The Swedish data protection authority provides some guidelines for controllers and data processors: https://www.datainspektionen.se/lagar–regler/dataskyddsforordningen/personuppgiftsansvariga-och-personuppgiftsbitraden/ (in Swedish).