Data protection & GDPR compliance in Denmark (2026)

Yes. As an EU/EEA member, Denmark applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Danish Data Protection Agency (Datatilsynet).

The Danish Data Protection Agency (Datatilsynet).

Up to €20 million or 4% of global annual turnover, whichever is higher.

A DPO is required where you carry out large-scale monitoring or process special-category data at scale.

Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.

The GDPR applies directly as EU law and is supplemented by the Danish Data Protection Act (Act No. 502 of 23 May 2018), both effective from 25 May 2018, giving Denmark a full omnibus personal-data framework covering public and private sectors.

Datatilsynet (Danish Data Protection Agency), based in Copenhagen, is the independent supervisory authority. It is led by the Data Council (Datarådet), a chair (a qualified lawyer) plus six members appointed by the Minister of Justice, supported by a secretariat.

Unlike most EU authorities, Datatilsynet cannot impose administrative fines directly; it reports cases recommending prosecution to the police, who investigate and may refer to the courts, which set any fine. GDPR's maximum ceilings (up to EUR 20m or 4% of global turnover) apply, but court-imposed fines have been comparatively low (largest to date DKK 1m, Arp-Hansen Hotels, 2023).

The Danish Act uses GDPR member-state options, including special rules for journalism, crime prevention, parliamentary work and legal proceedings; processing of personal data for personnel administration based on legislation or collective agreements; and disclosure of general personal data between businesses for marketing without consent, subject to checking an opt-out register.

Denmark set the age of digital consent at 13 (§ 6 of the Act). The Act also gives elevated protection to the CPR (national identification) number, restricting when public and private entities may process it.

For 2026 Datatilsynet has prioritised cookie-consent practices (targeting dark patterns, cookie walls, pre-ticked boxes and lack of genuine refusal, coordinating with Digitaliseringsstyrelsen), alongside monitoring via new technologies and personal-data security, including AI in devices and home patient-care monitoring.