---
title: "Use Swedish personal identity numbers only · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/records-and-data-map/swedish-personal-numbers
id: CMP-80
level: Required
region: SE
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 981
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use Swedish personal identity numbers only when clearly justified

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-80
- Level: Required
- Chapter: [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md)
- Rule: Collect a Swedish personal identity or coordination number only with consent, or when the purpose or a secure identity clearly justifies it. Record that reason per field.
- Check: A schema scan finds every column whose values match the pattern of a Swedish personal number. Each one has a recorded reason in the data map. A log scan of the last 7 days finds no full personal number.
- Risk: A law broken
- Region: Sweden (SE). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: Chapter 3 section 10 of the Swedish data protection act, lag (2018:218), sets this test. A number is often justified for credit checks, salary and tax reporting, or signing in with a national e-ID. It is rarely justified as a plain customer ID or a newsletter field. Never use it as a key in addresses, logs or exports, and mask it on screens to the birth date. Flag its column as sensitive in the [data map](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map.md), and encrypt it as [field encryption](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md) shows. The supervisory authority, IMY, checks this in its audits.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const SWEDISH_PERSONAL_NUMBER = /\b(19|20)?\d{6}[-+]?\d{4}\b/;
export const leaksPersonalNumber = line => SWEDISH_PERSONAL_NUMBER.test(line);
```

### Python example

```python
import re

SWEDISH_PERSONAL_NUMBER = re.compile(r"\b(19|20)?\d{6}[-+]?\d{4}\b")

def leaks_personal_number(line: str) -> bool:
    return bool(SWEDISH_PERSONAL_NUMBER.search(line))
```

## Sources

- [Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, chapter 3 section 10](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/)
- [GDPR Article 87 on national identification numbers](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- CMP-7 [Map every store that holds personal data](https://agentwranglers.se/playbook/compliance/records-and-data-map/data-map.md) in Compliance and governance
- APS-58 [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/records-and-data-map/swedish-personal-numbers">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep accounting records for seven years in Sweden](https://agentwranglers.se/playbook/compliance/records-and-data-map/swedish-bookkeeping-retention.md)
- Next: [Keep every GDPR request in one register with its deadline](https://agentwranglers.se/playbook/compliance/records-and-data-map/gdpr-request-register.md)
- [Records and data map](https://agentwranglers.se/playbook/compliance/records-and-data-map.md)