Hybridity9 in 10 Swedish IT service companies publish data protection policies that no longer match their own company structure
We read 813 public policy documents from 90 IT consultancies and managed service providers at the end of October 2026. Most of the gaps we found are maintenance problems: texts that were right when they were written and have not been updated since.
Privacy notice- companies analysed
- 90
- public documents
- 813
- obligations checked
- 3,690
- findings
- 1,351
What we looked at
The sample covers IT consultancies, managed IT and security service providers and cloud, hosting and data-centre operators. We recorded 1,351 findings, about 15 per company.
Three issues came up more often than any others: naming the company responsible for personal data, cookie information, and telling whistleblowers how to report to the authorities. Retention periods were a close fourth, with 76 of 89 companies giving no period or criteria for at least one category of data.
Key figures
Each figure counts only the companies where we could check that requirement, so the base varies.
The data protection policy does not clearly name the company responsible
At least one privacy notice leaves out, or gets wrong, which company is responsible for the data or how to contact it. Some notices name only a brand or the group. Others name a parent company that has since merged or moved, or say the controller is whichever group company the reader deals with. A client, job applicant or subcontractor cannot tell where to send a request. The controller is the legal entity that answers for the data and that IMY, the Swedish supervisory authority, holds to account.
Cookies on the website do not match what the cookie policy says
The cookie banner, the cookie policy and what the site actually loads do not match. Typical findings: the cookie list is missing or leaves out providers that load on the page, statistics and marketing cookies are labelled as necessary, or the only way to withdraw consent is through browser settings. In at least 16 of the 77 companies, our test browser received analytics or marketing cookies before anything had been clicked in the banner. Without valid consent these cookies may not be set, and anyone can check this from outside in a few clicks.
The whistleblowing page does not explain how to report to the authorities
The whistleblowing page does not fully explain how to report to a competent authority. Most pages describe the internal channel in detail but leave out which authorities receive reports and that the same legal protection applies when reporting externally. The page is public, so anyone can see what is missing. Without it, employees and consultants may not know they can report to an authority with the same legal protection.
Why the gaps appear
None of these are gaps in legal knowledge. They come from how the documents are maintained.
Copies drift.
The banner, the cookie policy and the privacy notice are usually edited by different people in different tools, and each language version separately. When marketing adds a tag to the site, the cookie policy is rarely updated at the same time.
Templates outlive their source.
A group notice is written once and reused by Swedish subsidiaries it never names. Seven companies still have unfilled template fields or placeholder links online, several of them on whistleblowing pages.
Nobody owns the date.
Acquisitions, mergers and office moves change who the controller is, but the notice stays the same. Seven notices still describe access rights under the Personal Data Act, which was repealed in May 2018, and two cookie policies cite the Electronic Communications Act of 2003.
Three examples
One example per cause, with wording that would close the gap.
| Example | Gap found | Proposed fix |
|---|---|---|
| Copies drift. The banner and the policy were edited separately. | A Swedish IT consultancy’s banner says cookies are used for personalised advertising and refers to the privacy policy for details. The policy lists no cookies and does not mention advertising. | Generate the table from the consent tool’s own scan so it updates when the tags change. “With your consent, we use cookies for statistics and advertising. The table below lists each cookie, who sets it, why and how long it is kept.” LEK (2022:482) 9 kap. 28 § |
| Templates outlive their source. A group template was reused without naming the Swedish company. | The Swedish notice of a provider in an international group says the controller is any group company the reader “has a relationship with”. The imprint names only the foreign parent. | “[Company] AB (org. no. [number]), [postal address], is the controller for personal data collected through [site] and in our Swedish operations. Privacy questions: [privacy mailbox].” GDPR Art. 13(1)(a) |
| Nobody owns the date. The rule changed in 2018 and the text did not. | A Swedish IT consultancy’s notice limits free access to personal data to once per calendar year. That limit comes from the Personal Data Act, repealed on 25 May 2018. | “You have the right to confirmation of whether we process personal data about you and, if we do, to a copy free of charge. We answer without undue delay and within one month.” GDPR Art. 12(5), Art. 15 |
What to do about it
A yearly review finds these gaps, and many of them are back within months. On an IT company’s website, a new tag, form or subsidiary can reopen a gap with the next release. The answer is to run policies like any other operational process: each published document has an owner and a review date, copies come from one master text, and changes to the site or the group trigger a check of the documents they affect.
Example: a new analytics tag
Marketing adds a new analytics tag to the website. This is how it moves through Hybridity:
01Snapshot
Public documents and site behaviour are checked against the applicable rules, and the tag that loads before consent is flagged.
02Rulebook
Each policy is broken into rules traced to the legal source. The consent rule is linked to both the cookie policy and the banner.
03Tasks
The gap gets an owner, who sets the tag to wait for consent, updates the cookie list and uploads a clean-browser test as evidence.
04Monitoring
When a rule, a group company or the site changes, the documents affected are flagged for review.
Your team approves every change before it is published.
Hybridity turns policies into rules with owners, tasks and evidence. Closing compliance gaps before they become barriers, so you can move faster.
Get your gap analysis
See what your public documents say today, and what it takes to close the gaps.
First analysis for free, no commitment.
Robert Lyngman, CRO · robert@hybridity.ai
Source: Hybridity Regulatory Exposure Snapshots, 90 IT and managed service providers, Q4 2026, week 4. 813 public documents read, 3,690 obligations checked.
Markets: Sweden (82 companies); global group sites assessed under EU, UK and US rules (8 companies). Percentages are rounded and use a different checked base for each requirement.
Regulatory areas: GDPR and the Swedish Data Protection Act, cookies (LEK), whistleblowing, the E-commerce Act, the Digital Services Act and Data Act, company and sustainability disclosures, UK modern-slavery statements, US state privacy law, accessibility, and document control.
A finding is a statement about a document, never a verdict on the company. Obligations that can only be evidenced internally have not been counted. This report is for information only. It is not legal advice and is not binding.