Data Protection & Privacy in Denmark

Denmark operates one of the most actively enforced data protection regimes in the European Union. The General Data Protection Regulation (GDPR) applies directly, supplemented by the Danish Data Protection Act (Databeskyttelsesloven), which fills national discretions and adds sector-specific rules. Businesses operating in Denmark - whether locally incorporated or targeting Danish residents from abroad - face real regulatory exposure: the Danish Data Protection Authority (Datatilsynet) issues binding orders, imposes administrative fines, and refers serious cases to the police for criminal prosecution. This article covers the legal framework, key compliance obligations, enforcement mechanics, cross-border data transfer rules, and the practical steps international businesses must take to manage risk effectively.

The GDPR is a directly applicable EU regulation. It establishes the core principles of lawful processing, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Every controller and processor operating in Denmark must comply with these principles regardless of company size or sector.

The Danish Data Protection Act (Databeskyttelsesloven, Act No. 502 of 2018, as amended) supplements the GDPR in areas where member states retain discretion. Key national additions include rules on the processing of personal identification numbers (CPR numbers), specific age thresholds for children's consent in information society services set at 13 years under Danish law, and restrictions on processing sensitive data in employment contexts. The Act also designates the Datatilsynet as the competent supervisory authority and sets out its investigative and corrective powers.

Sector-specific rules layer on top of this framework. The Danish Health Data Act (Sundhedsdataloven) governs processing of health data by healthcare providers and public registries. The Danish Criminal Records Act (Strafferegisterloven) restricts access to and use of criminal conviction data. Financial institutions must comply with additional requirements under the Danish Financial Business Act (Lov om finansiel virksomhed), which incorporates data protection obligations alongside prudential rules. Telecommunications providers face obligations under the Danish Executive Order on Security Measures (Bekendtgørelse om sikkerhedsforanstaltninger), implementing the ePrivacy Directive.

A common mistake among international clients is assuming that GDPR compliance in their home jurisdiction automatically satisfies Danish requirements. The national layer - particularly CPR number restrictions and the 13-year age threshold - creates additional obligations that a purely GDPR-focused compliance programme will miss.

Under GDPR Article 6, controllers must identify a lawful basis before processing personal data. The six bases are: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. Danish practice and Datatilsynet guidance place particular emphasis on selecting the correct basis from the outset, because switching bases mid-process is legally problematic and operationally disruptive.

Consent in Denmark must meet the GDPR standard: freely given, specific, informed, and unambiguous. The Datatilsynet has consistently found that pre-ticked boxes, bundled consent, and consent obtained as a condition of service do not satisfy this standard. For online services directed at children, the Danish Data Protection Act sets the age of digital consent at 13 years. Below that threshold, parental or guardian consent is required. Controllers must implement age verification mechanisms that are proportionate and technically feasible - a non-obvious risk is that overly intrusive age verification may itself create a separate data protection issue.

Legitimate interests under GDPR Article 6(1)(f) require a three-part balancing test: identifying the legitimate interest, demonstrating necessity, and confirming that the data subject's interests do not override the controller's. The Datatilsynet scrutinises legitimate interests claims carefully, particularly in direct marketing, employee monitoring, and fraud prevention contexts. Controllers relying on this basis should document the balancing test in writing and review it periodically.

For sensitive data under GDPR Article 9 - including health, biometric, racial or ethnic origin, and trade union membership data - an additional condition from Article 9(2) must be satisfied alongside a lawful basis. In practice, explicit consent and employment law necessity are the most commonly used conditions in Danish commercial contexts. Processing CPR numbers requires a specific legal basis under Databeskyttelsesloven Section 11: either a statutory obligation, explicit consent, or a legitimate purpose recognised by the Datatilsynet.

To receive a checklist on lawful basis selection and consent documentation for Denmark, send a request to info@vlolawfirm.com.

A Data Protection Officer (DPO) is a designated individual responsible for overseeing data protection compliance, advising on obligations, and acting as the contact point for the Datatilsynet. Under GDPR Article 37, appointment is mandatory in three situations: where processing is carried out by a public authority or body; where core activities require large-scale, regular, and systematic monitoring of individuals; or where core activities involve large-scale processing of sensitive data or criminal conviction data.

In Denmark, the Datatilsynet has published guidance clarifying that 'large-scale' is assessed by reference to the number of data subjects, the volume of data, the geographic scope, and the duration of processing. A mid-sized Danish retailer processing loyalty programme data for hundreds of thousands of customers will typically meet the threshold. A small professional services firm processing employee data for 20 staff will typically not.

The DPO must have expert knowledge of data protection law and practice. This does not require a legal qualification, but the Datatilsynet expects demonstrable competence. The DPO must be provided with resources, access to data and processing operations, and independence - meaning the DPO cannot be instructed on how to perform their tasks and cannot be dismissed or penalised for doing so. Controllers and processors may appoint an external DPO, which is a common and cost-effective solution for international groups operating in Denmark through a subsidiary or branch.

A non-obvious risk is the conflict of interest prohibition. A DPO cannot simultaneously hold a role that involves determining the purposes and means of processing - for example, a Chief Technology Officer or Head of Marketing cannot serve as DPO for the same organisation. International groups sometimes designate a group-level DPO without checking whether that individual's other responsibilities create a conflict under Danish and GDPR rules.

The DPO's contact details must be published and communicated to the Datatilsynet. Failure to appoint a DPO where required, or appointing one who lacks independence or expertise, is a direct compliance failure that the Datatilsynet treats as an aggravating factor in enforcement proceedings.

A personal data breach is defined under GDPR Article 4(12) as a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Not every breach triggers notification obligations, but the assessment must be made promptly and documented regardless of outcome.

Under GDPR Article 33, controllers must notify the Datatilsynet of a breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The 72-hour clock starts when the controller has a reasonable degree of certainty that a breach has occurred - not when the investigation is complete. Partial notifications are permitted: a controller may notify within 72 hours with the information available and supplement later.

Where the breach is likely to result in a high risk to individuals - for example, exposure of financial data, health data, or CPR numbers - the controller must also notify the affected data subjects under GDPR Article 34, without undue delay. The notification must describe the nature of the breach, the likely consequences, and the measures taken or proposed.

The Datatilsynet receives several hundred breach notifications annually. It assesses each notification and may open a formal investigation. In practice, the authority focuses on whether the breach resulted from inadequate technical or organisational measures, whether the controller responded appropriately, and whether notification was timely. Late notification - particularly where the delay is measured in weeks rather than hours - is treated as a separate compliance failure.

Practical scenario one: a Danish e-commerce company discovers that a misconfigured cloud storage bucket has exposed order history data, including names, addresses, and partial payment card numbers, for approximately 50,000 customers. The controller must notify the Datatilsynet within 72 hours, assess whether high risk to individuals exists (likely yes, given the financial data element), notify affected customers, and document the entire response. Failure to notify within 72 hours, or failure to notify customers where high risk exists, exposes the controller to administrative fines and reputational damage.

Practical scenario two: a Danish HR software provider suffers a ransomware attack that encrypts employee data held on behalf of client companies. The provider is a processor. Under GDPR Article 33(2), the processor must notify each controller without undue delay after becoming aware of the breach. Each controller then independently assesses its notification obligations to the Datatilsynet and to data subjects. A common mistake is for the processor to delay notification to controllers while conducting its own investigation, causing controllers to miss the 72-hour window.

To receive a checklist on data breach response procedures for Denmark, send a request to info@vlolawfirm.com.

Transferring personal data from Denmark to countries outside the European Economic Area (EEA) requires a transfer mechanism under GDPR Chapter V. The available mechanisms are: an adequacy decision by the European Commission; Standard Contractual Clauses (SCCs) adopted by the Commission; Binding Corporate Rules (BCRs) approved by a lead supervisory authority; approved codes of conduct with binding commitments; approved certification mechanisms; or derogations for specific situations under GDPR Article 49.

Adequacy decisions cover a limited number of countries, including the United Kingdom (subject to periodic review), Japan, Canada (commercial organisations), and a small number of others. Transfers to the United States rely primarily on the EU-US Data Privacy Framework, which replaced the invalidated Privacy Shield. Controllers transferring data to US entities must verify that the recipient is certified under the Framework and that the transfer falls within the Framework's scope.

Where no adequacy decision exists and the Framework does not apply, SCCs are the most commonly used mechanism. The European Commission adopted updated SCCs in 2021, replacing the earlier sets. Controllers must use the current SCCs and complete a Transfer Impact Assessment (TIA) - a documented analysis of the legal framework in the destination country and whether it provides essentially equivalent protection to EU law. The Datatilsynet expects TIAs to be substantive, not formulaic.

BCRs are appropriate for multinational groups transferring data between group entities across multiple jurisdictions. The approval process is lengthy - typically 12 to 24 months - and requires a lead supervisory authority. For groups with their EU headquarters or main establishment in Denmark, the Datatilsynet would act as lead authority. BCRs provide a durable, scalable solution but require significant upfront investment.

Derogations under GDPR Article 49 - such as explicit consent or necessity for contract performance - are intended for occasional, non-repetitive transfers. The Datatilsynet, consistent with European Data Protection Board guidance, takes the position that systematic reliance on Article 49 derogations as a substitute for a proper transfer mechanism is unlawful.

Practical scenario three: a Danish pharmaceutical company engages a US-based clinical research organisation to process patient data for a clinical trial. The transfer involves sensitive health data and CPR numbers. The company must implement SCCs with the US entity, complete a TIA addressing US surveillance law, ensure the US entity is subject to binding obligations equivalent to those of a GDPR processor, and obtain the appropriate lawful basis and Article 9 condition for the underlying processing. Relying solely on patient consent as both the transfer derogation and the Article 9 condition is legally fragile and likely to be challenged.

The Datatilsynet (Danish Data Protection Authority) is the competent supervisory authority under GDPR Article 51. It has investigative powers including the right to obtain access to premises, require information, and conduct audits. Its corrective powers include issuing warnings, reprimands, orders to comply, temporary or permanent bans on processing, and administrative fines.

Administrative fines under GDPR Article 83 operate on a two-tier structure. Less serious infringements - such as failures relating to controller and processor obligations, certification, or monitoring mechanisms - attract fines of up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. More serious infringements - including violations of the basic principles of processing, conditions for consent, data subjects' rights, and cross-border transfer rules - attract fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.

In Denmark, the Datatilsynet does not impose fines directly. Under the Danish model, the authority refers cases to the police and prosecution service, which then decides whether to bring criminal charges. Administrative fines are imposed by the courts following prosecution. This procedural model means that Danish enforcement proceedings can take longer than in some other EU member states, but the outcome - a criminal conviction with a fine - carries reputational consequences beyond a purely administrative penalty.

The Datatilsynet also has the power to issue binding orders requiring controllers to bring processing into compliance within a specified timeframe. Non-compliance with an order is itself a criminal offence under Databeskyttelsesloven Section 41. Controllers who receive an order must take it seriously and respond within the deadline, which is typically measured in weeks.

The risk of inaction is concrete. Where a controller becomes aware of a compliance gap - for example, an unlawful transfer mechanism or a missing DPO appointment - and fails to remediate it, the Datatilsynet treats the continued non-compliance as an aggravating factor. Voluntary self-reporting and proactive remediation, by contrast, are treated as mitigating factors. The cost of non-specialist mistakes in this jurisdiction is not limited to fines: it includes the management time and legal costs of responding to a formal investigation, which can run into the low hundreds of thousands of EUR for complex cases.

The Datatilsynet publishes its decisions and guidance on its website, creating a body of Danish enforcement practice that supplements GDPR recitals and European Data Protection Board opinions. Controllers operating in Denmark should monitor this guidance actively, as the authority's published positions on specific issues - such as cookie consent, employee monitoring, and CCTV - reflect its enforcement priorities.

Many underappreciate the Datatilsynet's sector focus. The authority has conducted thematic investigations into healthcare providers, municipalities, and online platforms. Controllers in these sectors face a higher probability of proactive scrutiny, independent of whether a complaint has been filed.

What are the most significant practical risks for international businesses entering the Danish market?

The most significant risks cluster around three areas. First, failing to identify and comply with the national layer of Danish data protection law - particularly CPR number restrictions and the 13-year age threshold for children's consent - when a GDPR-only compliance programme is in place. Second, inadequate cross-border transfer documentation: many international groups rely on outdated SCCs or fail to complete substantive Transfer Impact Assessments, creating exposure when the Datatilsynet audits transfer practices. Third, the absence of a properly appointed and independent DPO where one is required. The Datatilsynet treats structural compliance failures - missing DPO, no records of processing activities, absent data processing agreements with processors - as indicators of systemic non-compliance and escalates accordingly.

How long does a Datatilsynet investigation take, and what are the likely financial consequences?

A straightforward breach notification investigation may be resolved within a few months if the controller responds promptly and the breach was contained. Complex investigations - involving systemic processing violations, cross-border transfers, or multiple affected parties - can take one to two years from the initial notification or complaint to a final decision. Financial consequences depend on the severity and duration of the infringement, the number of affected individuals, the degree of cooperation, and whether the controller took proactive remediation steps. Legal costs for responding to a formal investigation typically start from the low tens of thousands of EUR and can increase significantly for multi-issue cases. Fines imposed by Danish courts following prosecution have ranged from modest amounts for minor technical violations to substantial sums for systemic failures by large organisations.

When should a business choose to appoint an external DPO rather than an internal one?

An external DPO is appropriate when the organisation lacks an individual with sufficient data protection expertise who can also satisfy the independence requirement. This is common in mid-sized international subsidiaries operating in Denmark, where the local management team is small and every senior employee holds a role that could create a conflict of interest. An external DPO provides demonstrable expertise, independence by structural separation, and flexibility - the engagement can be scaled as the organisation's processing activities change. The trade-off is that an external DPO may have less day-to-day visibility into operational decisions. Controllers choosing an external DPO should ensure the engagement agreement includes clear provisions on availability, escalation procedures, and access to processing operations, so that the DPO can genuinely fulfil the advisory and oversight functions required by GDPR Article 39.

Data protection compliance in Denmark requires attention to both the GDPR and the Danish national framework. The Datatilsynet enforces actively, and the Danish model of criminal prosecution rather than direct administrative fines adds a reputational dimension to financial exposure. International businesses must address lawful basis selection, DPO appointment, breach response, and cross-border transfer documentation as operational priorities, not afterthoughts. A structured compliance programme, supported by specialist legal advice, reduces enforcement risk and positions the business to respond effectively if the Datatilsynet makes contact.

To receive a checklist on building a GDPR and Danish data protection compliance programme, send a request to info@vlolawfirm.com.

Our law firm VLO Law Firm has experience supporting clients in Denmark on data protection and privacy matters. We can assist with compliance programme design, DPO appointment structuring, data breach response, cross-border transfer documentation, and representation in Datatilsynet proceedings. To receive a consultation, contact: info@vlolawfirm.com.