Amendments and additions to the Access Agreements for the IA System

Amendments October 2020

Appendix 2 – Data Processing Agreement

Section 12.1.2 has been clarified with the text […] as well as other necessary protective measures required in the individual case; […].     

Section 12.3: If Data Processor intends to transfer Personal Data to a third country, the Data Processor shall, before such transfer takes place, inform the Data Controller of this.

Amendments March 2020

Appendix 1 - General terms and conditions

In Appendix 1 - General Terms and Conditions, apart from minor editing changes, the main changes are as follows:

Clause 3.2: Amendments and additions to the Association Agreement will be published on (

Clause 3.3: The User Company is entitled to withdraw from the Association Agreement up to and including the date that the change in terms and conditions comes into force.

Clause 6.2: In the event of planned downtimes, the User Company will be notified by information about them published in the IA system prior to the downtime occurring.

Clause 8: The division of responsibility between AFA Trygghetsförsäkring and the User Company in respect of personal data has been clarified for the purpose of further explaining which personal data processing each party is responsible for.

Clause 12.2: For additional services such as technical systems support, the cost will be SEK 1200 per hour.

Appendix 2 - Personal Data Processing Agreement

In Appendix 2 - Personal Data Processing Agreement, apart from minor editing changes, the main changes are as follows:

Clause 7.3 (new): The sub-processors processing the personal data on behalf of the User Company must always be listed on

Comment: This provision is new and is intended to make it easier for the User Company to exercise its responsibility for checking who is performing the processing of the personal data. However, in accordance with Clause 7.4, AFA Trygghetsförsäkring will always, and without unnecessary delay, inform the User Company in writing of its intention of engaging a new sub-processor.

Clause 9 (formerly 7): The liability provision has been changed to make it clearer that it takes account of Article 82 of GDPR with regard to responsibility for fines and the possibility of limited liability and recourse in relation to claims for damages from data subjects.

Clause 12 (formerly 10): AFA Trygghetsförsäkring shall only be entitled to transfer personal information belonging to the User Company to a third country where the following conditions are fulfilled:

  • the third country guarantees an adequate level of security for personal information in accordance with a decision handed down by the EU Commission;
  • there are suitable security measures in place in accordance with the applicable personal data legislation, e.g. standardised data protection provisions adopted by the EU Commission which cover the transfer and  processing of personal data; or
  • in the opinion of the Data Processor, it is possible to rely on another exemption under applicable personal data legislation for the transfer of personal data.

Comment: This provision means that the transfer of personal data to a third country can only be done in accordance with the rules in Chapter V of the GDPR.