SPAR Access Authorization

Access to SPAR (Statens personadressregister - the Swedish Population Register) requires separate authorization from the Swedish Tax Agency (Skatteverket). This authorization is in addition to your standard Creditsafe credentials.

To use the SPAR API, you need two separate authorizations:

1. CONNECT Authentication: Standard Creditsafe authentication via CONNECT Authenticate
2. SPAR Authorization: Specific permission from the Swedish Tax Agency to access population register data

SPAR access is granted only to organizations with legitimate purposes for accessing Swedish population register data. Common legitimate purposes include:

• Identity verification for customer onboarding (KYC)
• Address verification for communication and delivery
• Credit assessment and risk management
• Debt collection and credit monitoring
• Prevention of fraud and financial crime
• Fulfilling legal obligations

Apply for SPAR access using form SKV 1537, available from the Swedish Tax Agency:

• Form name: Ansökan om direktåtkomst till SPAR (Application for direct access to SPAR)
• Form number: SKV 1537
• Available at: www.skatteverket.se

When applying, you must specify which level of access you require:

The basic authorization level provides access to:

• Personal identity number (personnummer)
• Name (first name, middle name, last name, given name)
• Gender
• Date of birth
• Registered address (folkbokföringsadress)
• Special postal address (särskild postadress)
• Population registration information (folkbokföringsuppgifter)
• Deregistration information (avregistreringsorsak)
• Secrecy marking status

This level does not include relation data or property information.

The relations authorization level includes all basic data plus:

• Family relations (parents, children, spouse, partner)
• Guardian information
• Names and addresses of related persons

As part of your application, you must demonstrate compliance with:

• GDPR (General Data Protection Regulation)
• Dataskyddsförordningen (Swedish Data Protection Act)
• Kreditupplysningslagen (Swedish Credit Information Act, if applicable)

You'll need to document:

• Legal basis for processing personal data
• Purpose limitation and data minimization practices
• Security measures to protect the data
• Data retention policies
• Procedures for handling data subject rights

Submit your completed SKV 1537 form to:

Skatteverket
Dataavdelningen, SPAR
171 94 Solna
Sweden

You can also submit electronically through Skatteverket's secure portal if you have a Swedish organization number and BankID.

• Processing time: Typically 4-8 weeks
• Approval notification: You'll receive a decision letter from Skatteverket
• SPAR credentials: If approved, you'll receive credentials for accessing SPAR

Once you receive your SPAR credentials from Skatteverket:

1. Contact your Creditsafe account manager
2. Provide your SPAR credentials (securely)
3. Creditsafe will configure your account for SPAR access
4. You'll receive confirmation when SPAR is activated on your account

The SPAR API uses SPAR XML Schema version 2023.1. This is the official schema version maintained by Skatteverket for SPAR data exchange.

Creditsafe's API converts the XML data from SPAR into JSON format for easier integration, but the underlying data structure follows the SPAR 2023.1 schema definitions.

Your SPAR authorization is specific to your organization and cannot be transferred or shared. Each organization that needs SPAR access must apply separately.

If your company has multiple legal entities in Sweden, each entity may need its own SPAR authorization depending on:

• Which entity is processing the personal data
• Which entity has the contractual relationships with data subjects
• Your internal data processing agreements

Consult with Skatteverket if you're unsure whether multiple applications are needed.

Skatteverket periodically reviews SPAR access authorizations. You may be required to:

• Confirm continued need for SPAR access
• Update your data protection documentation
• Demonstrate ongoing compliance with regulations

SPAR authorizations are typically valid indefinitely but can be revoked if:

• You no longer meet the requirements
• There are compliance violations
• The authorization is not actively used

When using SPAR data, you must:

Only use SPAR data for the purposes specified in your application. Using the data for other purposes violates your authorization.

Only request data when necessary. Don't perform bulk lookups or create databases of population information "just in case."

Implement appropriate technical and organizational measures:

• Encrypt data in transit and at rest
• Restrict access to authorized personnel only
• Log all access to SPAR data
• Implement access controls and authentication
• Regular security audits and vulnerability assessments

Don't retain SPAR data longer than necessary for your specified purpose. Define clear retention policies and implement automated deletion.

Implement procedures to handle:

• Right to access (personuppgiftsförfrågan)
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object

SPAR data cannot be shared with third parties unless:

• You have explicit authorization to do so
• The third party has their own SPAR authorization
• The sharing is necessary for your specified purpose and complies with GDPR

Creditsafe logs all SPAR API requests with the following information:

• Timestamp of request
• Personal identity number queried
• Parameters used (including relation flag)
• API credentials used
• Response status

This audit log is maintained for compliance purposes and may be reviewed by Skatteverket during audits.

This error indicates that your SPAR credentials are not configured correctly with Creditsafe. Solutions:

1. Verify you've provided your SPAR credentials to Creditsafe
2. Check that your credentials haven't expired
3. Contact Creditsafe support to verify account configuration

You requested relation data but don't have authorization for it. Solutions:

1. If you don't need relation data, remove the relation=true parameter
2. If you need relation data, apply for relations authorization with Skatteverket
3. After receiving relations authorization, update your configuration with Creditsafe

Contact your Creditsafe account manager:

• Guidance on completing SKV 1537 form
• Understanding authorization levels
• Data protection documentation requirements

Contact Creditsafe technical support:

• API integration questions
• Credential configuration
• Error troubleshooting
• API usage questions

Contact Skatteverket directly:

• Legal requirements for SPAR access
• Interpretation of regulations
• Compliance questions
• Authorization scope questions

Next Step: Once you have SPAR authorization configured, see the Step-by-Step Integration Guide for guidance on implementing SPAR in your application.