Denmark. Comprehensive data protection. Act
DatabeskyttelseslovenAct on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data (Databeskyttelsesloven), Act No. 502 of 23 May 2018
Partly verified
Medium confidence.Greenland and the Faroe Islands are outside the GDPR.
§1Summary
- Synopsis
The Danish Data Protection Act supplements the GDPR and transposes parts of national derogation space for CPR numbers, employment, criminal data and research. Datatilsynet supervises, but fines are imposed by courts.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 13. No administrative fines: Datatilsynet reports cases to police and courts impose fines (permitted by GDPR Recital 151); special restrictions on use of CPR numbers; employment-context processing basis in §12.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover (court-imposed)
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text retsinformation.dk
- English text datatilsynet.dk
- Authority
- Datatilsynet
§5Where it applies
- Domestic law of
- Denmark
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Greenland and the Faroe Islands are outside the GDPR.