Cybersecurity Policy Report, Swedish Agency Releases AI Training Guidance, (Dec 10, 2025)

By Tony Foley

The Swedish Authority for Privacy Protection (IMY) has partnered with a law firm to provide guidance on the use of personal data to create synthetic data to train artificial intelligence models.

In a press release yesterday, IMY said AI training often resulted in personal data processing, which must be done in accordance with the European Union’s General Data Protection Regulation (GDPR). The guidance, which may be downloaded from the press release but is available only in Swedish, specifies that when personal data previously collected for a specific purpose is used to train an AI model, the further processing must be compatible with the original purpose. This requirement may be easier to meet if the AI model is instead trained on synthetic data, which is created to resemble the original data but cannot be linked to specific individuals.

Law firm Familjens Jurist set out to train an AI model on data from custody cases, without processing personal data, aiming to be able to use AI to predict which cases were at risk of becoming conflictual and to identify potential interventions. In IMY’s regulatory sandbox, the agency and Familjens Jurist investigated issued linked to the project, including synthesis. The published guidance is designed to provide insights for more businesses.

"We see that it can be very positive from a privacy perspective to train an AI model with synthetic data. At the same time, synthesis itself means that personal data is processed, which needs to comply with the General Data Protection Regulation,” says Stina Almström, lawyer at IMY. “The project we investigated was about custody cases. It is therefore largely information of a very sensitive nature, which requires special considerations and measures.”

Public and private organizations can register their interest in participating in the IMY sandbox with their AI innovation projects. The deadline to register for the spring sandbox is Dec. 12.

News: InternationalLegislation DataPrivacy GDPR AINews