Swedish DPA supervises ICA Sverige AB: a case in data minimisation and control

What happened

The Swedish Data Protection Authority (IMY) has conducted supervision of ICA Sverige AB, one of Sweden's largest grocery retailers, concerning the handling of personal data ^[1]. The case covers both ordinary personal data and sensitive data about health and finances.

The supervision appears to have concluded, as the notice is dated and no further updates have been published ^[1]. IMY has not disclosed whether ICA received a reprimand, a penalty or guidance, and the decision notice itself is not publicly available in full.

That is not unusual. Swedish supervisory decisions often remain brief in their public form, especially when they concern internal processes rather than a data breach that affected a large number of people. What matters for others is the principle: a data controller must be able to show what it did, and when, if a supervisor asks.

The rules at work

Two articles in GDPR are particularly relevant here. Article 5(1)(c) sets out the principle of data minimisation: personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ^[2]. That means an organisation cannot collect everything it might find useful one day. It has to decide what it needs, and leave the rest.

Article 5(1)(f) requires data to be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage ^[2]. Article 32 then specifies that controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk ^[2].

Those measures depend on the context. Encrypted storage, access controls and activity logs are common steps. But here is the difficult part: logs themselves can be edited by someone with the right access. A supervisor might reasonably ask how an organisation knows its logs have not been altered, especially if the person who keeps them could also change them.

Demonstrating compliance

GDPR places the burden of proof on the data controller. Article 5(2) introduces the principle of accountability: the controller must be able to demonstrate compliance with the regulation's principles ^[2]. It is not enough to have a policy that says the right thing. When IMY or another supervisory authority conducts an inspection, they will ask to see evidence that the policy was followed.

That is where records come in. A data processing log, an access log or a retention schedule can show what happened. But those records are worth less if they can be quietly edited. A supervisor does not have to take the controller's word that nothing has changed. They can ask how the controller knows.

Say a bank holds transaction data on its customers. It has a retention policy that says certain data will be deleted after five years. The bank keeps a log of when data was deleted. During an inspection, the supervisor asks to see that log and to verify that it has not been altered. The bank can show the log, but if someone with administrative access could have edited it last week, the supervisor has a harder time trusting it.

An independent fingerprint per log entry changes that conversation. If the fingerprint does not match, the content has changed. The supervisor does not have to trust the bank's assurances. They can check.

What this means for you

If your organisation processes personal data, the ICA case is a reminder to ask three questions:

1. Could you show a supervisor what personal data you held on a given date, and for what purpose? Retention policies are easier to demonstrate when they are backed by records nobody in your organisation could have quietly changed.

2. Do your access logs show who looked at what, and when? Article 32 GDPR requires you to ensure confidentiality and integrity. A log that can be edited by the people it is supposed to monitor is not doing its job.

3. If someone asked whether a log entry had been altered, what would your answer rely on? Trust, or a check anyone can do?

Data controllers often think of compliance as a question of policies and procedures. It is also a question of evidence. When a supervisor arrives, they want to see what you did, not what you say you did. The gap between the two is where digital witnesses fit.

What to watch

IMY's supervision calendar is published on its website, and it gives a sense of which sectors and topics are in focus. In 2025, the authority has indicated that it will look at data minimisation and security measures across a range of controllers, including those handling health data and financial information.

For organisations in those sectors, the time to prepare is before the inspection notice arrives. That means reviewing what data you hold, checking that your retention schedules are followed and making sure your logs can be relied on when someone asks to see them.

The AI Act will add further obligations from 2 August 2026, including logging requirements for high-risk AI systems, and from 2 December 2027 for systems listed in Annex III ^[3]. Those logs will need to meet the same standard: they must be possible to trust. Under GDPR, the question is already live.