Right to work, posted workers, personal data and access are regulated in different ways. The overview distinguishes six regulatory areas – including the Swedish CER/LOM proposal – from the method of examining identity document authenticity.
What makes it hard in practice is that the requirements have different owners. The Migration Agency, the Work Environment Authority, the Police, the Tax Agency and the data protection authority each look at their own part, while responsibility for having all the parts in place sits with whoever lets the person onto the site.
Below is what each one requires, and what Sistec Compliance Platform does about it.
Regulatory areas and checking method
The Aliens Act
The employer must verify that foreign staff have the right to work in Sweden and retain the evidence. The check must happen before employment or access.
Work and residence permits are verified against the authorities' sources. Permits with an end date are monitored and flagged before they expire.
The Posting of Workers Act
Foreign employers sending staff to Sweden must notify the Work Environment Authority no later than when the work begins.
Posting status is checked against the Work Environment Authority at enrolment and monitored throughout the assignment.
GDPR article 10
Data on criminal convictions may only be processed under official authority or with explicit legal basis. Criminal record extracts may not be freely collected and stored.
The extract is ordered by the individual, presented in the original and examined in person. Only a note that it was examined is kept — never the extract itself. Sistec holds a permit from IMY to process personal data about criminal offences in background checks (reference number IMY-2026-3140).
The Protective Security Act (2010:305)
Access to protected sites requires established identity. Whoever is responsible for the site must be able to show who was let in.
The identity document is read by machine using chip, UV and IR, and the face is matched against it. Every entry is logged.
The Work Environment Act
Whoever controls a workplace is responsible for the working environment of hired staff and contractors too, and must know who is present.
Digital staff ledger with check-in and check-out, mandatory site induction and client-specific requirements before access.
Checking method: identity document authenticity
Authenticity examination is a checking method, not a separate regulation. The method needs to suit the document and the purpose of the check.
ICAO chip reading, UV and IR examination of security features, and facial matching against the document.
The CER directive / LOM
LOM is a legislative proposal with a proposed effective date of 1 January 2027. It includes background checking requirements for a defined group of people in critical entities.
Background screening designed around the LOM proposal, with a documented scoping of which roles are covered and automatic reminders before the next check.
Which of them apply to you?
Which rules reach you depends on your sector, your site and who passes through it. We will go through it with you.
Sources
- Arbetsmiljöverket – Utstationering av arbetstagare i Sverige
- Regeringen – Ny lag stärker samhällsviktiga tjänsters motståndskraft, prop. 2025/26:303 (regeringen.se)
- IMY – Personuppgifter som rör lagöverträdelser
- IMY – Bolag som har tillstånd att behandla personuppgifter om lagöverträdelser för att utföra bakgrundskontroller