Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Denmark supplements GDPR through the Databeskyttelsesloven, enforced by Datatilsynet (which cannot itself levy fines, Danish courts do), and has transposed NIS2 via a multi-statute package led by the new Danish Agency for Societal Security (SAMSIK).
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Directly applicable EU regulation; sets the 72-hour breach notification standard and the €20m/4% fine cap uniformly across the EEA.
SourceDenmark's supplementary GDPR legislation, in force since 25 May 2018 (consolidated March 2024), largely re-enacting the prior Personal Data Act, including that GDPR fines are imposed by courts rather than administratively by Datatilsynet.
SourceDenmark's principal NIS2 transposition, in force since 1 July 2025, paired with separate sector-specific statutes for energy, telecommunications, and financial services rather than a single omnibus law.
Source72 hours
Controllers must notify Datatilsynet without undue delay and, where feasible, within 72 hours of becoming aware of a breach, per GDPR Article 33. Denmark applies the EU-standard deadline without a shorter national variant.
Notify: Datatilsynet (Danish Data Protection Agency)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
Unlike most member states, Denmark does not let its DPA issue administrative fines directly, Datatilsynet refers cases to police/prosecutors and Danish courts impose the actual fine, still bounded by the GDPR cap.
SourceApplicable , as of 2026-09-08
Transposed after the EU deadline via a multi-statute package: the general Act on Measures for a High Level of Cybersecurity (Act No. 434 of 6 May 2025, in force 1 July 2025) plus sector-specific laws for energy, telecoms, and financial services. Supervision is deliberately decentralized by sector, with the newly formed SAMSIK (Danish Agency for Societal Security) playing the central coordinating role.
SourceDatatilsynet (Danish Data Protection Agency)(Datatilsynet)
Visit authority siteDatatilsynet, the Danish Data Protection Agency, within 72 hours of becoming aware of the breach where feasible, under GDPR Article 33.
No. Denmark is unusual in the EU in that Datatilsynet cannot impose administrative fines itself, it refers serious cases to the police, and Danish courts determine and impose any fine, still bounded by the GDPR's €20m/4% cap.
There is no single Danish cyber regulator. SAMSIK (the Danish Agency for Societal Security) plays the central coordinating role, but supervision is split across sector-specific competent authorities for energy, telecoms, finance, and other covered sectors.
Talk to us about scoping an engagement around your specific regulatory context.
