Customer contracts, website terms and GDPR for a small Swedish company
Terms must reach the customer before the contract to apply, consumers have fourteen days to withdraw from a distance contract, and the GDPR applies from the first personal data item however small the company is.
What the rules say
- The Contracts Act: a contract is formed by offer and acceptance, and terms must have reached the other party.
- The Distance Contracts Act: the consumer has fourteen days to withdraw, subject to exceptions for certain goods and services.
- The Swedish Data Protection Act and the GDPR: the duties apply whatever the headcount, with a limited record-keeping exemption below 250 employees.
The requirements line by line
| Question | Requirement | Source |
|---|---|---|
| Contract rule | A contract is formed by offer and acceptance. Terms not communicated before the contract is concluded normally do not become part of it. | SFS 1915:218, avtalslagen |
| Consumer distance sales | In distance contracts with consumers, prescribed information must be given before purchase and the consumer has a fourteen-day right of withdrawal, subject to exceptions. | SFS 2005:59, distansavtalslagen |
| Defects | The Consumer Sales Act governs defects, remedy, price reduction and cancellation, and cannot be contracted away to the consumer's detriment. | SFS 2022:260, konsumentköplagen |
| Price information | Marketing must be accurate, and material information about price and terms may not be left out. | SFS 2008:486, marknadsföringslagen |
| Personal data | The GDPR applies whatever the size of the company. The record-keeping exemption below 250 employees does not apply where processing is regular or involves special categories. | SFS 2018:218, lagen med kompletterande bestämmelser till EU:s dataskyddsförordning |
Thresholds and limits
| Limit | What it triggers | Source |
|---|---|---|
| 14 days | Right of withdrawal in consumer distance contracts | SFS 2005:59, distansavtalslagen |
| 250 employees | Below the limit records are required only for regular processing, risk or special categories | SFS 2018:218, lagen med kompletterande bestämmelser till EU:s dataskyddsförordning |
What it means for the company
Put the terms in the purchase flow, not in the footer. A term the customer never saw before buying rarely holds in a dispute, and the same goes for the withdrawal information.
What it means for the individual
As a consumer the withdrawal period runs from the day you received the goods, and it must appear in the information given before the purchase.
Source lines
- Svensk författningssamling, RiksdagenSFS 1915:218, avtalslagen · read 2026-08-25 · proof 3ca9d3e96168aa55
- Svensk författningssamling, RiksdagenSFS 2005:59, distansavtalslagen · read 2026-08-25 · proof 3ca9d3e96168aa55
- Svensk författningssamling, RiksdagenSFS 2022:260, konsumentköplagen · read 2026-08-25 · proof 3ca9d3e96168aa55
- Svensk författningssamling, RiksdagenSFS 2008:486, marknadsföringslagen · read 2026-08-25 · proof 3ca9d3e96168aa55
- Svensk författningssamling, RiksdagenSFS 2018:218, lagen med kompletterande bestämmelser till EU:s dataskyddsförordning · read 2026-08-25 · proof 3ca9d3e96168aa55
Next step
Walk the purchase flow step by step and check where terms, price information, withdrawal rights and privacy information are actually shown.
This page reports what the sources say, with the identifier and address of the publisher. It is not legal advice and does not decide an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.