Processes personal data, in Denmark

Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of 8 March 2024 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Denmark, including data collected by crawling.
• Conduct a Data Protection Impact Assessment for high risk processing under GDPR Article 35.

Regulation (EU) 2016/679, Arts. 12-21; Databeskyttelsesloven · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, for a person in Denmark.

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Denmark outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Bekendtgørelse nr. 1067 af 29. juni 2020 om videregivelse af oplysninger om enkeltpersoners helbredsforhold til forskning, §§ 3 and 10 · Read the law's page

• Disclose health record data for a research project, statistics or planning in pseudonymized form, so that the receiving data controller cannot directly trace it to a person, unless identification is strictly necessary for the study.
• When the study ends, delete, anonymize, destroy or return the health record data so that no natural person can be identified from it, alone or combined with other information, or move it to an archive under the archive laws.

Forslag til Lov om produktansvar, L 32 (2026/1) · Read the law's page

• If you develop or make software, or have it developed or made, you answer as its manufacturer, unless it is free open-source software that you develop or supply outside commercial activity (Secs. 1(2), 3 point 1 and 3 point 10).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (Secs. 3 point 5 and 12(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (Sec. 6(2) point 6), and failing a mandatory requirement that protects against the damage suffered presumes it defective (Sec. 11(2) point 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (Sec. 6(2) point 3).
• Keep records you could produce if a court orders disclosure on a claimant's supported request, because failing to comply with the order presumes the product defective (Secs. 10(1), 11(2) point 1).
• If you are a manufacturer established outside the European Union, your importer and your authorized representative answer as the manufacturer would, and where there is neither, the provider of distribution services answers (Sec. 7(1) point 3).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into use, you answer as its manufacturer (Sec. 7(2)).
• If you are a distributor, or an online platform that lets consumers conclude distance contracts with traders, identify the operator established in the European Union or your own supplier within a month of the injured person's request, or you answer for the product (Sec. 7(3) and (4)).
• Do not rely on a contract term to limit or exclude your liability to an injured person, because the Act cannot be departed from to the injured person's detriment (Sec. 2).
• Be ready to prove a Section 12 defense: that you did not put the product into circulation, that the defect probably did not exist then, that it results from compliance with legal requirements, or that the objective scientific and technical knowledge then did not allow the defect to be discovered (Sec. 12(1)).
• If you integrate software made by a micro or small enterprise as a component, a recourse waiver agreed with that enterprise removes your recourse against it (Sec. 13(4)).
• Claims are time-barred 3 years after the injured person knew or should have known of the damage, the defect and the liable operator, and the right expires 10 years after the product was put into circulation or into use, or 25 years for a latent personal injury (Secs. 15 and 16).