This thesis investigates how Swedish teachers manage confidential information about their pupils in reference to the General data protection regulation (GDPR). The purpose of the study has been to understand the general and individual actions that are carried through to ensure that the key principles of GDPR are actualized in a school context. Previous research in the field of education and information science has indicated that policies and shared regulations are a key element of obtaining information security in the management of personal data. It has also presented that teachers often have an inadequate knowledge about information security in the matter of their pu- pils’ personal data.  In order to examine the purpose of this study, seven interviews with Swedish elementary school teachers were conducted. Information culture theory was used to analyse the data collected from the interviews. The result of the study indicates that the interviewed teachers lack knowledge about the key principles of GDPR due to an absence of information provided to them by their employers. The key principle regarding integrity and confidentiality were the most common one to address in order to ensure that the legislation has been fulfilled. The other key principles of GDPR were often neglected as a result of inadequate knowledge and/or a lack of common policies.  This is a two years master's thesis in Library and information science.