Cybersecurity law & regulation in Denmark (2026)

Legal framework

Danish NIS2 Act (Act No. 434 of 6 May 2025 on Measures for a High Level of Cybersecurity — 'Cybersikkerhedsloven'), transposing EU Directive 2022/2555; supplemented by sector-specific acts (telco Act No. 435/2025, plus energy and finance rules) and the CER Act (Act on the Resilience of Critical Entities); DORA (Reg. (EU) 2022/2554) applies directly to financial entities. Baseline oversight sits with the Danish Resilience Agency (SAMSIK) under the Ministry of Resilience and Preparedness (est. 29 Aug 2024); the Centre for Cyber Security (CFCS, under the Danish Defence Intelligence Service) remains national CSIRT.

NIS2 & cybersecurity law in Denmark

In Denmark, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Denmark implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Denmark

1. 01Primary law (NIS2 transposition)

   The Act on Measures for a High Level of Cybersecurity (Lov nr. 434 af 6. maj 2025) entered into force on 1 July 2025, imposing risk-management, governance and reporting duties on 'essential' and 'important' entities across sectors listed in Annexes I and II of NIS2.

   digital-strategy.ec.europa.eu samsik.dk

2. 02Sector-specific approach

   Denmark opted for a decentralised model: telecoms are covered by Act No. 435 of 6 May 2025 (Security and Preparedness in the Telco Sector), energy and finance by dedicated sector laws, and each ministry's regulator (e.g., Finanstilsynet, Energistyrelsen) acts as competent authority rather than a single national cyber regulator.

   ezine.eversheds-sutherland.com samsik.dk

3. 03Incident reporting duties

   Entities must submit an early warning within 24 hours of becoming aware of a significant incident, a fuller incident notification within 72 hours (deadlines run concurrently), and a final report within one month (or one month after the incident is handled). Reports go via the competent sector authority; CFCS receives them in its CSIRT role.

   twobirds.com digital-strategy.ec.europa.eu

4. 04Registration and enforcement timeline

   Entities in scope of the Danish NIS2 Act were required to register by 1 October 2025; missing the deadline is itself a compliance breach. CFCS/SAMSIK have signalled audits of essential entities from early 2026, and Danish penalties are notably criminal rather than administrative in structure.

   samsik.dk ezine.eversheds-sutherland.com

5. 05Financial sector — DORA

   The EU Digital Operational Resilience Act (Reg. (EU) 2022/2554) has applied directly since 17 January 2025 to banks, insurers, payment/e-money institutions, investment firms and CASPs. Finanstilsynet (Danish FSA) is the sole competent authority, formally designated via an amendment to the Financial Business Act adopted 2 May 2024, and began preparing its first DORA inspections in 2025.

   finansforbundet.dk doragrc.com

6. 06Critical infrastructure — CER Act

   Denmark's Act on the Resilience of Critical Entities (transposing EU Directive 2022/2557) also entered into force on 1 July 2025, covering 11 sectors including energy, transport, banking, health, water, digital infrastructure, public administration, space and food. Sector authorities must designate critical entities by July 2026; those entities then have 9 months for a risk assessment and 10 months to implement a resilience plan.

   plesner.com gorrissenfederspiel.com

NIS2 in Denmark: FAQ

Timeline of decisions

1. 1 Jul 2025Law · official
   NIS2 main cybersecurity act enters into force

   Denmark's general cross-sector NIS2 statute (LOV nr. 434, 'Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau') takes effect, imposing risk-management, governance and incident-reporting duties on essential/important entities; covered entities had to self-register by 1 October 2025.

   Retsinformation (Danish official legislation portal)

2. 7 May 2025Enforcement · official
   European Commission opens infringement step over late NIS2 transposition

   Denmark missed the 17 October 2024 EU deadline to transpose NIS2, prompting Commission infringement action; the delay is why Danish cyber obligations only became binding from mid-2025.

   European Commission (Shaping Europe's digital future)

3. 6 May 2025Law · official
   Sector-specific NIS2 act for telecoms adopted

   A dedicated act on security and preparedness in the telecommunications and digital-infrastructure sector (LOV nr. 435) is enacted alongside the main law, reflecting Denmark's multi-statute, sector-responsibility implementation model rather than a single cyber code.

   Retsinformation

4. 6 Mar 2025Law · official
   Strengthened preparedness law for the energy sector (NIS2 + CER)

   LOV nr. 258 consolidates security and emergency-preparedness rules for electricity, gas, oil, heating and hydrogen operators, implementing both NIS2 and the Critical Entities Resilience directive and more than doubling the number of regulated energy companies to ~160.

   Retsinformation

5. 17 Jan 2025Law · official
   DORA becomes applicable to Danish financial entities

   The EU Digital Operational Resilience Act starts applying, setting ICT risk-management, incident-reporting and third-party (cloud) oversight rules for banks, insurers and other financial firms, supervised in Denmark by Finanstilsynet.

   ESMA

6. 12 Nov 2023Incident
   Largest coordinated cyberattack on Danish critical infrastructure disclosed

   SektorCERT's report details a May 2023 wave of attacks compromising ~22 energy companies via Zyxel firewall flaw CVE-2023-28771 (with possible GRU/Sandworm links), the largest such incident in Danish history and a key driver of tougher energy-sector rules.

   SektorCERT

7. 1 Dec 2021Guidance · official
   National Strategy for Cyber and Information Security 2022-2024 adopted

   The government's third national cyber strategy, funded with ~DKK 270m across 34 initiatives, continues Denmark's 'sector responsibility principle' approach where each ministry secures its own domain.

   Danish Agency for Digital Government (Digitaliseringsstyrelsen)

8. 25 Jun 2014Law · official
   Centre for Cyber Security Act establishes Denmark's national cyber authority

   LOV nr. 713 regulates the Centre for Cyber Security (CFCS) within the Defence Intelligence Service as Denmark's national IT-security authority, network-security service and centre of excellence, the foundational institution of today's framework.

   Retsinformation

Sources

1. 1.digital-strategy.ec.europa.eu/en/policies/nis2-directive-denmark
2. 2.samsik.dk/en/
3. 3.samsik.dk/nis2/overview-of-competent-authorities/
4. 4.ezine.eversheds-sutherland.com/eu-nis2-directive/denmark
5. 5.twobirds.com/en/insights/2024/denmark/nis-2-danmark---hvad-skal-din-virksomhed-vae
6. 6.finansforbundet.dk/en/news/2025/the-danish-financial-supervisory-authority-is-preparing-
7. 7.plesner.com/en/news/denmark-introduces-cer-act-strengthen-resilience-critical-ent
8. 8.gorrissenfederspiel.com/en/danish-implementation-of-the-eu-critical-entities-resilience-act/
9. 9.en.wikipedia.org/wiki/Ministry_of_Resilience_and_Preparedness_(Denmark)
10. 10.doragrc.com/blog/nordic-nca-digital-resilience-priorities-2026