As a private person, IMY's page states this requirement for setting up a surveillance camera.

att kameran inte fångar en plats dit allmänheten har tillträde

But yeah, GDPR isn't very restrictive unless you're capturing personal information without a valid reason. Usually the police/myndighet permits are just to make sure that you have a valid reason.