Denmark

Section 4 of the Danish Data Protection Act mirrors Article 3 of the General Data Protection Regulation. Subsection 1 covers processing carried out by a controller or processor established in Denmark, wherever the processing physically happens. Subsection 3 extends the Act to controllers and processors not established in the European Union where they process data about people who are in Denmark, in connection with offering goods or services to them, or monitoring their behaviour in Denmark. Two sectors do add a hard local-presence rule. Under the Gambling Act, a licence can only be granted to a company established in Denmark or another European Union or European Economic Area state; a company established elsewhere must appoint a representative approved by the Danish Gambling Authority who is resident or established in Denmark and empowered to represent the licence holder in litigation and criminal proceedings. Under the Danish network and information security law, a cloud, data centre, content delivery, managed service, online marketplace, search engine or social network provider falls under Danish jurisdiction if its main establishment in the European Union is in Denmark.

Rated sectoral. Sector by sector, verified 18 August 2026. GOVERNMENT AND PUBLIC SECTOR — closed for a named list. An executive order made in February 2022 and re-issued in March 2023 lists eleven system groups that must be operated in Denmark: the defence resource system, Digital Post, the national identity login MitID, the public login gateway NemLog-in3, the state payroll solution, the national police systems portfolio, the common public data distributor, the civil registration system, the public case and document handling system, the credit register, and the emergency call system. The power behind it is open-ended: the Minister of Justice may add any information technology system run for the public administration by executive order. ACCOUNTING, ALL INDUSTRIES — a copy must stay in Europe. A business using a digital bookkeeping system that is not on the Danish Business Authority's register must take a full backup at least weekly and keep it with a party unconnected to the business, on a server in a European Union or European Economic Area country. The equivalent rule applies to registered standard systems. Breaking it is punished by a criminal fine. STATISTICS AND RESEARCH — closed. Detailed person-level data from Denmark's national registers is only made available on Statistics Denmark's own research machines. Copying, exporting, emailing, printing or photographing data from those machines is forbidden outright; only aggregated results may be released, and only after review. EDUCATION AND LOCAL GOVERNMENT — conditional, and currently contested. On 2 February 2026 the Danish Data Protection Agency issued serious criticism to 51 municipalities over the use of Google's classroom products on pupil devices, warning that engaging a processor that uses sub-processors outside the European Economic Area without equivalent protection would likely breach the European rules, and that products with unclear processing arrangements cannot lawfully be used. TELECOMS — no location rule, but a heavy retention duty. From 30 March 2026 to 29 March 2027 all providers must record traffic data about fixed, mobile and internet telephony, text messages, their own email services and internet access, and keep it for one year, so retained until 29 March 2028 at the latest. No requirement was found that the logs be stored in Denmark. GAMBLING — no location rule, contrary to common belief. A licence holder must build a data warehouse called SAFE holding standard records of every game played, and the Danish Gambling Authority must be able to reach it online. Nothing in the current order requires that warehouse to be in Denmark. All betting data must be kept five years and player identity data five years after the customer relationship ends. BANKING, PAYMENTS, INSURANCE AND SECURITIES — conditional, no localisation. The European Union digital operational resilience rules apply since January 2025 and the Danish regulator runs notification of outsourcing contracts and a register of technology suppliers through them. No Danish rule requiring financial data to stay in Denmark was found, checked 18 August 2026. HEALTH — conditional, no localisation found. Patient records must be kept for ten years by doctors and dentists and five years by other health professionals, but no rule requiring them to be held in Denmark was located, checked 18 August 2026. MAPPING AND GEOSPATIAL, DEFENCE — no civil localisation rule found, checked 18 August 2026. Classified defence material is handled under separate security rules that were not examined.

The model is an allowlist with a populated list. Countries approved by the European Commission as of 18 August 2026: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial organisations, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, and the United States but only for organisations that have self-certified under the European Union-United States Data Privacy Framework, plus the European Patent Organisation since 15 July 2025. No approval has been withdrawn or suspended. Where no approval covers the destination, the 2021 standard contractual clauses remain the operative set and are unamended; the promised new clauses for importers already directly caught by the European rules are still not adopted. Binding corporate rules remain available. The narrow exceptions in Article 49 are not usable for routine or bulk transfers, and a transfer risk assessment is still expected. The European Union-United States framework is in force and legally valid today, but is under pressure: an appeal against the General Court's September 2025 dismissal in the Latombe case is pending before the Court of Justice, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent United States developments affect the decision's validity. Never build on it as your only mechanism. Separately, the Danish Act makes breach of the European transfer rules in Articles 44 to 49 a criminal offence punishable by fine or up to six months in prison.

Enforcement rated active, not aggressive. Evidence from the regulator's own 2025 annual report, published March 2026: 20,536 new cases opened, 9,849 personal data breach notifications received (5,167 from public authorities, 4,630 from private organisations), 3,653 supervision and enforcement cases, 2,867 advice and guidance cases, 525 cases opened on the agency's own initiative, and exactly 2 police reports with a recommended fine filed during the year. The agency's own fines page states plainly that in most European countries the supervisory authority can impose administrative fines itself, whereas in Denmark that must currently go through the courts, with the agency referring the case to the police with a recommended amount. Since a 2023 amendment the agency may also issue a fine notice offering to settle without a court case, but only where the offender admits guilt and pays; the 2025 annual report does not record any use of that route. The practical consequence is that the strongest tools are the non-financial ones: orders, bans on processing, and public criticism. The February 2026 Chromebook decision, covering 51 municipalities at once, is the clearest recent example. Other regulators are separately active: the Danish Business Authority for bookkeeping, the Danish Financial Supervisory Authority for the financial sector's technology resilience rules, the Danish Gambling Authority for licence holders, the Danish Agency for Societal Security for the network and information security regime, and the Danish Defence Intelligence Service acting as the national computer security incident response team.

Floors, all verified 18 August 2026. Accounting material must be kept securely for five years from the end of the financial year it relates to, under the Bookkeeping Act, with a weekly full backup that must sit with an unrelated third party on a server in the European Union or European Economic Area. Patient records: at least ten years from the last entry for doctors, dentists, midwives and certain specialists, at least five years for other authorised health professionals, per the Danish Patient Safety Authority. Gambling licence holders must keep identity and control information about a registered player for at least five years after the customer relationship ends, and all data about the offering of betting in the gambling system for at least five years. Telecommunications providers must keep the traffic data recorded under the March 2026 logging order for one year from the moment of recording, so data recorded on the last covered day is held until 29 March 2028. Criminal liability under the data protection Act itself is time-barred after five years. Ceilings: the European storage limitation principle applies unchanged, and the Danish Act extends the rules to information about deceased people for ten years after death, which is a Danish addition with no European equivalent. Denmark resolves a floor-versus-ceiling conflict the ordinary European way: a legal obligation to retain is an express exception to the right to erasure, so the specific statutory period governs until it runs out.

Clock one, personal data: 72 hours from awareness to the Danish Data Protection Agency under Article 33 of the European rules, plus notification to affected individuals without undue delay where the risk to their rights is high. The Agency received 9,849 such notifications in 2025, so this is a heavily used channel and the reporting form is well established. Clock two, cyber security: under the Danish network and information security law in force since 1 July 2025, essential and important entities must send an early warning to the relevant sector authority and to the national computer security incident response team without undue delay and within 24 hours of becoming aware of a significant incident, saying whether it is suspected to be malicious or to have cross-border effects; a fuller incident notification with an initial severity assessment and indicators of compromise follows within 72 hours; an interim report on request; and a final report within one month of the incident notification. The incident response team must respond within 24 hours of the early warning. Affected service recipients must also be told without undue delay. Failure to notify is punishable by a criminal fine, and companies can be held criminally liable. Clock three, finance: the European digital operational resilience rules have applied to financial entities since 17 January 2025 and run their own major incident reporting timetable through the Danish Financial Supervisory Authority. Clock four, telecoms: the separate Danish law on security and preparedness in the telecoms sector sits outside the cyber security law and was not examined in detail here. The overlap is the usual failure point: the 24-hour cyber warning fires long before the 72-hour privacy report is ready.

Trap one, the age. Denmark set the age at which a child can consent to online services at 15, in the middle of the range the European rules allow. Most global age gates are built for 13 or 16, so both settings are wrong for Denmark. Below 15, consent must be given or approved by the holder of parental responsibility. Trap two, criminal not administrative. The Danish Act punishes breaches of the core principles, the individual rights provisions, the controller and processor duties, and the third-country transfer rules with a fine or imprisonment for up to six months. Obstructing the regulator, or failing to comply with its orders, is a separate offence. A court can also disqualify someone from operating a business that stores personal data. This changes how you handle an investigation: it is a criminal matter, so the file is not open to inspection and the ordinary right of access to case documents does not apply. Trap three, the personal identity number. The Danish civil registration number has a dedicated regime. Public authorities may use it for unique identification or as a file number. Private organisations may use it only where a law requires it, where the person has consented, for scientific or statistical purposes, where passing it on is a natural part of normal operations of that kind of business and is decisive for unique identification, or where an authority requires it. It must never be published without consent. Danish systems are full of this number and foreign-built systems routinely treat it as an ordinary customer reference. Trap four, the accounting backup. A business that uses a bookkeeping system not on the Danish register must take a full weekly backup and keep it with a party unrelated to the business, presumed to meet recognised information security standards, on a server in a European Union or European Economic Area country. Breach is punished by fine. This is a genuine European residency requirement hiding inside company law rather than privacy law, and it bites hardest on foreign groups running a single global accounting platform. Trap five, the dormant switch. The Danish Act lets the Minister of Justice, after consulting the relevant minister, decree that personal data processed in specified information technology systems run for the public administration may only be stored in Denmark. There is no consultation requirement, no threshold and no list of qualifying systems in the statute. The power has already been used to capture eleven system groups, and the annex was expanded once in 2023. Any organisation running a system for a Danish public authority should treat this as a live commercial risk.

Already in force. The Danish network and information security law started on 1 July 2025; registration through the business portal opened the same day and closed on 1 October 2025, with a two-week window for entities that become covered later and a three-month deadline to report changes. Digital Sundhed Danmark, a new self-governing institution for health digitisation, was passed on 29 December 2025 and started on 1 January 2026. The digital bookkeeping duty reached its final phase on 1 January 2026, extending to non-financial businesses with net revenue above 300,000 Danish kroner, roughly 45,000 United States dollars, in two consecutive years. Proposed, no legal effect. On 7 November 2025 the government and a broad group of parties agreed a package on digital protection of children, funded with 160 million Danish kroner, roughly 24 million United States dollars, across fourteen measures. The centrepiece is an age limit of 15 for certain social media, with parental consent possible from 13. As of 18 August 2026 no bill implementing it was located on the parliament's own site. Treat it as policy, not law. Also in motion. The Agency for Digital Government has 80 million Danish kroner, roughly 12 million United States dollars, for a digital sovereignty action plan covering 2026 to 2029, with public-sector parties due to agree next steps in spring 2026. Today this is analysis and guidance, not binding rules; the risk is that it hardens into procurement requirements. Dormant switches, the ones that matter most. First, the Minister of Justice can add any public administration system to the must-stay-in-Denmark list by executive order, with no consultation. Second, the general telephone and internet logging duty rests on an annual national security assessment; the current order runs only from 30 March 2026 to 29 March 2027 and must be re-made each year, so it can lapse or be widened with a single ministerial signature. Third, at European level the digital operational resilience rules give supervisors escalating powers over cloud suppliers, and the European Union Data Act requires all cloud switching and data egress charges to fall to zero by 12 January 2027.