Cloud services and confidentiality in the public sector

Cloud services are part of everyday public administration in Sweden, and the secrecy rules determine how they may be used. The EU-US Data Privacy Framework covers personal data. The secrecy rules cover all confidential information and form the Swedish side of US law and data stored in Europe.

When information counts as disclosed

According to the government bill behind the Public Access to Information and Secrecy Act, 2022/23:97, confidential information counts as disclosed when it is made available to a service provider. That holds even when the provider only runs a system for the authority. One exception is information encrypted so that the recipient has no means of reading it.

Chapter 10, Section 2 a has applied since 1 July 2023. Confidentiality does not prevent information from being passed to someone who, on the authority’s behalf, only processes or stores it technically, unless that would be inappropriate in the circumstances. The supplier and its sub-suppliers are then bound by confidentiality under a separate act from 2020.

What must be weighed

The assessment must take all relevant factors into account. The bill mentions the type and volume of information, the recipient’s safeguards and whether the contract risks removing the authority’s control over the information. The geographical location of the processing can matter, as can whether sub-suppliers can access the information and whether it is stored alongside other customers’ data. The government also notes that documenting the assessment can be appropriate when large volumes of information are involved.

The Swedish Security Service and other consulted bodies wanted the assessment to consider whether the recipient is subject to another country’s legal order.

eSam, through which Swedish authorities cooperate on digitalisation, has published guidance on outsourcing, and its page on the cloud question notes that other countries’ laws can have an extraterritorial effect on public clouds. eSam distinguishes between public, shared and private clouds. A private cloud is limited to one organisation, which can matter when requirements on data sovereignty, confidentiality or security weigh heavily.

AI, the cloud policy and questions to ask

The exception applies when the supplier only processes or stores the information technically. An AI service reads and summarises content in order to answer. How that fits the exception has to be assessed case by case, ideally before any information is passed on. The simplest position is one in which nothing is disclosed at all, for example when AI runs on the authority’s own premises.

On 28 May 2026 the government adopted Sweden’s first cloud policy for public administration. It aims to strengthen security, reduce dependencies and improve control over data, and it stresses the ability to change supplier through open standards, clear contracts and an exit plan. The Swedish Post and Telecom Authority will support its application.

Before choosing, an authority needs to know where the information is handled, which sub-suppliers can reach it and whether the environment is shared with other customers. Just as important are which country’s law applies to the supplier and its owners, how data is moved when switching, and whether anything is passed on to public AI services. The answers feed into the assessment and into how it is documented. See also AI in the public sector and AI for strict confidentiality. The next part asks is a sovereign cloud enough?

How it works in iSearch

iSearch can run on your premises, with the whole chain in the authority’s own environment and no public AI services. The information then stays with you.

iSearch can also be hosted by us. The hosting runs in Sweden, by a Swedish company with no US owners and no US-owned sub-suppliers for the hosting. Every customer gets a separate environment that is never shared with others, so the information is not stored together with other customers’ data. Hosted by us, iSearch can run entirely without public AI services, with the language model in the Swedish hosting.

These facts can go straight into your own assessment. If you choose to use public AI services, the data sent there needs to be assessed separately. Read more about on-premises or cloud or book a walkthrough.