Hybridity2 out of 3 pharma and medtech companies don’t say which legal entity is responsible for personal data.
We read 879 public policy documents from 94 companies in Sweden. Unclear responsibility, incomplete reporting instructions and outdated authority details reveal an operational pattern.
Privacy notice- companies analysed
- 94
- public documents
- 879
- obligations checked
- 3,917
- findings
- 1,392
Different sector. Familiar gaps.
We analysed 879 public policy documents from 94 pharma and medtech companies in Sweden: pharmaceutical companies and affiliates, medtech and diagnostics manufacturers, contract manufacturers, wholesalers and pharmacies. They produced 1,392 findings.
Three patterns stand out. Unclear controller identity. Incomplete external reporting instructions. Complaint information that has not kept up with the authority it refers to.
The headline is rounded from 59 of the 91 companies whose privacy notices we could check for controller identity. These findings describe published documents, not the companies’ internal compliance.
Three gaps hiding in plain sight.
Each figure counts only the companies we could check for that requirement, so the base varies. Percentages are rounded.
Which legal entity is responsible?
The privacy notice does not identify the legal entity that is the controller. It names the group, a brand or a parent abroad without making responsibility clear. A patient reporting a side effect, a healthcare professional or a job applicant cannot tell which company to turn to.
Where can someone report externally?
The whistleblowing page does not fully explain how to report to a competent authority. Of these 33 companies, 21 say nothing at all. Someone who does not trust the internal channel is not told where else to go. The page is visible to employees, journalists and supervisors.
Where can someone complain?
The privacy notice does not point readers correctly to IMY. Of these 41 notices, 15 still name Datainspektionen and 14 do not mention the right to complain at all. The authority changed its name on 1 January 2021, more than five years before this snapshot.
Why the same gaps keep coming back.
The findings point to operational problems. Three mechanisms help explain how a document can change in one place and stay unchanged in another.
Copies drift.
Group notices, Swedish pages and PDFs are edited separately. An old copy remains searchable after a new one has been published.
Templates outlive their source.
Group templates and drafting notes go live and stay. A placeholder survives where a working telephone number or link should be.
Nobody owns the date.
External facts change on a date nobody tracks. An authority changes its name, but the notice keeps the old name and address.
What the page says. What needs to change.
One example per mechanism, with proposed wording to address the finding. Replace bracketed placeholders with verified details before publishing.
| Example | Gap found | Proposed fix |
|---|---|---|
| Two Swedish notices. Only one is current. | An older Swedish privacy notice is still published at a different address, and a web search finds it before the current one. The two versions differ. | Take the older copy offline or redirect it, then date the current notice. “This privacy notice was last updated on [date] and replaces all earlier versions.” GDPR Art. 12(1) |
| The hotline number was never filled in. | Both language versions of the whistleblowing page tell reporters to call a bracketed placeholder. The page itself gives no number. | Replace the placeholders with the working number and reporting link before publishing. “To report by phone, call our whistleblowing line on [Swedish number]. You can also report in writing at [URL] or ask for a meeting.” Lag (2021:890), 5 kap. 9 § 1 p. |
| The authority changed. The notice did not. | The privacy notice tells readers to complain to Datainspektionen, at its old web address. | Update the authority name and link in every published copy. “You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.” GDPR Art. 13(2)(d) |
From one snapshot to staying current.
A yearly gap list captures a point in time. Keeping the findings from returning takes ongoing ownership of the policies, their published copies and the facts they depend on.
Name the actual legal entity responsible for the processing and provide its contact details. Explain the right to complain and give readers current authority information. Keep each Swedish notice specific to the processing it describes.
Copies should follow one master text, with old versions removed or redirected. Facts that change documents, such as authority names, company names after a divestment and office addresses, need a review date and someone responsible.
From a policy update to action.
Step 1 is what this report did for 94 companies. Steps 2 to 4 show how to keep findings from returning. Follow an illustrative correction to an outdated authority reference.
01Snapshot
Check public documents against the requirements that apply.
02Rulebook
Keep each disclosure requirement linked to its source policy.
03Tasks
Assign the correction and check every published copy.
04Kept current
Track changes, collect evidence and keep a reviewer involved.
Hybridity turns policies into rules with owners, tasks and evidence, and flags what a change touches. Closing compliance gaps before they become barriers, so you can move faster.
Get your gap analysis.
See what your public documents say today, and what it takes to close the gaps.
Source: Hybridity Regulatory Exposure Snapshots, 94 pharma and medtech companies, Q4 2026 week 2. 879 public documents read, 3,917 obligations checked and 1,392 findings. Market: Sweden (94 companies).
Percentages are rounded and use a different checked base for each requirement: 59/91 for controller identity, 33/34 for external reporting information and 41/91 for complaint information. Subcounts within a finding are not presented as mutually exclusive categories.
Regulatory areas: GDPR, cookies and ePrivacy (LEK), whistleblowing, document control, statutory company information, accessibility, distance selling, corporate governance, sustainability reporting, medicines and medical-device rules, marketing, EU Data Act, and foreign rules that apply to some group documents.
A finding is a statement about a document, never a verdict on the company. Obligations that can only be evidenced internally have not been counted.
References: GDPR Articles 12 and 13; Lag (2021:890), Chapter 5, Section 9; IMY’s name change on 1 January 2021.