IMY Drafts Public Sector Cloud Guidance After Quizzing 19 Bodies

Erik Berg

October 30, 2026 4 min read

Executive Summary

Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY), is drafting public sector cloud guidance and has sent questions to 19 municipalities, regions and state agencies about how they use cloud services. IMY announced the work on 20 October 2026. The questions cover information classification, cloud providers in third countries and exit strategies among other areas. IMY links the guidance to the government’s cloud policy and AI strategy, a changing geopolitical situation and ongoing legal developments in the United States. It has not named the 19 organisations. The guidance was planned before the announcement and is due to be finished during the winter.

What IMY Is Asking About Public Sector Cloud Use

The questionnaire reaches all three tiers of Swedish public administration. According to the IMY announcement, it asks how each body classifies information, whether it relies on cloud providers outside the EU and EEA and what exit strategy it has if a service has to be dropped.

Malin Blixt, a head of department at IMY, said cloud use raises questions of data protection, sovereignty and efficiency particularly in the current state of the world. She said the aim is to give the public sector tools to handle those problems systematically and securely.

IMY gave no detail on which US legal developments it means.

A Government Policy That Makes Exit Plans a Principle

The government adopted Sweden’s first cloud policy for public administration on 28 May 2026. The Ministry of Finance announcement says the policy sets out how to assess risks such as information security, dependencies and resilience. Agencies, municipalities and regions should pick solutions that let them move data and services without unnecessary obstacles, according to the announcement. Open standards, clear contracts and exit plans can reduce the risk of lock-in. Post- och telestyrelsen (PTS), the Swedish telecoms regulator, was tasked with supporting the policy, including guidance on weighing efficiency against security.

The policy isn’t binding. In an interpellation debated in the Riksdag on 18 June 2026, a member argued that the government had chosen to make it guiding rather than governing and pressed Minister for Public Administration Erik Slottner on exit strategies.

IMY’s 2022 Survey Found Agencies Struggling

IMY last looked at public sector cloud use in 2022, as part of a coordinated action by the European Data Protection Board (EDPB) in which 22 data protection authorities took part. It sent a questionnaire to 11 state agencies and seven answered, no municipality or region was asked. In its report dated 16 November 2022, IMY said all seven described finding cloud services that comply with data protection rules as a challenge. It couldn’t tell from the answers whether transfers to third countries always rested on a transfer tool under Chapter V of the GDPR. Only one agency said it examined all data flows including telemetry and diagnostic data. Agencies also reported that contract terms were not always transparent and were often changed unilaterally by the provider.

That survey was not supervision, IMY said at the time. The 2026 announcement doesn’t say whether the new questions are, whether the answers will be published or on what date the public sector cloud guidance will appear.

Exit Strategies Are New on IMY’s List

IMY’s 2022 report covered third-country transfers, telemetry, provider controls and contracts. Exit strategies were not among its topics. They are named in the 2026 questions, less than five months after the government’s cloud policy called for exit plans to limit lock-in. The sample has also changed shape. In 2022 only state agencies were asked; this time municipalities and regions are among the 19.