GDPR in Denmark — Guide to Datatilsynet, Data Governance, Profiling Rules, DPIA Standards, AI Regulation & Sector Obligations

Denmark operates one of the most strict, detail-oriented, documentation-heavy, and transparency-focused GDPR environments in Europe.
The Danish Data Protection Authority Datatilsynet — is internationally respected for its clear, direct, uncompromising approach to privacy enforcement.

Denmark enforces GDPR through a uniquely Scandinavian lens:

zero-tolerance culture for poor documentation
aggressive stance on unnecessary tracking
strict consent expectations
deep DPIA obligations, especially for municipalities and schools
high transparency standards (“no vagueness allowed”)
severe penalties for weak security

Denmark has been responsible for some of the EU’s most influential enforcement actions, including:

bans on Google Workspace for schools (due to transfer + DPIA failures)
harsh rulings on cookies and fluorescent tracking
strict interpretations of legitimate interest
major scrutiny of municipalities and public institutions
aggressive breach investigations

1. The Legal Foundation of GDPR in Denmark

GDPR applies fully in Denmark and is supplemented by the:

Danish Data Protection Act (Databeskyttelsesloven)

The Act includes Danish-specific rules governing:

public sector processing
CPR numbers (the Danish national ID system)
employment and workplace data
journalistic exemptions
biometric and genetic information rules
health sector obligations
municipal data governance requirements

Denmark has unique rules for the CPR number (CPR-nummer).
Processing CPR numbers is strictly regulated and only allowed with explicit legal justification.

2. Datatilsynet — The Danish Data Protection Authority

Datatilsynet is one of Europe’s most respected regulators.
Its style is:

direct
uncompromising
highly technical
documentation-driven

The authority is known for enforcing GDPR through:

regular inspections
sector audits
strong public statements
quick bans on unlawful processing
heavy criticism for poor data governance

Denmark often publishes opinion-style decisions that become models for the rest of the EU.

3. Denmark’s GDPR Enforcement Culture (Very Strict)

Datatilsynet consistently ranks among the strictest regulators in Europe for:

data minimisation
security expectations
lawful basis interpretation
documentation + DPIA requirements
public sector investigations

Denmark often enforces GDPR where other EU states would merely issue guidance.

This creates an environment where organisations must assume:

every claim requires evidence
every decision is auditable
every processing activity must be fully documented

4. Denmark’s Interpretation of Lawful Basis

Denmark has some of the strongest restrictions on using:

legitimate interest for tracking or profiling
contract necessity for analytics or personalisation

Datatilsynet repeatedly states:

“If consent is required, no other legal basis can be used to bypass it.”

4.1 Obtaining valid consent in Denmark

Consent must be:

explicit
unambiguous
freely given
granular for each processing purpose
revokable at any time

Soft nudges and dark patterns are aggressively punished.

4.2 Danish rulings on unlawful contract-based processing

Datatilsynet rejects contractual necessity claims for:

analytics
behavioural advertising
personalised content
profiling recommendations

Only processing strictly necessary to deliver the core service qualifies.

5. Transparency Requirements in Denmark

Denmark has some of the strictest transparency rules in the EU.
Privacy notices must:

be written in plain, direct Danish
explain actual data flows
identify recipients clearly (not vague categories)
list all transfer mechanisms
include specific retention periods
describe profiling and its logic

Vague or generic privacy notices = automatic non-compliance.

Denmark often states:

“If users cannot understand your privacy notice, consent cannot be valid.”

6. Profiling & Automated Decision-Making (Denmark’s Approach)

Datatilsynet is one of the strictest authorities in Europe regarding:

profiling
automated decision-making
algorithmic scoring
behavioural prediction

The Danish regulator requires organisations to disclose:

data sources used in profiling
categories of data influencing outcomes
the logic behind scoring or ranking
potential consequences for the individual
how individuals can object or request human review

6.1 High-Risk Profiling Areas in Denmark

Datatilsynet defines the following as inherently high-risk:

credit scoring
insurance risk models
behavioural advertising
algorithmic recommendations
predictive analytics
employment monitoring tools

All require detailed DPIAs with evidence, not generic statements.

7. Cookies & Tracking — Denmark’s Interpretation

Denmark enforces strict cookie laws based on both GDPR and the Danish Cookie Order (Cookiebekendtgørelsen).

Datatilsynet has issued high-profile rulings requiring organisations to:

implement Reject All = Accept All design
block all tracking before consent
remove deceptive colours and nudges
avoid burying choices
evaluate third-party trackers using DPIAs

7.1 Denmark’s “No Consent, No Cookies” Standard

Denmark prohibits loading:

analytics scripts
advertising scripts
social media plugins
third-party tracking pixels

…before consent is obtained.

The regulator has banned multiple platforms from using non-essential cookies without proper consent.

8. Danish Requirements for High-Risk Processing

DPIAs are mandatory for:

monitoring employees
CCTV in workplaces
tracking customer behaviour
AI-driven decision systems
children’s data processing
municipal digital systems

Denmark often expands the definition of “high-risk” beyond the GDPR minimum.

9. Denmark’s Documentation Culture (“Show, Don’t Claim”)

Denmark is famous for requiring evidence, not statements in compliance documentation.

Organisations must maintain:

full ROPA
data flow diagrams
risk assessments
DPIAs with technical detail
security audit logs
access control records
change management logs
vendor screening documentation

A claim is worthless without proof — Datatilsynet repeats this often.

10. CPR Number Rules (Unique to Denmark)

The Danish CPR number (national ID) has special protection under Danish law.

10.1 You may only process CPR numbers when:

required by law
necessary to identify the person securely
explicit consent is obtained
used in secure, limited-access environments

Improper CPR handling is one of Denmark’s most frequent enforcement triggers.

11. Danish Expectations for Data Minimisation

Datatilsynet is extremely strict about only collecting what is necessary.
Common violations include:

collecting full birthdates when only age is needed
storing data indefinitely without justification
collecting behavioural analytics without consent
keeping copies of ID documents without lawful basis

Minimisation is a core principle in Danish GDPR enforcement.

12. Danish DPIA Standards (Among the Strictest in Europe)

A Danish DPIA must include:

detailed data flows
risk scoring with justification
clear mapping of alternatives considered
technical detail about systems
security documentation
transparent assessment of necessity and proportionality
plan for reducing residual risk

Datatilsynet rejects DPIAs that are:

generic
copy/paste from templates
lacking technical depth
missing risk scenarios

13. Children’s Data Protection in Denmark

Denmark enforces strict rules for children’s data, especially in:

schools
municipal digital systems
EdTech providers
social media platforms

Danish schools were forbidden from using certain Google platforms until DPIAs and transfer safeguards were corrected.

13.1 Children’s rights in Denmark include:

strong transparency about how data is used
no profiling without strict protections
parental consent for certain data types
data minimisation
high-security requirements

14. Denmark’s Approach to AI, Automated Decisions & Algorithmic Transparency

Denmark regulates AI with one of the strictest GDPR interpretations in Europe.
Datatilsynet requires organisations to justify the necessity, proportionality, fairness and transparency of AI systems in detail.

While the EU AI Act is coming, Denmark already enforces rigorous oversight based on GDPR Articles 5, 22 and Recitals 60–71.

14.1 AI Systems Automatically Considered High-Risk in Denmark

credit scoring algorithms
employment suitability scoring
AI-driven hiring filters
health diagnostic prediction tools
algorithmic profiling for insurance
behavioural advertising engines
AI recommendation systems used by minors
public-sector case-handling automation

Any AI system used by municipalities must undergo a full DPIA.

14.2 Required Disclosures in Denmark for AI Systems

data categories used for training
source of the data
how the model makes decisions
which input factors influence outcomes
bias mitigation steps
human intervention options
potential consequences for users

Opaque models are treated as violations of GDPR’s transparency and fairness principles.

14.3 Danish Demands for Algorithm Governance

Datatilsynet expects organisations to maintain:

model documentation
data quality reports
bias testing logs
access logs for model outputs
monitoring for drift and accuracy degradation

Failure to do so = unlawful processing.

15. Profiling & Behavioural Advertising in Denmark

Denmark is one of the most aggressive EU countries against behavioural advertising without consent.
Datatilsynet has ruled repeatedly that:

legitimate interest is NEVER valid for personalised advertising
contract cannot justify tracking
consent is mandatory for behavioural profiling

15.1 Denmark’s Strict Profiling Rules Include:

no tracking until explicit consent
no combining data across services without transparency
profiling explanations must be specific and understandable
users must be given meaningful opt-out options

16. Cookie Enforcement in Denmark (Extremely Strict)

Denmark enforces both GDPR and the Danish Cookie Order (Bekendtgørelse om information og samtykke i forbindelse med lagring og adgang til oplysninger i terminaludstyr).

Datatilsynet’s approach is stricter than many EU states:

All tracking requires consent — no exceptions.
“Reject All” must be equally prominent.
No pre-ticked boxes.
No misleading contrast (e.g., green Accept, grey Reject).
Analytics must be opt-in, not opt-out.
Cookie walls are often unlawful unless alternatives exist.

16.1 Denmark’s Design Pattern Rules (Consent UX)

Datatilsynet actively investigates the UI/UX of cookie banners.
They explicitly prohibit:

nudging buttons (Accept bright + large / Reject small + ghosted)
burying settings in multiple layers
default analytics on “legitimate interest”
statements like “we use cookies to improve your experience” (vague)
scroll or swipe = consent models

Denmark expects consent flows to be:

clear
direct
unmanipulated
action-based

17. Public Sector, Municipalities & School Systems (Denmark’s Unique High-Risk Area)

No EU country enforces GDPR in public-sector digital systems as aggressively as Denmark.
Municipalities and schools (folkeskole) have experienced:

bans on entire software platforms (e.g., Google Workspace cases)
forced rewrites of DPIAs
strict transfer controls
complete suspension of tools until compliance is proven

17.1 Mandatory Requirements for Municipal DPIAs

Danish regulations require extremely detailed DPIAs for:

school learning platforms
student monitoring systems
home-school communication apps
public-sector case management systems
cloud services used by municipalities

DPIAs must include:

full data flow mapping
vendor/subprocessor maps
transfer analysis (SCCs + TIAs)
risk assessment for children
assessment of technical safeguards
contingency planning

Lack of detail has resulted in bans affecting over 1 million students.

18. Employee Monitoring in Denmark

Denmark is stricter than most EU states regarding workplace monitoring.

18.1 Monitoring that requires a DPIA

CCTV in workplaces
GPS tracking of vehicles
employee productivity monitoring software
keystroke logging
email/communications surveillance

18.2 Consent is INVALID in employment

Denmark follows the Nordic principle that employees cannot freely consent due to power imbalance.
Consent ≠ valid lawful basis for workplace tracking.

Only legitimate interest or legal obligation can apply — with strict necessity tests.

18.3 Transparency Requirements for Employers

Employers must notify employees of:

monitoring practices
data retention periods
data access and review rights
purpose and justification

Surprise monitoring = illegal.

19. Denmark’s Special Categories: CPR, Health Data, Biometrics

Denmark treats certain data types as especially high-risk:

CPR number (national ID)
health data (extremely regulated)
biometric data (face, fingerprint, voice)
genetic data

19.1 CPR Number Processing Rules

You may ONLY process CPR numbers if:

required by law
necessary for secure identification
explicit consent obtained

Datatilsynet frequently fines organisations for mishandling CPR numbers.

19.2 Biometric Data Restrictions

Denmark classifies biometrics as highly sensitive.
Use cases such as:

fingerprint access control
facial recognition in workplaces
voice biometrics

…require a DPIA + legal basis beyond legitimate interest.

20. International Transfers in Denmark (Strict, Conservative, Documentation-Heavy)

Denmark follows GDPR and EDPB guidance, but enforces them more aggressively than many states.
Transfers to the US remain high-risk and require:

SCCs
Transfer Impact Assessment (TIA)
risk-based supplementary measures
encryption in transit and at rest
subprocessor mapping

20.1 Danish TIA Expectations

Danish TIAs must include:

details of US surveillance laws (FISA, EO 12333)
classification of data risk
description of technical measures
likelihood of government access
vendor safeguards

A vague TIA is considered no TIA.

21. High-Risk Processing Classification in Denmark

Denmark takes a broader view of high-risk processing than many EU states.
Processing is automatically high-risk if it involves:

children
public authorities
algorithmic decisions
systematic monitoring
CPR numbers
large-scale sensitive data
cross-border transfers outside EU

Thus, most modern digital services require a DPIA.

22. Denmark’s Security & Technical Requirements

Datatilsynet expects organisations to implement:

MFA for all admin accounts
strong encryption (AES-256, TLS 1.2+)
network segmentation
continuous logging and monitoring
penetration testing
secure coding practices
backup & disaster recovery

22.1 Danish Enforcement for Weak Security

Danish fines have been issued for:

unencrypted USBs
unencrypted emails with sensitive data
weak passwords
lack of access logs
CCTV with open access
poor vendor oversight

Security failures are one of Denmark’s most punished GDPR violations.

23. Denmark’s GDPR Enforcement Landscape

Datatilsynet is one of the most active and uncompromising GDPR regulators in Europe.
Unlike some authorities, Denmark regularly issues:

public reprimands
bans on specific processing activities
mandatory DPIA revisions
referrals for criminal proceedings
strict compliance orders

While Denmark does issue fines, the regulator’s signature move is:

outright prohibitions on unlawful processing

This is more damaging (and more feared) than fines, especially for municipalities, schools, SaaS vendors and public-sector digital systems.

24. Major Danish GDPR Cases (High-Impact Precedents)

These landmark cases shaped GDPR interpretation in Denmark and across Europe.

24.1 Google Workspace for Schools — The Odense Case

The most globally impactful Danish ruling.

Datatilsynet temporarily banned Google Workspace in Odense Municipality schools because:

DPIAs were incomplete
data flows were unclear
transfer safeguards were insufficient
subprocessor oversight was inadequate
CPR number handling was not justified

This case forced municipalities nationwide to rewrite DPIAs and seek extensive clarification from Google.

Result:
Millions of EU students were affected.
The case influenced EDPB positions on cloud transfers.

24.2 Danish Taxi App Cases — GPS Tracking & Employee Data

Multiple taxi companies were reprimanded or fined for:

GPS tracking drivers beyond necessary periods
keeping journey logs indefinitely
insufficient transparency

Danish regulators emphasised:

“Collect only what is strictly necessary and delete immediately when no longer required.”

24.3 Danish Municipalities — Widespread DPIA Failures

Dozens of municipalities were reprimanded for:

insufficient DPIAs
poor system documentation
unclear vendor contracts
lack of retention policies
insufficient access controls

Datatilsynet stated repeatedly:

“Public authorities must set the highest standard for GDPR compliance.”

24.4 Gym Chain Case — Illegal Biometric Access Control

A Danish fitness chain used fingerprint scanning for membership check-ins.
Datatilsynet ruled it unlawful because:

fingerprints are biometric data (special category)
no legitimate interest justification
no explicit consent (which would still not be sufficient)

Result: biometric access was banned.
A warning to all gyms, coworking spaces and workplaces in Denmark.

24.5 The Municipality of Helsingør — CCTV Storage Violations

CCTV footage was stored too long.
Datatilsynet ordered:

immediate deletion
rewriting of retention policies
staff retraining

This became a model case for CCTV regulation across Denmark.

25. DSAR Requirements in Denmark (Strict, High-Detail)

Denmark enforces GDPR Article 15 more aggressively than almost any EU state except Ireland.
Organisations must respond to DSARs:

within 30 days
with complete detail
free of charge

Partial responses = violation.

25.1 What a Danish DSAR Response MUST Contain

Datatilsynet requires explicit answers for:

what data is processed
where it came from
why it is processed
how long it is kept
legal basis for each purpose
all recipients (must be specific, not “categories”)
whether profiling occurs
logic used in automated decisions
copies of actual data

Omitting any of these may be considered non-compliance.

25.2 Identity Verification Rules

Denmark is strict:
organisations must verify identity, but:

must not over-collect personal data
must not request CPR or ID unless strictly needed

26. ROPA Requirements in Denmark (Records of Processing Activities)

Denmark has one of the strictest expectations for ROPA.

Datatilsynet repeatedly fines organisations for:

generic ROPA descriptions
missing retention periods
incomplete subprocessor lists
lack of transfer information

26.1 Required ROPA Fields in Denmark

processing purpose (detailed)
legal basis for each purpose
categories of data subjects
categories of personal data
full list of recipients
transfer mechanisms (SCCs, TIAs, etc.)
retention schedules
security measures
data flow architecture

Datatilsynet expects each entry to be extremely specific.

27. Data Retention Rules in Denmark

Denmark requires organisations to maintain clear, purpose-specific retention periods.
“Keep as long as necessary” is illegal unless justified with clear reasoning.

27.1 Common Danish Retention Standards

Data Type	Retention Period	Notes
Employee files	5–10 years	Depends on labor disputes and tax law
Financial records	5 years	Danish bookkeeping law
CCTV footage	30 days typical	Longer requires strict justification
Access logs	6–24 months	Risk-based
Health data	5–30 years	Sector rules + GDPR

28. Breach Notification Rules in Denmark

Denmark is extremely tough on breach mismanagement.

28.1 Breach Notification Requirements

DPC must be notified within 72 hours
affected individuals must be notified if risk is high
breach log must be maintained
risk assessment must be documented
root-cause analysis must be provided
corrective actions must be implemented

Failing to notify leads to enforcement even if the breach itself is minor.

29. Governance Frameworks for Danish Organisations

29.1 SME GDPR Framework (Denmark Edition)

A simple but regulator-approved model:

Data mapping (full inventory)
ROPA creation
Cookie banner + consent management tool
Retention schedule
Security controls (MFA, encryption)
DPIAs where required
DSAR workflow
Vendor risk assessment
Staff training

29.2 Enterprise Governance Framework (Large Companies & Public Sector)

Denmark imposes high governance expectations on large controllers such as municipalities, hospitals, banks and global tech firms.

Chief Privacy Officer (global or Nordic)
↓
Danish DPO
↓
Data Governance Committee
↓
Information Security Management
↓
AI + Algorithmic Oversight Team
↓
Data Owners & System Managers
↓
Local Data Stewards (departments)

29.3 Enterprise Responsibilities

annual DPIA reviews
quarterly ROPA updates
continuous incident monitoring
vendor audits
technical assessments (security, transfers)

30. Denmark’s Data Architecture Requirements

Datatilsynet expects organisations to understand and document technical flows.

User → Consent Layer → Application → Database → Access Control → Logs → Vendor → Transfers → Backup → Disposal

Architecture documentation must show:

entry/exit points
encryption boundaries
vendor integrations
transfer pathways
data lifecycle stages

31. GDPR in Danish Healthcare (Hospitals, Regions, Clinics, eHealth Systems)

Denmark’s healthcare system — overseen by the Danish Regions, Sundhedsdatastyrelsen (The Danish Health Data Authority), and individual hospitals — is one of the most heavily regulated GDPR environments in Europe.

Key factors:

large volumes of sensitive health data
nationwide electronic health records (Sundhedsjournalen)
extensive digital health infrastructure
public-sector DPIA obligations
strict CPR number rules

31.1 High-Risk Health Data Processing

The following always require a DPIA in Denmark:

electronic health records
telemedicine & remote patient monitoring
AI-assisted diagnostics
genetic testing & biobanks
clinical trial data collection
cross-border medical data transfers

31.2 Hospital Security Requirements (Datatilsynet Standards)

multi-factor authentication for staff
log management for every access to patient records
automatic log alerts for unusual behaviour
fully encrypted data stores
DPIAs for all new medical technologies
documented retention periods for clinical data

Hospitals are regularly audited, and violations are public.

31.3 Danish Retention Requirements for Health Data

Type	Retention	Basis
Medical records	Minimum 5 years	Danish Health Act
Radiology	10 years+	Professional guidelines
Psychiatry	10–30 years	Clinical needs
Research data	10–25 years	Ethics + GDPR

32. Clinical Research, Biobanks & Genomic Data

Denmark is a global leader in epidemiology and genetic research, which creates some of the strictest GDPR-governed research environments.

32.1 Mandatory Requirements

explicit consent or statutory basis
detailed DPIAs
pseudonymisation as default
strict access control
secure IT infrastructure
ethics committee approval

Denmark’s biobanks — some of the oldest and largest in the world — require impeccable data governance.

33. Financial Services & Banking (Danmarks Nationalbank, FSA, Private Institutions)

Denmark’s financial institutions are monitored by both:

Finanstilsynet (Danish Financial Supervisory Authority)
Datatilsynet (GDPR regulator)

The financial sector operates under a dual-compliance model:
financial law + GDPR.

33.1 High-Risk Activities (Always DPIA Required)

AML screening (anti-money laundering)
fraud detection algorithms
KYC identity verification systems
credit scoring models
transaction monitoring

33.2 Security Expectations for Banks

MFA for internal and customer systems
encryption of all financial data
SIEM + 24/7 monitoring
network segmentation
secure coding and vulnerability scanning

34. Insurance Sector (Life, Property, Motor, Health)

Datatilsynet scrutinises insurers for:

profiling transparency
fairness in automated decisions
use of telematics in motor insurance
processing of health information

34.1 Denmark’s Position on Insurance Profiling

Insurers must explain:

evaluation criteria
factors affecting premiums
data used for scoring
rights to contest decisions

35. Telecom & Internet Providers (TDC, Telia, 3, Stofa, etc.)

Telecoms process vast amounts of sensitive data:

location data
traffic logs
metadata
subscriber identity

35.1 Mandatory GDPR Requirements

data minimisation for traffic monitoring
end-to-end encryption
strict access-role separation
CCTV and physical security controls
clear retention schedules

Danish telecom cases often revolve around excessive retention or insufficient security.

36. Public Sector & Municipal Authorities

No country in Europe enforces GDPR on the public sector more aggressively than Denmark.

Municipalities (kommuner) handle:

social services
welfare data
children’s educational records
personal case management
public housing data
elder care systems

Because the public expects transparency and security, Datatilsynet performs regular, deep audits.

36.1 Common Public-Sector Violations

missing DPIAs
improper use of cloud services
outdated or incomplete privacy notices
insufficient transfer documentation
poor data minimisation practices

The regulator regularly issues orders prohibiting software until risks are mitigated.

37. Education Sector (Folkeskoler, Gymnasier, Universities, EdTech)

Denmark’s most publicised GDPR battles relate to schools using cloud platforms.

37.1 Mandatory DPIA Requirements for Schools

Google/Chromebook environments
learning analytics platforms
home-school communication apps
digital testing systems

37.2 Denmark’s Strict Rules for Minors

processing must be necessary and proportionate
profiling of children is high-risk by default
parental transparency obligations are stronger
cross-border transfers must be fully justified

38. SaaS, Cloud & Tech Companies Operating in Denmark

Denmark is a major cloud and SaaS adoption market.
However, Datatilsynet requires extremely rigorous documentation.

38.1 SaaS DPIA Requirements

If your SaaS product:

uses analytics
tracks user behaviour
processes sensitive data
uses non-EU vendors
relies on cookies

A DPIA is required with full detail.

38.2 Cloud Provider Obligations

SCCs + TIAs for any US transfer
server location transparency
sub-processor listing
access logs for administrators
encryption key management documentation

39. E-Commerce, Retail & Loyalty Systems

Denmark’s e-commerce rules focus on:

cookies
email marketing consent
loyalty program transparency
profiling disclosures
behavioural advertising restrictions

39.1 Loyalty Program DPIAs

Required when:

behaviour is tracked over time
purchase history is profiled
cross-channel analytics are used

40. Media, Publishing & Content Platforms

Danish regulators target:

ad-tracking systems
cookie banners
analytics without consent
algorithmic personalisation without transparency

41. Transportation, Logistics & Mobility

GDPR applies to:

vehicle GPS systems
fleet management tools
public transit RFID systems
ride-sharing and micro-mobility apps

41.1 DPIA Required for:

real-time tracking
driver monitoring
behavioural analytics

42. Energy, Utilities & Smart Infrastructure

These sectors process:

smart-meter data
usage patterns
building automation data
location-linked energy usage

42.1 High-Risk Factors

household behavioural patterns
risk of intrusion detection
mass surveillance potential

43. The Complete Denmark GDPR FAQ

This FAQ is optimised for Denmark’s most common search intents, Datatilsynet complaints data, Danish-language queries translated into English, and sector-specific needs.

GENERAL QUESTIONS ABOUT GDPR IN DENMARK

1 Is GDPR enforced strictly in Denmark?

Yes — Denmark is one of the strictest GDPR jurisdictions in Europe.

2 Which law implements GDPR in Denmark?

The Danish Data Protection Act (Databeskyttelsesloven).

3 Who enforces GDPR?

Datatilsynet (The Danish Data Protection Authority).

4 Does Denmark allow legitimate interest for analytics?

No — analytics requires consent unless extremely limited and anonymised.

5 Are cookie walls legal in Denmark?

Usually no — unless a genuine, equivalent alternative is offered.

COOKIE CONSENT FAQ (DENMARK-SPECIFIC)

6 Must websites provide equal “Accept” and “Reject” buttons?

Yes. Denmark bans manipulative banner design.

7 Can analytics load before consent?

No — this is a widely enforced violation.

8 Are third-party advertising cookies allowed?

Only with explicit, prior consent.

9 Can scrolling be treated as cookie consent?

No, not in Denmark.

AI & PROFILING FAQ

10 Does Denmark require AI explainability?

Yes. Datatilsynet requires human-understandable logic descriptions.

11 Are AI hiring systems high-risk?

Always. DPIA required.

12 Can companies use AI to recommend content to users?

Yes, but profiling must be disclosed and consent required if tracking is involved.

PUBLIC-SECTOR & SCHOOL SYSTEM FAQ

13 Why did Denmark ban Google Workspace for schools?

DPIAs were incomplete, transfers unclear, CPR numbers mishandled.

14 Do Danish schools need DPIAs for new software?

Yes — mandatory.

15 Can student data be transferred to the US?

Only with a full TIA + SCCs + technical safeguards.

EMPLOYMENT & WORKPLACE FAQ

16 Can employers rely on consent?

No. Consent is not valid in Danish employment relationships.

17 Is GPS tracking of employees allowed?

Yes, but requires DPIA + transparency + purpose limitation.

18 Can employers read employee emails?

Only under strict conditions and with clear policy documentation.

CPR NUMBER FAQ

19 When can CPR numbers be processed?

Only when required by law, necessary for security, or with explicit consent.

20 Are CPR numbers considered sensitive?

Yes — extremely sensitive under Danish law.

DSAR FAQ (DENMARK-SPECIFIC)

21 How quickly must DSARs be answered?

30 days — strict.

22 Must data sources be disclosed?

Yes — Denmark is unforgiving on transparency.

23 Can companies refuse a DSAR?

Only if manifestly unfounded and evidence is provided.

RETENTION FAQ

24 Are vague retention periods allowed?

No — every process must have a specific timeline.

25 Must CCTV footage be deleted within 30 days?

Yes, unless justified exceptions apply.

TRANSFER FAQ

26 Are US transfers allowed?

Yes, but only with SCCs + TIA + supplementary measures.

27 Must sub-processors be listed publicly?

Datatilsynet recommends full transparency.

BREACH FAQ

28 When must Datatilsynet be notified?

Within 72 hours.

29 What if a breach affects CPR numbers?

High urgency — notification required in almost all cases.

SECTOR FAQ (SUMMARY)

Healthcare: DPIAs mandatory + log management
Banks: AML, credit scoring, AI = high-risk
Insurance: profiling transparency required
Education: the strictest cloud-use rules in Europe
SaaS: TIAs + strict consent obligations
Telecom: metadata retention rules strictly enforced

44. Danish SME GDPR Compliance Blueprint (2025 Edition)

This blueprint is specifically designed for Danish small and medium enterprises.

44.1 Step-by-step Compliance Model

Create a data inventory (map all processing).
Build your ROPA (must be detailed).
Implement cookie consent tools with Reject=Accept.
Draft transparent privacy notices in plain Danish.
Set clear retention periods following Danish law.
Secure systems (MFA, encryption, access controls).
Create a DSAR workflow.
DPIA for high-risk areas (tracking, profiling, CCTV, cloud).
Vendor contracts (DPAs, SCCs, TIAs).
Breach management procedure.

45. Enterprise & Public-Sector GDPR Framework (Denmark Edition)

Designed for municipalities, hospitals, banks, insurance companies, cloud vendors and multinational tech firms.

45.1 Governance Structure

Chief Privacy Officer
↓
Danish DPO
↓
Privacy Governance Board
↓
System Owners / Data Stewards
↓
Information Security (SOC, IR Teams)
↓
AI & Algorithm Oversight Committees
↓
Risk, Compliance & Vendor Teams

45.2 Key Responsibilities

annual DPIA audits
quarterly ROPA updates
continuous security monitoring
formal risk assessments
TIAs for all non-EU transfers
vendor management programme

46. Denmark ROPA Template (Regulator-Level Detail)

Processing Activity:
Purpose:
Legal Basis (Article 6 / Article 9):
Data Subjects:
Data Categories:
Recipients:
Transfers (SCC, TIA, supplementary measures):
Retention Period (explicit):
Security Measures:
System Architecture Notes:
Responsible Person:
Review Cycle:

47. Denmark DPIA Template (Strict Regulatory Standard)

1. Project Overview
2. Processing Description
3. Necessity & Proportionality
4. Lawful Basis Justification
5. Data Flow Diagram
6. Risk Scenarios (High detail)
7. Impact on Rights & Freedoms
8. Children’s Data Assessment (if relevant)
9. AI/Profiling Logic Explanation
10. Alternatives Considered
11. Security Measures (technical + organisational)
12. Third-Country Transfer Assessment (TIA)
13. Residual Risk Evaluation
14. DPO Opinion
15. Decision + Mitigation Plan

48. Denmark TOMs Template (Technical & Organisational Measures)

• MFA everywhere
• Encryption (AES-256, TLS 1.2+)
• Secure key management
• Role-Based Access Control (RBAC)
• Segmented network zones
• Intrusion detection & SIEM
• Logging (access, admin, API)
• Secure coding standards
• Regular penetration testing
• Backup & disaster recovery
• Staff security training

49. Retention & Deletion Matrix (Danmark-Specific)

Data Category:
Processing Purpose:
Retention Rule (explicit number of years):
Danish Legal Basis:
Deletion Method:
Archive Security Level:
Responsible Department:
Review Frequency:

Denmark maintains one of the most demanding GDPR environments in Europe, combining highly protective legal traditions with Datatilsynet’s uncompromising enforcement culture.
This guide has mapped the legal, operational, technical, sectoral, and governance expectations across all major industries in Denmark, including public-sector systems, healthcare, banking, SaaS, e-commerce, education, and high-risk AI processing.

The Danish approach is characterised by:

documentation requirements far above EU minimum standards
strict consent and cookie rules
zero tolerance for vague retention schedules
aggressive oversight of public-sector and cloud systems
deep transparency obligations
far-reaching DPIA expectations
strict handling of CPR numbers

By following the frameworks, templates, governance models, and best practices provided here, any organisation — from local SME to multinational tech provider — can build a GDPR programme capable of passing Danish scrutiny and operating with confidence.