Does a small Swedish company need a data protection officer?

No, not merely because the company is small or processes personal data. An officer is required when the body is a public authority, when the core activity consists of regular and systematic monitoring of data subjects on a large scale, or when the core activity consists of large-scale processing of special categories of data or data on criminal offences. A company may appoint one voluntarily, and the same rules on position and tasks then apply.