Sportadmin Fined SEK 6 Million for GDPR Data Leak

The Swedish Authority for Privacy Protection (IMY) has issued an administrative fine of SEK 6 million against Sportadmin for violations of the General Data Protection Regulation (GDPR). This action follows an IT attack in January 2025 where personal data of over 2.1 million individuals, including sensitive health data and information on children, was leaked onto the Darknet. IMY determined that Sportadmin failed to implement an appropriate level of technical and organizational security measures, despite being aware of system weaknesses and elevated risks, and lacked adequate intrusion detection capabilities.

This enforcement action highlights the critical need for robust data security practices under GDPR. Regulated entities, particularly those processing sensitive personal data or data of minors, must ensure their security measures are adequate and actively monitored. While no specific compliance deadline is mentioned for Sportadmin's remediation, the SEK 6 million fine underscores the significant financial penalties for non-compliance with GDPR security requirements. Companies should review their cybersecurity protocols, risk assessments, and intrusion detection systems to prevent similar breaches and avoid substantial fines.