Data protection & privacy law in Denmark (2026)

Legal framework

EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) as supplemented nationally by the Danish Data Protection Act (Consolidated Act No. 289 of 8 March 2024); sector rules include the TV Surveillance Act and Executive Order No. 1148/2011 on cookies. Supervisory authority: Datatilsynet (Danish Data Protection Agency).

GDPR & data protection in Denmark

In Denmark, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Danish Data Protection Agency (Datatilsynet).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Danish Data Protection Agency (Datatilsynet)

Applies to

any organisation processing the personal data of people in Denmark, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Denmark supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Denmark

1. 01Primary law

   GDPR applies directly and is supplemented by the Danish Data Protection Act (Consolidated Act No. 289 of 8 March 2024), which implements Member State derogations and national provisions on processing.

   datatilsynet.dk iapp.org

2. 02Supervisory authority

   Datatilsynet (the Danish Data Protection Agency) supervises compliance with the GDPR and the Data Protection Act, handles complaints, conducts inspections, issues binding orders and reprimands, and can recommend fines to prosecutors.

   datatilsynet.dk en.wikipedia.org

3. 03Enforcement via courts (Danish specificity)

   Because Danish constitutional practice bars administrative authorities from imposing punitive fines, GDPR fines in Denmark must be pursued through the criminal courts on police/prosecution referral — e.g., the Western High Court fined ILVA A/S DKK 1.5m (~€200,900) in 2025 for storage-limitation breaches.

   linklaters.com whitecase.com

4. 04National-specific rules (CPR, CCTV, consent age)

   The Data Protection Act restricts processing of the CPR (national ID) number by private entities; the TV Surveillance Act requires CCTV footage to be deleted within 30 days unless handed to police; the digital-consent age for information-society services is set at 13.

   datatilsynet.dk whitecase.com

5. 05Cookies & ePrivacy

   Executive Order No. 1148 of 9 December 2011 (Cookiebekendtgørelsen) implements the ePrivacy Directive and requires prior informed consent for non-essential cookies; it is enforced by the Danish Agency for Digital Government (Digitaliseringsstyrelsen), with joint DPA guidance published in May 2025 targeting dark patterns.

   cookieinformation.com dataguidance.com

6. 062026 supervisory priorities

   Datatilsynet's 2026 focus is on new monitoring technologies (access logging, CCTV, GPS, AI-based tools), AI in health/care settings, employee monitoring, and cookie-consent compliance including manipulative design patterns.

   grip.globalrelay.com njordlaw.com

GDPR in Denmark: FAQ

Timeline of decisions

1. 2 Feb 2026Enforcement
   DPA criticizes 51 municipalities over Google in schools

   Following its reassessment of the Google Chromebook/Workspace setup, Datatilsynet issued serious criticism of 51 municipalities for unlawful processing of pupils' data, showing the years-long schools dispute remains unresolved.

   The Copenhagen Post

2. 30 Jan 2024Decision
   Chromebook/Google Workspace order extended to all municipalities

   Datatilsynet extended its Helsingør ruling to all ~53 municipalities using the same Google Workspace for Education setup, issuing binding orders to fix third-country transfer and controller-control problems.

   GDPRhub (Datatilsynet 2023-431-0001)

3. 12 Jan 2024Enforcement
   Record DKK 15m fine recommended against Netcompany (mit.dk)

   Datatilsynet reported Netcompany to police and recommended its largest-ever fine after a coding flaw in the mit.dk digital-mailbox authentication could let users access others' public-authority mail.

   DataGuidance

4. 1 Jan 2024Enforcement · official
   Datatilsynet recommends record GDPR fine against Netcompany over mit.dk

   The Danish Data Protection Agency reported Netcompany to police and recommended a record ~DKK 15m fine after a coding flaw in the mit.dk digital-post authentication component briefly exposed citizens' confidential data, faulting inadequate security and a missing impact assessment.

   Datatilsynet

5. 21 Sept 2022Decision
   Datatilsynet declares Google Analytics unlawful

   The DPA found Google Analytics non-compliant with GDPR because it transfers personal data to the US without adequate safeguards post-Schrems II, making Denmark the fourth EU state to reach this conclusion.

   DataGuidance

6. 14 Jul 2022Decision
   Helsingør school Chromebook/Google Workspace ban

   In a landmark decision, Datatilsynet banned Helsingør municipality's use of Google Chromebooks and Workspace for Education in primary schools and suspended US data transfers until GDPR-compliant.

   TechCrunch

7. 5 Apr 2022Enforcement · official
   DKK 10m fine recommended against Danske Bank

   After the bank self-reported it could not document deletion across 400+ systems holding millions of customers' data, Datatilsynet filed a police report proposing a ~EUR 1.3m fine for retention/deletion failures.

   EDPB

8. 18 Mar 2019Enforcement · official
   First Danish GDPR fine recommendation: Taxa 4x35

   Datatilsynet proposed Denmark's first GDPR fine (DKK 1.2m) against taxi firm Taxa 4x35 for over-retaining customer phone numbers tied to ~9m rides, breaching the data-minimisation principle.

   EDPB

9. 25 May 2018Law · official
   GDPR becomes applicable across the EU

   Regulation (EU) 2016/679 (adopted 14 April 2016) took effect, directly applying in Denmark and establishing the core data-protection framework that supersedes the 1995 Directive.

   EUR-Lex

10. 23 May 2018Law · official
    Danish Data Protection Act adopted (Act No. 502)

    Denmark enacted the Data Protection Act to supplement the GDPR with national derogations (e.g. on CPR numbers, employment and research) and designated Datatilsynet as supervisory authority.

    Datatilsynet

11. 1 Jul 2000Law · official
    Act on Processing of Personal Data (Persondataloven) enters force

    Act No. 429 of 31 May 2000 transposed the EU Data Protection Directive 95/46/EC into Danish law, governing personal-data processing until replaced by the GDPR regime in 2018.

    Council of Europe

12. 1 Jan 1978Law
    Denmark's first data-protection statutes

    The Private Registers Act and the Public Authorities' Registers Act introduced Denmark's first rules on personal-data registers, predating the EU framework and laying the groundwork for later laws.

    GDPRhub

Sources

1. 1.datatilsynet.dk/media/7753/danish-data-protection-act.pdf
2. 2.datatilsynet.dk/english
3. 3.iapp.org/news/a/analysis-the-danish-data-protection-act-and-its-gdpr-derogatio
4. 4.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-denmark
5. 5.linklaters.com/en/insights/data-protected/data-protected---denmark
6. 6.grip.globalrelay.com/danish-dpa-releases-new-supervisory-priorities-2026/
7. 7.njordlaw.com/danish-data-protection-agency-steps-supervision-employee-monitoring-2
8. 8.cookieinformation.com/regulations/cookie-guidelines/danish-cookie-guidelines/
9. 9.dataguidance.com/sites/default/files/engelsk-vejledning-cookiebekendtgorelse.pdf
10. 10.en.wikipedia.org/wiki/Danish_Data_Protection_Agency