Fredrik Gustafsson

Data transfers to India

1 Introduction

Briefly before the summer holidays, the Irish Data Protection Commission imposed a substantial €530 million fine on TikTok for its violations of the General Data Protection Regulation (GDPR) relating to the transfer of personal data to China, and warned that it may suspend all such transfers. This decision once again underscores the critical importance of ensuring compliance with the GDPR when transferring personal data internationally.

As we all know, India is a major player in technology-intensive industries, and many Swedish companies have already outsourced, or are planning to outsource, all or parts of their IT operations there. To provide practical guidance for Swedish companies – and considering the TikTok fine – TM & Partners and Panag, Babu & Sarangi have produced this whitepaper. It outlines recent developments, highlights what you need to know, and sets out key considerations to ensure that transfers of personal data to India are lawful.

2 Transfers to India and other countries outside the EU/EEA

2.1 Adequacy decision, appropriate safeguards, and specific derogations

2.1.1 Overview

The GDPR lays down the conditions for when transfers of personal data to countries outside the EU/EEA are permissible. As a general rule, transfers of personal data outside the EU/EEA may only be transmitted when:

1. Adequacy decision: There is a decision from the European Commission admitting that the relevant receiving country ensures an adequate level of protection;
2. Appropriate safeguards: The sending entity has implemented appropriate safeguards such as Standard Contractual Clauses (SCC); or
3. Specific derogation: a specific situation making the transfer admissible is applicable.

2.1.2 Adequacy decision

For India, there is currently no adequacy decision from the European Commission (EC) determining that India offers an adequate level of data protection under the GDPR. To this date, the EC has recognised Andorra, Argentina, Brazil, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom[1], the United States (commercial organisations participating in the EU-US Data Privacy Framework), and Uruguay as providing adequate protection. The adequacy decisions for these countries have the effect that personal data can flow from the EU/EEA to that third country without any further safeguard being necessary, subject to the restrictions and provisions under the EC’s decision and the GDPR.

2.1.3 Appropriate safeguards

In addition to an adequacy decision, transfer of personal data outside of the EU/EEA can be permitted to territories if appropriate protection measures have been taken.[2] There are different types of appropriate safeguards, such as Binding Corporate Rules (“BCR”) or Standard Contractual Clauses (“SCC”).

SCCs are the most commonly implemented safeguards. SCCs are model contract clauses that have been “pre-approved” by the European Commission, setting the general framework for data transfers by regulating the rights and obligations for both exporters and importers of personal data to territories outside the EU/EEA. The SCCs may not be amended by the parties. However, the parties are free to incorporate the SCCs into a broader commercial agreement, provided that the agreement between the parties does not include any contradictions to the SCCs or in any way prejudice the rights of data subjects.

In some cases, additional safeguards may need to be put in place, beyond e.g. SCCs. This is the case if the level of protection in the recipient country is not effective and the protection cannot be guaranteed by the appropriate safeguards, due to e.g. national legislation that makes it impossible to maintain adequate safeguards in practice.

In June 2021, in the wake of a CJEU judgementC-311/18 (Schrems II), the EDPB adopted recommendations on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data.[3] The EDPB recommends exporters to do an assessment in the following six steps.

1. Know the transfers, by mapping all transfers of personal data to third countries;
2. Verify the transfer tool the transfer relies on, e.g. Articles 45, 46 and 49;
3. Assess if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools the processing is relying on, in the context of the specific transfer;
4. Identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence;
5. take any formal procedural steps the adoption of the supplementary measure may require, depending on the Article 46 GDPR transfer tool relied on; and
6. re-evaluate at appropriate intervals the level of protection afforded to the personal data that is transferred to third countries and to monitor if there have been or there will be any developments that may affect it.

The assessment in step 3 above includes examining if there is anything in the law and/or practices in force in the country outside the EU/EEA (in this case India), that may impinge on the effectiveness of the appropriate safeguards of the transfer tools the exporter relies on, in the context of the specific transfer. The EDPB clarifies that exporters, in the assessment, need to focus first and foremost on third country legislation that is relevant to the transfer. The assessment needs to include examining the practices of the third country’s public authorities and ensuring the effective protection, in practice, of the personal data transferred. Examining these practices will be especially relevant for the assessment where: (i) legislation in the third country formally meeting EU standards is manifestly not applied/complied with in practice; (ii) there are practices incompatible with the commitments of the transfer tool where relevant legislation in the third country is lacking; (iii) the transferred data and/or importer fall or might fall within the scope of problematic legislation (i.e. impinging on the transfer tool’s contractual guarantee of an essentially equivalent level of protection and not meeting EU standards on fundamental rights, necessity and proportionality).[4]

The EDPB has drafted a non-exhaustive list of examples of supplementary measures with some conditions that they would require to be effective. Such supplementary steps are only necessary if the assessment reveals that the third country legislation and/or practices impinge on the effectiveness of the Article 46 GDPR transfer tool that the exporter is relying on or the exporter intends to rely on in the context of the transfer. Supplementary measures may include technical or additional contractual measures, or, depending on the context, a combination of the two. Technical measures may include e.g. encryption, pseudonymization, or similar technical access restrictions, while additional contractual measures may include transparency obligations or obligations on the importer to commit to reviewing and to challenge an order from a requesting public authority.

2.1.4 Specific derogations

In specific situations and under certain conditions, personal data can be transferred to a third country or an international organisation even if there is neither an adequate decision issued by the EC nor any applicable safeguards. It is important to recognise that this is a last resort to enable a transfer and should never be seen as a default solution to enable third country transfers. Such derogations must be interpreted restrictively and cannot be used for routine, large-scale, or repeated transfers. Such specific situations include:

• If the data subject has given their consent. However, this exception is subject to strict conditions. While the general requirements for valid consent under the GDPR still apply, additional and more specific elements are necessary for consent to serve as a legal basis for international data transfers.
• If the transfer is necessary for the performance of a contract between the data subject and the controller, or for the implementation of pre-contractual measures taken at the data subject’s request. In this context, the data subject must be a party to the contract, and there must be a close and substantial connection between the data transfer and the purpose of the contract.
• If it is necessary for important reasons of public interest recognised in EU or member state law.
• If necessary for the establishment, exercise, or defence of legal claims.
• If the transfer is necessary to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent.
• The transfer, under certain conditions, is made from a register which, under national or EU law, is for public information.

Lastly, in cases not covered by the above exceptions, a transfer may be allowed if it is not repetitive, concerns only a limited number of data subjects, and is necessary for the compelling legitimate interests pursued by the controller. Such an exception requires that the controller has assessed all the circumstances of the transfer, provided suitable safeguards, informed the supervisory authority and the data subject, and ensured that the transfer does not override the rights and freedoms of the data subject.

2.2 Transfer impact assessment

While the GDPR does not explicitly mention transfer impact assessments (“TIAs”), it is an essential compliance tool considering the EU data transfer rules. TIAs are closely related to data protection impact assessments (“DPIAs”), which are explicitly governed by Article 35 GDPR. Though both assessments aim to evaluate and mitigate risks, they apply in different contexts and serve distinct purposes.

A TIA is required when personal data is transferred to a third country outside the EU/EEA, and stems from the obligations set out in Articles 44-50 GDPR.[5] Its purpose is to identify and evaluate the potential risks of such transfers, focusing on how the personal data will continue to enjoy protection equivalent to that afforded by the GDPR.

It is crucial that the TIA is conducted before any data transfer takes place, ensuring that the controller, through a documented evaluation, can demonstrate compliance with the GDPR. The TIA should also be regularly reviewed, especially if relevant laws or circumstances change.

Failure to perform an adequate TIA and demonstrate compliance of the GDPR may expose the controller to penalties and administrative fines.[6] Recent enforcement actions, such as the record-breaking fine of 1.2 billion EUR against Meta[7] and the 530 million EUR fine against TikTok[8], highlight the importance of conducting an adequate assessment. These cases underscore that supervisory authorities expect organisations to conduct thorough, case-by-case assessments and not rely on generic or incomplete risk evaluations.

2.3 Transfer of personal data to India

For India, since there is currently no adequacy decision from the European Commission determining that India offers an adequate level of data protection, controllers need to assess other options for a transfer of personal data to be permitted. This places high demands on the controller to assess, among other things, India’s legislation to determine whether it offers sufficient guarantees that the personal data will be subject to at least the same level of protection as if the personal data processing were carried out within the EU/EEA.

3 Indian law

3.1 Overview

The Indian parliament enacted India’s first comprehensive data protection law on 11 August 2023, namely the Digital Personal Data Protection Act 2023 (the “DPDPA”). The DPDPA will replace India’s existing patchwork of data protection rules and is expected to trigger significant changes in how companies subject to Indian data protection laws process personal data. The DPDPA is a concept-based legislation that has remained in suspended animation, awaiting implementation.

The DPDPA, whilst being the proposed central data protection regime, is also a response to the Indian Supreme Court’s decision in Justice K.S. Puttaswamy v Union of India[9] (Puttaswamy Case), which read Article 21 (Protection of life and personal liberty) to include the right to privacy. The Puttaswamy Case of 2017 was a landmark decision in Indian jurisprudence as an intrinsic part of the fundamental right to life and personal liberty of every individual guaranteed by the Constitution. Therefore, the violation of any individual’s right to privacy, particularly foreign data subjects who may not fall under the scope of other local laws and regulations, may enable them to seek remedies for breaches of their fundamental rights before constitutional courts. The Indian courts have recognised the rights of foreign citizens to be forgotten and to require the destruction of evidence collected in a breach of procedural and substantive safeguards. However, these cases are isolated and may have limited precedential value.

3.2 Background of the DPDPA

The DPDPA, which was promulgated in 2023 and notified as a law in the Official Gazette after approval by both houses of Parliament and receiving the President’s assent, has not yet become operational. The DPDPA is expected to be operationalised after the establishment of the regulatory authority (“Data Protection Board”) and the notification of the subordinate rules, i.e., the (draft) Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), as these will provide interpretative guidance on procedural steps and enforcement methodology.

The DPDPA introduces key concepts similar to the GDPR[10], such as:

• Data Principal: The individual to whom the personal data relates (equivalent to a data subject under the GDPR).
• Data Fiduciary: The entity that determines the purpose and means of processing personal data, alone or in conjunction with others (equivalent to a controller under the GDPR).
• Data Processor: An entity that processes personal data on behalf of a controller.

3.3 DPDPA and the GDPR

With the soon-to-be-implemented DPDPA, the protections provided to data subjects under Indian law would be commensurate with those provided for in the GDPR. The GDPR and the DPDPA follow broadly similar principles and are conceptually embodied in a consent-based model. The DPDPA is, however, tacitly different from the GDPR, with such specific granular differences explained below:

3.3.1 Scope

The DPDPA regulates the processing of digital personal data, i.e., personal data collected in digital form, or collected in non-digital form and subsequently digitised. The GDPR is applicable to digital as well as, under certain circumstances, non-digital personal data. The scope of the DPDPA is therefore limited in its application to only digitised personal data.

Additionally, the definition of personal data under the DPDPA is quite similar to that prescribed under the GDPR; however, the definition under the DPDPA excludes any publicly available personal data, made available by the data principal or by any other person under a legal obligation to make that data publicly available, from its scope.

3.3.2 Legal basis for processing of personal data

The DPDPA provides that controllers may lawfully process personal data only with the consent of the data principals or for certain specified “legitimate uses”. Such legitimate uses include:

• processing of personal data voluntarily shared by the data principal for a specified purpose (provided that the data principal does not object);
• processing to comply with the law or court orders;
• for employment purposes;
• or to respond to medical emergencies, epidemics, or disasters.

However, the DPDPA does not permit processing for the lawful bases of contractual necessity or legitimate interests, unlike the GDPR, which recognizes these categories as a lawful basis for processing.

3.3.3 Consent Standards

The DPDPA’s consent standard is similar to that of the GDPR, with consent required to be obtained as “free, specific, informed, unconditional and unambiguous with a clear affirmative action.” However, the DPDPA does not categorise consent as ‘explicit’ or otherwise, as has been recognised in the GDPR for the processing of sensitive personal data. As has been set out below, the DPDPA does not classify any categories of personal data either.

3.3.4 Data subject rights

Whilst data subjects will have certain rights similar to those under the GDPR (i.e., rights of access, correction, or erasure), there are certain additional rights in the DPDPA which are unique to Indian data protection regulation. The DPDPA prescribes the right to a readily available and effective means of grievance redressal (e.g., via a grievance redressal officer) by the controller, which needs to be exhausted prior to approaching the Data Protection Board. Additionally, the DPDPA will enable the data subject to have the right to nominate an individual who will be able to exercise their rights in the event of the death or incapacity of the data subject. However, the DPDPA is currently silent on the right to restrict processing, the right to data portability, and rights concerning automated decision-making and profiling.

3.3.5 Cross-border data transfers

In terms of transfer mechanisms, the DPDPA is a significant departure from the GDPR’s ‘adequacy’ or ‘whitelist’ approach, as it adopts a ‘blacklist’ model. It permits a controller to transfer personal data for processing to any country or territory outside India, except to those countries that have been specifically blacklisted by the Government of India.

However, the DPDPA Rules apply significant backstops to the general transfer provision in the DPDPA by prescribing that:

• all transfers of personal data will have to comply with the conditions the Central Government will prescribe by way of a special or general order, and
• significant data fiduciaries (defined hereinafter in 3.4.1) will be restricted from transferring specific categories of personal data (as will be specified by the Central Government) and traffic related to such personal data outside the territory of India.

Despite the broader transfer mechanisms under the DPDPA, unlike other specific legislations, the DPDPA does not override other sectoral laws that may impose stricter data localisation requirements or transfer restrictions. For instance, regulations in the financial services or healthcare sectors may still require certain data to be stored within India.

3.3.6 Data breach notification

In accordance with the DPDPA, controllers will be required to notify personal data breaches not only to the regulatory authority (i.e., Data Protection Board) but also to the impacted data subjects. The DPDPA departs from the breach reporting requirements under the GDPR, as it provides a broader reporting requirement, which is required regardless of the magnitude of the breach or risk of harm.

3.3.7  Consent of Children

While the GDPR and DPDPA specifically provide for heightened consent requirements when processing the personal data of children, the DPDPA specifically provides that ‘verifiable’ consent of the parent or lawful guardian of the child must be obtained. As per the DPDP Rules, verifiable consent is obtained when the individual identifying themself as the parent or lawful guardian of a child is an adult who can be identified, if required in connection with complying with any law in India.

Additionally, the DPDPA prescribes certain obligations in addition to the GDPR with respect to the processing of children’s data as well. In accordance with the DPDPA, any data processing that is detrimental to children, or processing of data that in any manner would aid targeted advertising directed at children, should not be undertaken.

Lastly, any individual under the age of 18 (eighteen) years is identified as a child under the DPDPA, unlike the GDPR, which provides a threshold of 16 (sixteen) years, with the option for each of the member states in the EU/EAA to prescribe an age not lower than 13 (thirteen) years.

3.4 Departure from the GDPR

The compliance requirements and provisions set out above are elaborated on in the context of the GDPR, as incremental compliance applicable under the DPDPA. Additionally, there are certain key concepts that are unique to the DPDPA framework and warrant attention while assessing the data protection framework and safeguards in India for the transfer of personal data.

3.4.1 Significant data fiduciaries

As per the DPDPA, the Government of India will have the power to classify specific classes of controllers as ‘significant data fiduciaries’ on the basis of categories or volume of personal data processed. The DPDPA prescribes the following factors, based on which notification as a significant data fiduciary will be made:

• the sensitivity and volume of personal data processed,
• the impact of processing on the rights of data subjects,
• risk to electrical democracy, or
• the impact on the sovereignty, security, public order, and integrity of India.

Entities classified as a significant data fiduciary will have additional obligations, which include the appointment of an independent auditor, a data protection officer, undertaking data protection impact assessments periodically, and restricting cross-border transfer of certain classes of personal data, as will be notified by the Central Government.

3.4.2 Consent Manager framework

Consent manager is a concept unique to the DPDPA and is defined as a person who shall be responsible as the sole point of contact to enable a data subject to give, manage, review, and withdraw their consent for processing their personal data through an accessible and transparent platform. Consent managers are required to be registered with the Data Protection Board.

3.5 Summary of Analysis

As has been set out above, the DPDPA sets standards of data protection that are broadly comparable in scope and intent to those under the GDPR, ensuring proportional safeguards for personal data routed through India. Therefore, a TIA conducted prior to the transfer of personal data to India can reasonably conclude that India’s data protection regime offers adequate measures to justify the transfer from the EU/EEA to India, although a more in-depth analysis may be required depending on the scope and the nature of the data. Both frameworks provide broadly similar data subject rights, require robust security measures, and impose significant compliance obligations on data controllers to prevent the misuse of personal data.

Recommendations

In instances wherein any controller in the EU/EAA collects or processes the personal data of vendors based in India, such controllers would be required to consider the compliance obligations imposed by the DPDPA. The DPDPA has an extraterritorial effect in that it applies to digital personal data processing outside of India if such processing relates to the offering of goods or services to data subjects in India.

Although, as the compliance requirements between the DPDPA and the GDPR are conceptually mirrored, controllers collecting or processing personal data of Indian vendors would only be required to undertake specific incremental compliance measures in addition to what is already in place, owing to their GDPR specific compliance measures adopted as a part of their data compliance framework.

In case of any non-compliance with the DPDPA, penalties range from INR 500 million (~€5 million) to INR 2.5 billion (~€25 million). Urgent remedial or mitigation measures can be imposed by the Data Protection Board in the event of a personal data breach. The DPDPA signals a major change in the way personal data is processed in India. While the DPDPA is currently in suspended animation, organisations targeting individuals in India or already having an operational presence in India should consider preemptive steps to bring their privacy compliance in line with the DPDPA, including as regards data collection and consent mapping practices.

Authors

For Sweden (TM & Partners)

Fredrik Gustafsson
Partner
fredrik.gustafsson@tmpartners.se
+46 76-00 283 57

Francisco Stråhle
Associate
francisco.strahle@tmpartners.se
+46 76-00 283 21

For India (Panag, Babu & Sarangi)

Akash Karmakar
Partner
akash@pblawoffices.com

Anshika Gaur
Associate
anshika.gaur@pblawoffices.com  

Kopal Arora
Associate
kopal.arora@pblawoffices.com

This whitepaper is intended to be illustrative and provide a general summary of the applicable legal frameworks. It does not constitute legal advice. Controllers considering the transfer of personal data to India should conduct an independent and thorough analysis of their specific circumstances and ensure that such an assessment is appropriately documented in accordance with applicable data protection requirements.

[1] Under the GDPR and the LED (Commission Implementing Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom)

[2] Article 46 GDPR.

[3] Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data.

[4] Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data. 

[5] Cf. CJEUs judgement of 16 June 2020, C-311/18 (Schrems II).

[6] Article 83.5 GDPR.

[7] Binding Decision 1/2023 on the dispute submitted by the Irish SA on data transfers by Meta Platforms Ireland Limited for its Facebook service (Art. 65 GDPR).

[8] Notice from the Irish Data Protection Commission, 2^nd May 2025, Irish Data Protection Commission fines TikTok €530 million and orders corrective measures following Inquiry into transfers of EEA User Data to China.

[9] (2017) 10 SCC 1

[10] For ease of reference, we have used the terms ‘data subject’ and ‘controller’ instead of ‘data principal’ and ‘data fiduciary’ while referring to Indian data protection laws.

TM & Partners has advised Umeå Energi in a strategic industrial project for the production of fossil-free electrofuel

TM & Partners has advised Umeå Energi in a pioneering industrial project that forms an important part of Umeå’s efforts to achieve its climate and growth targets. The project enables the construction of an electrofuel facility in collaboration with Liquid Wind and the newly established company FS3AB. The facility is expected to produce up to 100,000 tonnes of fossil-free methanol per year, which can replace fossil fuels in sectors such as maritime shipping.

The fossil-free methanol is produced by capturing biogenic carbon dioxide from the flue gases of combined heat and power plants, a solution that strengthens both local sustainability and European energy security. According to Liquid Wind, the project is of strategic importance for both Sweden and the EU’s green transition.

TM & Partners acted as legal advisor to Umeå Energi in the drafting and negotiation of the agreements that form the basis for the project’s implementation. These include financing arrangements, guarantee undertakings, and cooperation agreements between Umeå Energi and FS3AB, which will own and operate the facility.

For more information about the project, please refer to the press release:
https://www.umeaenergi.se/aktuellt/umea-energi-och-liquid-wind-tar-nasta-steg-mot-elektrobransleanlaggning

TM & Partners team consisted of:
Per Granström (Partner)
Fredrik Gustafsson (Partner)
Catharina Ull (Senior Associate)
Francisco Stråhle (Associate)
Elin Torpman (Associate)

For more information, please contact the responsible partner:
Per Granström
Email: per.granstrom@tmpartners.se
Phone: +46 76 00 283 60

TM & Partners have assisted Scan Sverige AB in connection with the acquisition of Lindvalls Chark AB

TM & Partners have assisted Scan Sverige AB, part of Lantmännen since spring of 2024, in connection with the acquisition of all shares in Lindvalls Chark AB. Lindvalls produces sausages and charcuterie sourced from Swedish farms. The company employs around 100 people and has an annual turnover of approximately MSEK 400.

Read more: https://www.lantmannen.com/about-lantmannen/newsroom/press-releases/2025/scan-sverige-acquires-lindvalls-chark-ab/

TM & Partners team consisted of:

• Vaiva Eriksson (Partner, M&A)
• Fredrik Gustafsson (Partner, Tech)
• Anna Elheim Sylten (M&A)
• Teo Torstensen (M&A)
• Ludvig Tidhult (Tech)
• Vilma Hansson (Employment)
• Carl Östlund (Employment)
• Catharina Ull (Real Estate)

For more information, please contact:
Vaiva Eriksson
Partner
E-mail: vaiva.eriksson@tmpartners.se
Phone: +46 76 00 283 50

TM & Partners have advised a global industrial with a handbook for negotiation data processing agreements

TM & Partners have advised a market-leading industrial company on creating a handbook for negotiating data processing agreements.

We assisted the company in developing a guidance document for its legal and procurement teams to use during these negotiations. The project took place over spring and autumn 2024 and included workshops with more than 150 participants, offering practical advice for legal and procurement teams.

Our team consisted of:
Fredrik Gustafsson (Lawyer/Partner)
Francisco Stråhle (Associate).

For more information, please contact:
Fredrik Gustafsson
E-post: fredrik.gustafsson@tmpartners.se
Tel: +46 76 00 283 57

We have advised SaltX Technology in connection with directed share issue and cooperation agreement

We have advised SaltX Technology Holding AB (publ) in connection with a directed share issue of approximately SEK 38 million to Switzerland Ltd, SMA Mineral AB and Stiftelsen Industrifonden as well as a cooperation agreement entered into with ABB Switzerland Ltd.

SaltX Technology is a Swedish green tech company that operates within the electrification of emission-intensive industries such as the lime and cement industries. SaltX Technology’s shares are admitted to trading on Nasdaq First North Premier Growth Market.

Our team consisted of:

• Johan Wigh (Partner, Capital Markets)
• Fredrik Gustafsson (Partner, Tech)
• Alexandra Rosell (Senior Associate, Tech)
• Philip Bihl (Associate, Capital Markets)

For more information, please contact Johan Wigh:
E-mail: johan.wigh@tmpartners.se
Phone: +46 76 00 283 26

We have advised CombinedX AB (publ) on the acquisition of the consulting business M3CS

We have assisted CombinedX (publ), which through its wholly owned subsidiary CombinedX Professional Services, has acquired the business of M3CS AB. The acquisition took place through an asset transfer and entails that the business will be conducted under the existing name but with a new registration number.

The consultancy business M3CS AB engages around 80 consultants, with expertise and experience in implementing, managing, and supporting Infor’s business system M3 and the CloudSuite platform with associated integrations.

CombinedX is a knowledge company with the ambition to be a market-leading specialist company that helps companies and organisations take advantage of the opportunities of digitalisation. It delivers services through wholly owned specialist companies, each of which has market-leading technology and business expertise in its niche.

For more information, see the press release.

Our team consisted, amongst others, of:

• Per Granström (Partner, M&A)
• Fredrik Gustafsson (Partner, Tech)
• Johan Wigh (Partner, Capital markets)
• Erik Woodcock (Senior counsel, Tech)
• Sara Jacobson (Associate, M&A)
• Louise Warvsten (Associate, M&A)
• Tom Bovaller (Associate, M&A)
• Lovisa Björk (Associate, M&A)
• Vilma Hansson (Associate, Employment law)
• Hanna Hillgren (Senior associate, Capital markets)

Legal advisor to Team Olivia in connection with sale to Attendo

We advise Team Olivia in connection with the sale of Team Olivia’s Swedish care division, including the operations within Individual & Family and Home Care business, to Attendo. The division, which in the transaction is valued at SEK 950 million on a cash and debt free basis, includes appr. 120 care units with close to 3,000 employees, with annual sales of appr. SEK 1,350 million.

The transaction is subject to customary conditions and approvals and is expected to close in the beginning of 2024.

Team Olivia’s main owner is Procuritas Capital Investors IV GP Ltd.

Our team consists of:

• Sten Hedbäck (Partner, M&A)
• Vaiva Eriksson (Partner, M&A)
• Fredrik Gustafsson (Partner, Tech)
• Anna Jerndorf (Partner, Employment Law)
• Arvid Riemer (Associate, M&A)
• Johan Mörlin (Associate, M&A)
• Tom Bovaller (Associate, M&A)
• Lovisa Björk (Associate, M&A)
• Louise Warvsten (Associate, M&A)
• Carl Östlund (Senior Associate, Employment Law)
• Vilma Hansson (Associate, Employment Law)
• Amela Balijaj (Senior Associate, Real Estate)
• Johan Aronsson (Senior Associate, Real Estate)
• Erik Woodcock (Senior Counsel, Tech)
• Alexandra Rosell (Senior Associate , Tech)
• Carolin Von Oelreich (Senior Associate, Banking and Finance)
• Mikaela Nordh (Senior Associate, Banking and Finance)
• Anastasia Lindström (Associate, Banking and Finance)

For more information, please contact Sten Hedbäck:
E-post: sten.hedback@tmpartners.se
Tel: +46 76 00 283 05

We have advised a credit market company on multi-jurisdictional agreement regarding card processing services

We have advised a credit market company on an agreement regarding card processing services and card issuing services (Card as a Solution, CaaS). The agreement is part of a strategic collaboration and covers several jurisdictions.

The agreement was concluded in September 2023.

Our team comprised of:

• Fredrik Gustafsson (Partner)
• Eva Sundling (Partner)
• Karolina Kjellberg (Senior Associate)
• Simon Lundahl (Associate)

We have advised in a critical outsourcing of IT services from an insurance company

We have advised an IT supplier in the preparation and negotiation of framework agreements regarding a critical outsourcing of IT services from an insurance company.

The agreements were entered into during the summer of 2023.

Our team comprised of :

• Fredrik Gustafsson (Partner)
• Karolina Kjellberg (Senior Associate)

Counsel to a Swedish infrastructure company on key customer framework agreement regarding dark fibre

TM & Partners has advised a Swedish fiber infrastructure company on drafting several key customer framework agreements regarding the use of the client’s long-haul dark fibre infrastructure in Northern Europe and related services.

TM & Partners’ team comprised of :

• Fredrik Gustafsson (Advokat, Partner)
• Karolina Kjellberg (Senior Associate)
• Arvid Riemer (Associate)

TM & Partners has advised one of the leading Swedish industrial companies on an agreement regarding AI-based IT solution

We have advised a Swedish industrial company on an agreement regarding an IT solution that uses Artificial Intelligence (AI) for real time analytics. The agreement was signed in January 2023 and is part of the client’s strategic investment in IT security.

TM & Partners’ team comprised of :

• Fredrik Gustafsson (Advokat, Partner)
• Karolina Kjellberg (Senior Associate)
• Anna Björklund (Associate)

TM & Partners has assisted EQUA Simulation AB

TM & Partners has assisted EQUA Simulation AB in connection with the sale of a majority of the shares to MagiCAD Group Oy, a subsidiary of Glodon Company Limited.

EQUA Simulation AB  is a global leader of simulation software, and is known for its expertise, high quality standards and leading edge technology development.

MagiCAD Group is a global software provider with the mission to help engineering, manufacturing and construction companies create better buildings for people and the planet.

TM & Partners’ team consisted of :

• Per Granström (Partner, M&A)
• Anna Elheim Sylten (Senior Associate, M&A)
• Tom Bovaller (Associate, M&A)
• Fredrik Gustafsson (Partner, Tech)
• Erik Woodcock (Senior Counsel, Tech)
• Alexandra Rosell (Senior Associate, Tech)

TM & Partners has advised an energy company on its procurement of network services (NaaS) to approx. 1 000 locations in the Nordics

TM & Partners has advised an energy company on an agreement regarding SD-WAN and other network services (Network as a Service, NaaS). The network services will be rolled-out at approx. 1 000 locations. The partnership is part of the company’s transformation and the modernisation of its network.

The deal is worth approx. 500 000 000 SEK. The agreement was concluded in October 2022.

TM & Partners team comprised of Fredrik Gustafsson, Erik Woodcock, Karolina Kjellberg and Arvid Riemer.

TM & Partners has advised a bank on its outsourcing of card issuing services

TM & Partners has advised a bank on an agreement regarding card issuing services (CaaS, Card as a Service). In addition to contractual matters and negotiations, the Tech department, together with Banking and Finance, also advised the client on financial regulatory matters, such as EBA’s outsourcing guidelines and PSD 2. The agreement involved several jurisdictions.

The agreement was concluded in December 2021.

TM & Partners team bestod av Fredrik Gustafsson, Erik Woodcock, Eva Sundling, Karolina Kjellberg and Kristoffer Vasberg.

TM & Partners has advised a credit market company on a Software as a Service (SaaS) agreement for financial services

The agreement was concluded during August 2022.

TM & Partners team comprised of Fredrik Gustafsson and Karolina Kjellberg.

TM & Partners has advised one of the largest Swedish industrial companies on the transformation of its network services

TM & Partners has advised a Swedish industrial company on several agreements related to global network services. The extensive project included procurement of SD-WAN, transport and other network services. The roll-out will take place at approx. 500 sites in 150 countries.

We advised the client throughout the entire process, from RFP to closing.

The agreements were signed during spring/summer 2022.

TM & Partners team comprised of Fredrik Gustafsson, Erik Woodcock, Karolina Kjellberg och Arvid Riemer.

TM & Partners has advised one of Sweden’s largest chain of petrol stations on its procurement of payment terminals

TM & Partners has advised a petrol chain on an agreement regarding card payment services and digital payment solutions. The roll-out will continue for some time, at hundreds of sites, and in several countires. The agreement is part of the company’s digital transformation.

The agreement was concluded in December 2021.

TM & Partners team comprised of Fredrik Gustafsson and Erik Woodcock.

TM & Partners has advised one of Sweden’s largest real estate company´s on a managed services agreement

TM & Partners has provided support to the real estate company on a managed services agreement covering not only work place services, network services but also hybrid cloud services and application management services, all to put in place a foundation for further strategic co-operation in relation to the real estate company´s continuing digitalisation activities.

The agreement was signed in March 2022.

TM & Partners team consisted of Erik Woodcock, Fredrik Gustafsson and Arvid Riemer.

TM & Partners has advised a company within the public transportation industry on an agreement regarding a new ticket reservation system

TM & Partners has advised a company within the public transportation industry on its procurement of a new ticket reservation system. The procurement is the company’s largest IT investment to this date and a part of its strategic technical development.

The contract value is approx. 2 MEUR per year and was concluded in March 2022.

TM & Partners team comprised of Fredrik Gustafsson, Karolina Kjellberg and Arvid Riemer.

TM & Partners has advised on an outsourcing from an insurance company

TM & Partners has advised an IT supplier on a first generation outsourcing from an insurance company, involving several jurisdictions. In addition to contractual matters and negotiations, we advised the client on related employment matters.

The contract value is approx. 5 MEUR per year.

The agreement was entered into in March 2022.

TM & Partners team comprised of Per Granström, Fredrik Gustafsson, Karolina Kjellberg och Lisa Ericsson.

TM & Partners has advised on of Sweden’s largest banks on an API-agreement

TM & Partners has advised a bank on an API agreement regarding access to bank customers data. The projects is a part of the bank’s Open Banking initiative.

The work was performed during spring/summer 2021.

TM & Partners team comprised of Fredrik Gustafsson, Erik Woodcock and Karolina Kjellberg.

TM & Partners has advised RNB Retail and Brands AB in connection with the sale of Brothers & Sisters AB, the acquisition of Coala-Life AB and the conversion of notes

TM & Partners has advised RNB Retail and Brands AB (“RNB”) in connection with the sale of Brothers & Sisters. They holds all shares in Brothers AB, to the Norwegian investment company Jotunfjell Partners AS. The acquisition of Coala-Life AB (“Coala-Life”) through an issue in kind, and the conversion of RNB’s notes to unconditional capital contributions and shares in the company.

Jotunfjell Partners AS has a primary focus on Nordic retail, and owns, inter alia, the Swedish retail chain Pagelle.

Coala Life is a Swedish medtech company that focuses on heart diagnostics and digital health. The company has developed a portfolio of solutions based on the Coala, a patented and commercial service for remote monitoring and self-screening of heart sounds and ECG.

As a result of the transactions, RNB changed its business name to Coala-Life Group AB (publ) and its business activities to development, marketing and sale of medtech. In addition, a change of listing of RNB’s shares from Nasdaq Stockholm to Nasdaq First North Growth Market was carried out in connection with the closing of the transactions.

TM & Partners’ team comprised:

• Niclas Högström (Partner, M&A)
• Johan Wigh (Partner, Capital Markets)
• Tobhias Brandell (Partner, Banking & Finance)
• Fredrik Gustafsson (Partner, Technology)
• Sara Jacobson (Associate, M&A)
• Mikael Ahlberg (Associate, M&A)
• Robin Bergqvist (Associate, Banking and Finance)
• Philip Bihl (Associate, Capital Markets)
• Johan Mörlin (Associate, M&A)
• Karolina Kjellberg (Senior Associate, Technology)
• Cecilia Bergman (Senior Associate, Employment)
• Catharina Danielsson (Associate, Real Estate)

TM & Partners has advised one of Sweden’s largest chain of petrol stations on its procurement of card issuing services

TM & Partners has advised a petrol chain on an agreement regarding card payment services (CaaS, Card as a Service). The partnership aims to enhance the companies card services for its hundreds of thousands members.

The agreement was concluded in October 2021.

TM & Partners team comprised of Fredrik Gustafsson, Erik Woodcock, Eva Sundling and Karolina Kjellberg.

TM & Partners has advised a Swedish industrial an procurement of global network services

TM & Partners has advised an industrial on an agreement including SD-WAN and other network services. The services will be rolled-out in all of the countries (40+) were the company is established.

The agreement was signed in June 2021.

TM & Partners team comprised of Fredrik Gustafsson.

TM & Partners has assisted in connection with the sale of Adtoox

TM & Partners has advised the founders of Adtoox in connection with the sale of the company to global video ad management platform Peach.

Adtoox was founded in 2007 by Emil Brolin and Oskar Milton and delivers a wide range of services within the scope of ad distribution, research and online advertisement.

TM & Partners’ team consisted of Sten Hedbäck (Partner, M&A), Philip Reznik (Senior Associate, M&A), Tom Bovaller (Associate, M&A), Fredrik Gustafsson (Partner, Tech) and Lisa Ericsson (Counsel, Employment). Livingstone were financial advisers to the sellers.

TM & Partners has advised a Swedish industrial on outsourcing of IT infrastructure

TM & Partners has advised an industrial on an Application Development and Maintenance (ADM) agreement with one of the global IT supplier. The services will be used in several jurisdictions.

The agreement was signed in August 2021.

TM & Partners team comprised of Fredrik Gustafsson and Erik Woodcock. 

TM & Partners has advised a Swedish industrial on a strategic investment in cyber security

TM & Partners has advised an industrial on an managed services agreement regarding cyber security services, including Application Operations (AO) and consultancy services.

The contract value is approx. 4 MSEK per year.

The agreement was signed in March 2021.

TM & Partners team comprised of Fredrik Gustafsson and John Park.

TM & Partners has advised RNB Retail and Brands AB (publ) in connection with the sale of Polarn O. Pyret AB

TM & Partners has advised RNB Retail and Brands AB (publ) in connection with the sale of its wholly-owned subsidiary Polarn O. Pyret AB to Procuritas Capital Investors Fund VI. The preliminary purchase price amounts to SEK 330 million on a cash and debt-free basis. Polarn O. Pyret is a true Swedish icon and an internationally recognised quality brand within the field of children’s clothing since 1976. Procuritas invests in and develops medium-sized Nordic companies and has for more than thirty years invested in over 45 different companies.

TM & Partners team comprised:

• Niclas Högström (Partner, M&A)
• Mikael Ahlberg (Associate, M&A)
• Sofia Lindh (Associate, M&A)
• Sara Jacobson (Associate, M&A)
• Tobhias Brandell (Partner, Banking & Finance)
• Matilde Abejón (Associate, Banking & Finance)
• Fredrik Gustafsson (Partner, Tech)
• Andreas Sahlstedt (Associate, Real Estate)

TM & Partners has assisted Oasmia Pharmaceutical in relation to its acquisition of the global development and commercialization rights for Cantrixil

TM & Partners has assisted Oasmia Pharmaceutical (Oasmia) in relation to its acquisition of the global development and commercialization rights for Cantrixil, a clinical stage, ovarian cancer program. The transaction includes an upfront payment of $4 million, milestone payments worth up to $42 million and sales-based royalties. The Australian law firm Allens and TM & Partners advised Oasmia in relation to the transaction.

TM & Partners’ team included Johan Wigh, Fredrik Gustafsson and Alexandra Rosell.

TM & Partners has assisted Departments & Stores Europe AB in connection with the transfer of its assets in the department stores of Nordiska Kompaniet in Stockholm and Gothenburg to NK Retail AB

TM & Partners has assisted Departments & Stores Europe AB (DSE) in connection with the transfer of its business in the department stores of Nordiska Kompaniet in Stockholm and Gothenburg to NK Retail AB. The buyer is a subsidiary to AB Nordiska Kompaniet which is a subsidiary to Hufvudstaden. Through the sale approximately 40 departments will be transferred in NK Stockholm and Gothenburg. DSE generated revenues of SEK 773 million in the financial year of 2019/2020. All employees, about 400, will be offered employment at NK Retail AB.

TM & Partners team comprised Niclas Högström (Partner), Tobhias Brandell (Partner), Fredrik Gustafsson (Partner), Mikael Ahlberg (Associate), Sofia Lindh (Associate), Sara Jacobson (Associate), Karolina Kjellberg (Associate), John Park (Associate) and Robin Berqvist (Associate).

TM & Partners advises Posti group on divestment of Posti Messaging Scandinavia to Ropo Capital

TM & Partners has advised Posti Group in connection with the divestment of Posti Messaging Scandinavia to Ropo Capital, a portfolio company to Adelis Equity. Posti Messaging Scandinavia is a major provider of high-volume multichannel transaction flows in Sweden and Norway, with net sales in 2019 of approximately EUR 38 million and around 100 employees.

TM & Partners’ team was led by Vaiva Eriksson (Partner, M&A) and comprised Mikael Ahlberg (Associate, M&A), Emma Borg (Associate, M&A), Anna Bjurell (Senior Associate, M&A), Lisa Ericsson (Counsel, Employment), Fredrik Gustafsson (Partner, Tech) and John Park (Associate, Tech).

TM & Partners have advised Footway on its acquisition of Caliroots

TM & Partners have advised Footway AB in connection with its acquisition of Caliroots, a strong brand within streetwear and sneakers. The acquisition is made by means of an acquisition of Caliroots’ trademarks, internet domains and inventory.

Footway was founded in 2010 and is an e-commerce company with sales of products within sports and fashion via Footway.com, Sportamore.com, Brandos.com, Solestory.se etc. Its shares are listed on Nasdqq First North Growth market. For more information on the transaction, please see Footway’s press release here.

TM & Partner’s team was led by:

• Sten Hedbäck (Partner, M&A)
• Peter Törngren(Partner, RIB)
• Anna Jerndorf (Partner, Employment)
• Fredrik Gustafsson (Partner, Tech)

TM & Partners has advised NetNordic in connection with its acquisition of Bolero

TM & Partners has advised NetNordic, an independent system integrator with majority owner Norvestor, in connection with its acquisition of Bolero. Bolero is an established Swedish provider of services related to cloud, cyber security, analytics, network and data centre and a number of areas within system development. Bolero has 80 employees and a significant number of sub-consultants servicing the company’s customer base. The headquarters is located in Stockholm, with offices in Gothenburg and Linköping. Both NetNordic and Bolero primarily work with large and medium-sized customers in both the public and private sectors. Last financial year revenues of Bolero were SEK 270 million. Management shareholders in Bolero are reinvesting in NetNordic. 

TM & Partners’ team was led by Sten Hedbäck (Partner) and Philip Reznik (Senior Associate) and included Fredrik Gustafsson (Partner), Lisa Ericsson (Counsel), Anna Elheim Sylten(Associate), John Park (Associate), Jacob Elovsson Hultin (Associate) and Andreas Sahlstedt(Associate).

TM & Partners has assisted Priveq Investment in its acquisition of a majority stake in the fast-growing language and media technology company Plint

TM & Partners has assisted Priveq Investment in its acquisition of a majority stake in the fast-growing language and media technology company Plint in Gothenburg. Plint, which works closely with streaming giant Netflix, has grown from SEK 11m to SEK 236m in five years. Apart from Netflix, customers also include Amazon, Viacom, Volvo, IKEA and H&M.

For more information about this transaction please see the press release here.

TM & Partners’s team consisted of:

• Per Granström (Partner M&A)
• Philip Reznik (Senior Associate M&A)
• Anna Elheim Sylten (Associate M&A)
• Jacob Elovsson Hultin (Associate M&A)
• Fredrik Gustafsson (Partner Tech)
• John Park (Associate Tech)
• Cecilia Bergman(Associate Employment)
• Cecilia Rudels (Partner Banking & Finance)
• Marcus Kern Fahlander (Associate  Banking & Finance)
• Louise Ekdahl (Associate Banking & Finance)
• Andreas Sahlstedt (Associate Real Estate)

TM & Partners has advised Posti Group in connection with the acquisition of Aditro Logistics

TM & Partners has advised Posti Group Oyj in connection with the acquisition of Aditro Logistics Holding AB from Valedo Partners Fund II AB.

Posti is the leading postal and logistics service company in Finland with net sales in 2018 of approx. EUR 1.6 billion and approx. 22,000 employees. The acquisition of Aditro Logistics strengthens Posti’s presence in the Nordics and the Baltic Sea region and increases its growth within logistics services.

Aditro Logistics offers a broad portfolio of logistics services such as warehousing, staffing and transportation services. The group has six warehouses in Sweden and one in Norway, with a total of approx. 230,000 m2 of storage space, approx. SEK 1.1 billion in net sales and approx. 1,100 full-time employees.

Törngren Magnell’s consisted of:

• Vaiva Eriksson (Partner, M&A)
• Sten Hedbäck (Partner, M&A)
• Mikael Ahlberg (Associate, M&A)
• Bruce McGinn (Counsel, M&A)
• Lisa Ericsson (Counsel, Employment)
• Fredrik Gustafsson (Partner, Tech)
• John Park(Associate, Tech)
• Johan Aronsson (Associate, Real Estate)
• Marcus Kern Fahlander (Associate, Banking & Finance)
• Sara Jacobson (Associate, M&A)
• Jacob Elovsson Hultin(Associate, M&A)

New practice group at Törngren Magnell: Fredrik Gustafsson and Erik Woodcock will build the new Tech group

Earlier in September, Fredrik Gustafsson joined as a new partner at Törngren Magnell to build the Technology practice group. Törngren Magnell has in addition now recruited Erik Woodcock as Senior Counsel.

Fredrik and Erik are specialised in IT related commercial law. Fredrik and Erik have worked together for nearly seven years, most recently at the law firm Kahn Pedersen, and are a welded team. Together they have more than 25 years of experience in IT related commercial law. They have extensive experience of all sorts of IT sourcing transactions, digitalisation projects, GDPR as well as the law surrounding the latest IT trends. Furthermore, Fredrik is one of three in Sweden to be ranked as a ”Next Generation Lawyer” within IT & Telecommunications by The Legal 500.

The recruitment of Fredrik and Erik is part of TM & Parnters investment in IT related commercial law. Fredrik, Erik and Lisa Ericsson will form the core of TM:s Technology group. Lisa has more than ten years of experience in commercial law, has been a member of Törngren Magnell since 2016 and is a specialist within the field of employment related data protection.

”We are experiencing a strong and increasing demand for specialists in IT and GDPR. This is now a core competence in transactions. With the recruitment of Fredrik and Erik, along with the competence we already have, Törngren Magnell has now one of the strongest teams on the market within the field of Technology. We are delighted to have recruited Fredrik and Erik.”

Kristoffer Stråth, Managing Partner.

Törngren Magnell is growing and will keep recruiting junior and senior talents within the field of Technology as well as other areas.

Contact:

Fredrik Gustafsson, Partner

Kristoffer Stråth, Managing Partner