Denmark

Danish data protection law copies the European Union rule on who is covered. It covers any company based in Denmark, wherever the computers actually sit. It also covers companies based outside the European Union when they handle data about people in Denmark. That applies when you offer them goods or services, or track how they behave in Denmark. Two industries add a hard local-presence rule. For gambling, a licence can only go to a company based in Denmark or another European Union or European Economic Area country. A company based elsewhere must appoint a representative approved by the Danish Gambling Authority. That representative must live or be based in Denmark. They must be able to represent the licence holder in court cases, including criminal ones. Under Danish network and information security law, some suppliers fall under Danish rules if their main European Union base is in Denmark. That covers cloud, data centre, content delivery, managed service, online marketplace, search engine and social network suppliers.

The answer depends on your industry. Here is each one, checked 18 August 2026. GOVERNMENT AND PUBLIC SECTOR — closed for a named list. An order made in February 2022 and re-issued in March 2023 lists eleven groups of systems that must run in Denmark. They are the defence resource system, Digital Post, the national identity login MitID, the public login gateway NemLog-in3, the state payroll solution, the national police systems, the common public data distributor, the civil registration system, the public case and document handling system, the credit register, and the emergency call system. The power behind this is open-ended. The Minister of Justice can add any government computer system to the list by making a new order. ACCOUNTING, ALL INDUSTRIES — a copy must stay in Europe. Is your bookkeeping system on the Danish Business Authority's register? If not, you must take a full backup at least weekly. You must keep it with a party unconnected to your business. It must sit on a server in a European Union or European Economic Area country. The same rule applies to registered standard systems. Breaking it brings a criminal fine. STATISTICS AND RESEARCH — closed. Detailed person-level data from Denmark's national registers is only available on Statistics Denmark's own research machines. You cannot copy, export, email, print or photograph data from those machines. Only summary results can be released, and only after review. EDUCATION AND LOCAL GOVERNMENT — it depends, and it is being fought over now. On 2 February 2026 the Danish Data Protection Agency issued serious criticism to 51 municipalities. The subject was Google's classroom products on pupil devices. The agency warned about hiring a supplier that uses sub-suppliers outside the European Economic Area without equal protection. That would likely break the European rules. It also said products with unclear data handling arrangements cannot lawfully be used. TELECOMS — no location rule, but a heavy record-keeping duty. From 30 March 2026 to 29 March 2027 all providers must record traffic data. That covers fixed, mobile and internet telephony, text messages, their own email services and internet access. They must keep it for one year. So records are held until 29 March 2028 at the latest. We found no requirement that the logs sit in Denmark. GAMBLING — no location rule, despite what many people say. A licence holder must build a data warehouse called SAFE. It holds standard records of every game played. The Danish Gambling Authority must be able to reach it online. Nothing in the current order says that warehouse must be in Denmark. All betting data must be kept five years. Player identity data must be kept five years after the customer relationship ends. BANKING, PAYMENTS, INSURANCE AND SECURITIES — conditions apply, but no rule about staying in the country. The European Union digital operational resilience rules have applied since January 2025. The Danish regulator runs outsourcing contract notifications and a register of technology suppliers through them. We found no Danish rule requiring financial data to stay in Denmark, checked 18 August 2026. HEALTH — conditions apply, but we found no rule about staying in the country. Doctors and dentists must keep patient records for ten years. Other health professionals must keep them for five years. We found no rule requiring those records to be held in Denmark, checked 18 August 2026. MAPPING AND GEOSPATIAL, DEFENCE — we found no civil rule about staying in the country, checked 18 August 2026. Classified defence material is handled under separate security rules. We did not examine those.

You can only send data to approved countries, and the approved list is long. These are the countries the European Commission had approved as of 18 August 2026. Andorra, Argentina, Brazil (new on 26 January 2026, and mutual), Canada for commercial organisations, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), and Uruguay. The United States is included, but only for organisations that have self-certified under the European Union-United States Data Privacy Framework. The European Patent Organisation has been on the list since 15 July 2025. No approval has been withdrawn or suspended. If no approval covers your destination, use the 2021 standard contract clauses. They are still the current set and are unchanged. The promised new clauses for recipients already covered directly by European rules have still not been adopted. Approved group-wide rules are also available. The narrow emergency exceptions cannot be used for routine or bulk transfers. You are still expected to write a risk assessment for the transfer. The European Union-United States arrangement is in force and legally valid today. But it is under pressure. An appeal against the General Court's September 2025 dismissal in the Latombe case is pending before the Court of Justice. On 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent United States developments affect its validity. Never build on it as your only route. Separately, Danish law makes breaking the European transfer rules a crime. The penalty is a fine or up to six months in prison.

Enforcement is active, not aggressive. The numbers come from the regulator's own 2025 annual report, published March 2026. It opened 20,536 new cases. It received 9,849 personal data breach reports, 5,167 from public authorities and 4,630 from private organisations. It ran 3,653 supervision and enforcement cases and 2,867 advice and guidance cases. It opened 525 cases on its own initiative. It filed exactly 2 police reports with a recommended fine during the year. The agency's own fines page explains why. In most European countries the privacy regulator can impose fines itself. In Denmark that currently has to go through the courts. The agency refers the case to the police with a recommended amount. Since a 2023 change the agency can also offer a settlement without a court case. That only works where the offender admits guilt and pays. The 2025 annual report does not record any use of that route. So its strongest tools are the ones that do not involve money. Those are orders, bans on using data, and public criticism. The February 2026 Chromebook decision, covering 51 municipalities at once, is the clearest recent example. Other regulators are also active. The Danish Business Authority covers bookkeeping. The Danish Financial Supervisory Authority covers technology resilience in finance. The Danish Gambling Authority covers licence holders. The Danish Agency for Societal Security covers the network and information security rules. The Danish Defence Intelligence Service acts as the national computer security incident response team.

Minimums, all checked 18 August 2026. Accounting material must be kept securely for five years from the end of the financial year it covers. That comes from the Bookkeeping Act. You also need a weekly full backup with an unrelated third party, on a server in the European Union or European Economic Area. Patient records must be kept at least ten years from the last entry by doctors, dentists, midwives and certain specialists. Other authorised health professionals must keep them at least five years. That comes from the Danish Patient Safety Authority. Gambling licence holders must keep identity and control information about a registered player for at least five years after the customer relationship ends. They must keep all data about betting offered in the gambling system for at least five years. Telecoms providers must keep the traffic data recorded under the March 2026 logging order for one year from when it was recorded. So data recorded on the last covered day is held until 29 March 2028. Criminal liability under the data protection law itself runs out after five years. Now the maximums. The European rule against keeping data longer than you need applies unchanged. Danish law also protects information about people who have died for ten years after death. That is a Danish addition with no European equivalent. When a minimum and a maximum clash, Denmark handles it the ordinary European way. A legal duty to keep data is an express exception to the right to erasure. So the specific keeping period wins until it runs out.

Clock one, personal data. You have 72 hours from the moment you know, and you tell the Danish Data Protection Agency. You must also tell affected people without undue delay where the risk to their rights is high. The Agency received 9,849 such reports in 2025. So this is a heavily used channel and the reporting form is well established. Clock two, cyber security. The Danish network and information security law has applied since 1 July 2025. Essential and important organisations must send an early warning about a significant incident. It goes to the relevant sector authority and to the national computer security incident response team. It is due without undue delay and within 24 hours of becoming aware. It must say whether the incident looks malicious or has cross-border effects. A fuller notice follows within 72 hours, with a first severity assessment and signs of compromise. An interim report follows on request. A final report is due within one month of the incident notice. The incident response team must reply within 24 hours of the early warning. You must also tell affected customers without undue delay. Failing to report brings a criminal fine, and companies can be held criminally liable. Clock three, finance. The European digital operational resilience rules have applied to financial firms since 17 January 2025. They run their own major incident reporting timetable through the Danish Financial Supervisory Authority. Clock four, telecoms. A separate Danish law on security and preparedness in telecoms sits outside the cyber security law. We did not examine it in detail here. The overlap is the usual failure point. The 24-hour cyber warning is due long before the 72-hour privacy report is ready.

Trap one, the age. Denmark set the age at which a child can agree to online services at 15. That is the middle of the range the European rules allow. Most global age gates are built for 13 or 16. So both settings are wrong for Denmark. Below 15, a parent or guardian must give or approve consent. Trap two, crime not fine. Danish law punishes four kinds of breach. The core principles. People's individual rights. The duties on companies that handle data. And the rules on sending data abroad. The penalty is a fine or up to six months in prison. Blocking the regulator, or ignoring its orders, is a separate crime. A court can also ban someone from running a business that stores personal data. This changes how you handle an investigation. Because it is a criminal matter, the file is closed. You cannot use the ordinary right to see case documents. Trap three, the personal identity number. The Danish civil registration number has its own rulebook. Public authorities can use it to identify someone uniquely, or as a file number. Private organisations can only use it in limited cases. Those cases are these. Where a law requires it. Where the person has agreed. For scientific or statistical purposes. Where an authority requires it. Or where passing it on is a natural part of normal business of that kind, and is decisive for identifying someone uniquely. You must never publish it without consent. Danish systems are full of this number. Foreign-built systems routinely treat it as an ordinary customer reference. Trap four, the accounting backup. Is your bookkeeping system on the Danish register? If not, you must take a full weekly backup. It must be kept with a party unrelated to your business, on a server in a European Union or European Economic Area country. That party is presumed to meet recognised information security standards. Breaking this brings a fine. This is a real rule about keeping data in Europe. It hides inside company law rather than privacy law. It hits foreign groups running a single global accounting platform hardest. Trap five, the switch that can be flipped at any time. Danish law lets the Minister of Justice decree that personal data in named government computer systems may only be stored in Denmark. The Minister consults the relevant minister first. Beyond that, the law sets no consultation requirement, no threshold and no list of qualifying systems. The power has already been used to capture eleven groups of systems. The list was expanded once in 2023. If you run a system for a Danish public authority, treat this as a live commercial risk.

Already in force. The Danish network and information security law started on 1 July 2025. Registration through the business portal opened the same day and closed on 1 October 2025. Organisations that become covered later get a two-week window. Changes must be reported within three months. Digital Sundhed Danmark is a new self-governing institution for health digitisation. It was passed on 29 December 2025 and started on 1 January 2026. The digital bookkeeping duty reached its final phase on 1 January 2026. It now covers non-financial businesses with net revenue above 300,000 Danish kroner, roughly 45,000 United States dollars, in two years running. Proposed, with no legal effect yet. On 7 November 2025 the government and a broad group of parties agreed a package on digital protection of children. It is funded with 160 million Danish kroner, roughly 24 million United States dollars, across fourteen measures. The centrepiece is an age limit of 15 for certain social media, with parental consent possible from 13. As of 18 August 2026 we found no bill on the parliament's own site. Treat it as policy, not law. Also in motion. The Agency for Digital Government has 80 million Danish kroner for a digital sovereignty action plan. That is roughly 12 million United States dollars. The plan covers 2026 to 2029. Public-sector parties were due to agree next steps in spring 2026. Today this is analysis and guidance, not binding rules. The risk is that it hardens into purchasing requirements. Switches that can flip at any time. These matter most. First, the Minister of Justice can add any public administration system to the must-stay-in-Denmark list by order, with no consultation. Second, the general telephone and internet logging duty rests on an annual national security assessment. The current order runs only from 30 March 2026 to 29 March 2027 and must be re-made each year. So it can lapse or be widened with a single ministerial signature. Third, at European level the digital operational resilience rules give supervisors growing powers over cloud suppliers. And the European Union Data Act requires all cloud switching and data export charges to fall to zero by 12 January 2027.