On 13 April 2026, the Swedish Data Protection Authority (IMY) published its sandbox report on the use of AI for transcription in social services (Sw. Transkribering inom socialtjänsten). This is referred to below as the Transcription report.
The report examines whether AI-based transcription and summarisation can be used in compliance with the GDPR, with particular focus on legal basis, necessity and sensitive data. IMY’s reasoning turns on the necessity criterion in Articles 6(1)(c) and 6(1)(e) GDPR, and on the same understanding of necessity under Article 9 where special categories of personal data are involved.
IMY is essentially asked a practical question: is the use of AI tools to record, transcribe and summarise conversations necessary for social services to perform their tasks? The report focuses on conversations held in the course of case handling where relevant information must be documented. Against that background, IMY examines whether AI-supported transcription can be used as part of that documentation process in an efficient and GDPR-compliant way.
“Processing is necessary for …”
According to IMY, necessity does not mean that, without a specific processing activity, the objective would be entirely unattainable. The real question is whether the same result can be achieved just as effectively by less intrusive means. In that sense, IMY adopts the view that genuine efficiency gains may support a finding of necessity.
This approach is not new. It reflects the CJEU’s judgment in Latvijas Republikas Saeima (C‑439/19). It also aligns with IMY’s earlier sandbox report of 7 November 2024 on AI-assisted disclosure of public documents (Sw. Utlämnande av allmänna handlingar med hjälp av AI), referred to here as the Disclosure report.
IMY clearly states that “necessity” does not mean that the objective cannot be achieved without processing personal data. Processing can still be necessary if it yields real practical efficiency gains compared with manual alternatives. Here, IMY does not question the municipality’s submission that AI transcription and summarisation can reduce time spent on documentation, limit the need for multiple staff members, shorten case handling and lower the risk of missing important details.
Just as importantly, IMY does not assess necessity step by step. Instead, it considers the process as a whole, including recording, transfer of audio, transcription, generation of summaries and storage of the result. It treats this as one connected workflow.
The Transcription report also makes another key point. The issue is not whether there is a separate legal basis for AI, ASR (automatic speech recognition) or LLMs (large language models). The issue is whether the existing legal basis already covers the task for which the technology is used. In social services, that task is clear: relevant information arising in case handling must be documented. On that basis, IMY considers that Articles 6(1)(c) and 6(1)(e) GDPR may apply, as compliance with a legal obligation and performance of a task in the public interest. The important point is that the legal basis attaches to the function, namely documentation, not to the technology used to carry it out.
On that basis, IMY’s view is that much indicates that the processing may be regarded as necessary and proportionate.
A tool vs a stand-alone system
The Disclosure report is particularly useful in showing the contrast between two different types of AI use. One is a narrower support tool that assists a human in carrying out an existing legal task. The other is a broader system that changes the structure of processing, for example by requiring separate databases, vectorisation, indexing and ongoing analysis of relationships.
In the Disclosure report, IMY takes a noticeably stricter approach to the broader model. The further the technology moves away from supporting an existing function, and the more it changes the scale, structure and risk profile of the processing, the less willing IMY is to accept that a general legal basis is sufficient.
Against that background, the Transcription report can reasonably be read as dealing with a support tool rather than a stand-alone analytical system. IMY evaluates the processing as a single workflow and ties it directly to the task of documentation. It also stresses the need for human review of the output, which supports the view that the system remains an aid to the user rather than a decision-maker.
Sensitive data
As regards the processing of special categories of personal data, IMY applies the same logic. Since conversations in social services often involve such data, it considers the exception in Article 9(2)(h). IMY’s position is that this exception will typically apply. The processing takes place within social services, is grounded in national law, concerns data provided in individual cases and is subject to professional secrecy.
IMY expressly links the concept of necessity under Article 9 to the same meaning it has under Article 6. The conclusion is therefore not a general statement that “AI is allowed”. It is a narrower and more case-specific point: given this task, this legal framework and this organisation of the process, the processing of both ordinary personal data and special categories of personal data may be lawful.
Finally, the Disclosure report is also helpful for understanding IMY’s broader approach to sensitive data. It shows that IMY is particularly cautious where a system creates separate and more independently searchable or analysable bodies of sensitive data. Against that background, it becomes easier to see why IMY was prepared to accept the processing in the Transcription case: the system is assessed as part of the documentation of a specific case, not as the creation of a separate vectorised or indexed dataset for broader analytical use.
For businesses, this report cannot be applied directly because IMY’s conclusions are grounded in the public sector context under Articles 6(1)(c), 6(1)(e) and 9(2)(h). Methodologically, however, it remains relevant. IMY’s reasoning points towards an understanding of necessity that is not limited to what is strictly indispensable, but extends to what is objectively justified where the same result cannot be achieved equally effectively by less intrusive means. IMY does not put it in exactly those terms. Even so, if this approach is applied consistently, it may also become relevant for legitimate interest assessments that include a necessity test.
