New laws 1 July 2026: strengthened cybersecurity and e-evidence

On 1 July 2026, new rules begin to apply. Most are aimed at authorities. But they show which way the wind is blowing: requirements for information security are increasing.

Strengthened national cybersecurity centre

New laws strengthen the national cybersecurity centre at FRA. The centre will find it easier to share information between authorities. It will also be able to handle personal data in its work and protect data from private individuals who get in touch. The goal is to detect and stop cyber threats faster.

New rules for electronic evidence (e-evidence)

From 1 July 2026, service providers can report a disclosure point in Sweden. From 18 August, they can begin to disclose electronic evidence under the new rules. It is part of the EU’s rules for cross-border evidence gathering.

What it means for you

Most small businesses do not need to do anything urgent. But together with NIS2/Cybersecurity Act, which has applied since January 2026, the trend is clear. Documented security and knowing where data ends up are becoming increasingly important. This also applies to smaller suppliers selling to larger customers.

An easy first step is to review the basics:

• Get a password manager, for example 1Password or Bitwarden.
• Choose a storage location where you know where the data is, for example Nextcloud.

Do those two things and you have done your part of this legislative package. The rest, the cybersecurity centre and the e-evidence rules, is the authorities’ table, and for most small businesses the right move right now is to wait and see.