Cybersecurity law in Denmark: NIS2 compliance (2026)

Yes. As an EU member, Denmark has transposed the NIS2 Directive (EU) 2022/2555 into national law, covering essential and important entities in critical sectors.

Medium and large organisations in sectors such as energy, transport, banking, health, water, digital infrastructure and public administration.

An early warning within 24 hours of becoming aware and a fuller incident notification within 72 hours to the national CSIRT.

Up to €10 million or 2% of global annual turnover for essential entities, with lower ceilings for important entities.

The Act on Measures for a High Level of Cybersecurity (Lov nr. 434 af 6. maj 2025) entered into force on 1 July 2025, imposing risk-management, governance and reporting duties on 'essential' and 'important' entities across sectors listed in Annexes I and II of NIS2.

Denmark opted for a decentralised model: telecoms are covered by Act No. 435 of 6 May 2025 (Security and Preparedness in the Telco Sector), energy and finance by dedicated sector laws, and each ministry's regulator (e.g., Finanstilsynet, Energistyrelsen) acts as competent authority rather than a single national cyber regulator.

Entities must submit an early warning within 24 hours of becoming aware of a significant incident, a fuller incident notification within 72 hours (deadlines run concurrently), and a final report within one month (or one month after the incident is handled). Reports go via the competent sector authority; CFCS receives them in its CSIRT role.

Entities in scope of the Danish NIS2 Act were required to register by 1 October 2025; missing the deadline is itself a compliance breach. CFCS/SAMSIK have signalled audits of essential entities from early 2026, and Danish penalties are notably criminal rather than administrative in structure.

The EU Digital Operational Resilience Act (Reg. (EU) 2022/2554) has applied directly since 17 January 2025 to banks, insurers, payment/e-money institutions, investment firms and CASPs. Finanstilsynet (Danish FSA) is the sole competent authority, formally designated via an amendment to the Financial Business Act adopted 2 May 2024, and began preparing its first DORA inspections in 2025.

Denmark's Act on the Resilience of Critical Entities (transposing EU Directive 2022/2557) also entered into force on 1 July 2025, covering 11 sectors including energy, transport, banking, health, water, digital infrastructure, public administration, space and food. Sector authorities must designate critical entities by July 2026; those entities then have 9 months for a risk assessment and 10 months to implement a resilience plan.