorities will normally have a data protection officer (dataskyddsombud). The DPO is an appropriate contact point for data-subject rights. In practice, for authorities we recommend:

To: the DPO, if a contact address can be found;
CC: the registrar (registrator) or official registry address;
if no DPO contact can be found: send it to the official registry or published privacy contact address.

The generator builds the addressing block from your selections.

Multiple people and children

Article 15 is an individual right belonging to each data subject. If data about several family members are requested, the request should clearly identify each person for whom the right is exercised.

Children have their own GDPR rights. Depending on age and circumstances, those rights may be exercised by the child or by a guardian. The generator therefore creates a separate person block for every child and identifies who is exercising the right on the child's behalf.

It does not impose a blanket rule that one parent can always act alone or that both guardians must always sign. The exact representation issue can depend on age, maturity, custody arrangements and context.

What must an Article 15 response cover?

Article 15 GDPR includes, in particular:

confirmation whether personal data are being processed;
access to the personal data being processed;
purposes of processing;
categories of personal data;
recipients or categories of recipients;
where possible, the envisaged storage period or the criteria used to determine it;
information about rights to rectification, erasure, restriction and objection where applicable;
the right to lodge a complaint with a supervisory authority;
where the data were not collected from the data subject: any available information about their source;
where applicable: information about automated decision-making, including profiling;
where data are transferred to a third country or international organisation: information about appropriate safeguards;
a copy of the personal data undergoing processing.

The first copy is generally free of charge. Further copies may be subject to a reasonable fee under the conditions of Article 15(3) GDPR.

How long can the response take?

Under Article 12(3) GDPR, the controller must respond without undue delay and in principle within one month of receiving the request.

The period may be extended by up to two further months where necessary because of complexity or the number of requests. The controller must inform the data subject of the extension and the reasons for it within the first month.

Can the organisation verify my identity?

Yes. Where there are reasonable doubts about identity, Article 12(6) GDPR allows the controller to request additional information necessary to confirm identity.

That is not a licence for unnecessary data collection. Verification must be proportionate to the situation. A secure portal may be useful for identification without limiting the content of the request already made.

Are there exceptions?

Yes. The right of access is not unlimited.

In Sweden, Chapter 5, Section 1 of the Data Protection Act (Dataskyddslagen 2018:218) provides that Articles 13–15 GDPR do not apply to information that the controller is prohibited from disclosing to the data subject under law, regulation or a decision based on legislation.

Chapter 5, Section 2 of the Data Protection Act also restricts Article 15 for personal data in text that has not received its final form and for memory notes or similar material, subject to the exceptions set out in that section.

Article 15(4) GDPR also protects the rights and freedoms of others.

A restriction therefore does not automatically justify rejecting the whole request. The organisation must assess the specific legal basis and scope of the restriction.

What must an authority do with a public-document request?

Under Chapter 2, Section 15 of the Freedom of the Press Act, a public document that may be disclosed must generally be made available immediately or as soon as possible for inspection.

A request for a copy must under Chapter 2, Section 16 be handled promptly (skyndsamt).

If a document contains some information that cannot be disclosed, Chapter 2, Section 15 requires the remaining parts to be made available where this can be done without revealing the protected information.

Fees may apply for copies. The Freedom of the Press Act does not create a general right to receive public documents in electronic form. The generator therefore asks for electronic delivery as a preference and, if that is not possible, asks the authority to state the available format and any fee.

Do I have to identify myself or explain why I want the documents?

For an ordinary public-document request, Chapter 2, Section 18 of the Freedom of the Press Act generally prevents an authority from inquiring into identity or purpose beyond what is necessary to assess whether disclosure is legally prevented.

This is an important distinction from party access or a GDPR request, where identity or party status may matter.

What happens if secrecy applies?

“Sekretess” does not automatically mean that the whole document can be withheld.

The authority must assess which specific information is protected and under which legal provision. If only part is protected, the remainder must in principle be made accessible under the Freedom of the Press Act.

If an employee refuses disclosure or imposes conditions, Chapter 6, Section 3 OSL allows you to request the authority's formal determination. The authority must inform you that a written authority decision is required in order to appeal.

A refusal to disclose can generally be appealed under Chapter 6, Sections 7–8 OSL; for state and municipal authorities the appeal will normally go to the Administrative Court of Appeal (Kammarrätt).

How is party access different?

Under Section 10 Förvaltningslagen, a party has the right to access all material added to the matter.

The secrecy threshold is not identical to an ordinary public-document request. Chapter 10, Section 3 OSL provides that secrecy generally does not prevent a party from accessing the material. Material may nevertheless be withheld to the extent that it is of exceptional importance (synnerlig vikt), in view of a public or private interest, that protected information is not disclosed. In that situation the authority must generally inform the party of the substance by other means to the extent necessary for the party to protect their rights and where this can be done without serious harm to the protected interest.

The generators

This page does not generate complaints, appeals or individual litigation strategy. It generates information requests.

Choose:

Case file / Party access
Public document request
Article 15 GDPR
Combined authority request: party access + public documents

The generated letters are always in Swedish, because they are intended for Swedish recipients. Explanations, field guidance and warnings are shown in the language of the page.

Frequently asked questions

Do I need to use a specific form or authority portal for an Article 15 GDPR request?

No. An Article 15 GDPR request does not have to follow a prescribed form and can generally be made orally or in writing. A written request is usually easier to document. A portal may be used for proportionate identity verification or secure delivery, but it must not reduce an already valid request to the options available in that portal.

What is the difference between party access, public documents and Article 15 GDPR?

Party access concerns material in an administrative matter when you are a party to that matter. A public-document request concerns documents held by an authority. Article 15 GDPR concerns personal data and information about how those data are processed. The rights can overlap, but they serve different purposes.

How long can an Article 15 GDPR response take?

Under Article 12(3) GDPR, the controller must respond without undue delay and in principle within one month. Where necessary because of complexity or the number of requests, this may be extended by up to two further months. The data subject must be informed of the extension and the reasons within the first month.

Do I have to give my name when requesting a public document?

Generally not. Under Chapter 2, Section 18 of the Swedish Freedom of the Press Act, an authority may generally not investigate the requester's identity or purpose beyond what is necessary to determine whether disclosure is legally prevented.

Does secrecy mean that I cannot receive the document at all?

Not necessarily. Where only particular information is protected, the remaining parts must generally be made available where this can be done without revealing the protected information. Party access is also subject to the separate rule in Chapter 10, Section 3 OSL.

Can I request case-file access and Article 15 GDPR access at the same time?

Yes. They are separate information rights and may complement each other. If you want to reconstruct a matter as completely as possible, it can be useful to examine both the procedural/public-document material and the processing of personal data.

What comes next once I have the file?

Getting the complete file is only the first step. What often follows is a pile of decisions, notes, emails, reports, statements and repeated claims. More documents do not automatically mean more clarity.

The important part now is working out what is actually supported, where information originally came from, what has merely been copied or repeated, and where contradictions, gaps or deviations appear.

That is exactly what my compact guide is designed for. It takes you step by step through a practical method for structuring and breaking down large case files so that you can isolate the information that actually matters for further analysis.

The result is no longer simply a collection of PDFs, but a traceable structure of statements, sources, dates, decisions and possible contradictions.

Getting the file gives you access. Learning how to read it gives you leverage.

Open the guide: Analyse your case file