Handles health records, in Denmark

Bekendtgørelse nr. 1067 af 29. juni 2020 om videregivelse af oplysninger om enkeltpersoners helbredsforhold til forskning, §§ 3 and 10 · Read the law's page

• Disclose health record data for a research project, statistics or planning in pseudonymized form, so that the receiving data controller cannot directly trace it to a person, unless identification is strictly necessary for the study.
• When the study ends, delete, anonymize, destroy or return the health record data so that no natural person can be identified from it, alone or combined with other information, or move it to an archive under the archive laws.

NIS 2-loven, §§ 12-13, 15 · Read the law's page

• This binds the same essential and important entities as this jurisdiction's companion risk-management row: Annex 1's digital-infrastructure entry (item 8) and Annex 2's digital-provider entry (item 6), at the size thresholds Sections 4 and 5 set; the wider sector classes are reached as on that row, and the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
• Notify your competent authority and Denmark's CSIRT of every significant incident, one that has caused or can cause serious operational disruption or financial loss for you, or has affected or can affect another person through significant physical or non-physical harm.
• Send an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.
• Follow with a notification, without undue delay and in any case within 72 hours of becoming aware of the incident, updating the early warning with an initial assessment of the incident's severity and impact, including any indicators of compromise where available.
• Submit an interim report if your CSIRT asks for one, and a final report no later than one month after your notification, describing the incident in detail, its severity and impact, the likely threat or root cause, mitigating measures applied and under way, and any cross-border effects. If the incident is still ongoing at that point, submit a status report instead and the final report within one month of the incident being handled.
• If you are a trust-service provider, send the notification described in the previous step without undue delay and no later than 24 hours after becoming aware of the significant incident, rather than within 72 hours.
• Notify the recipients of your service, without undue delay, of a significant incident likely to adversely affect the delivery of your service to them, and inform any recipient potentially affected by a significant cyber threat of the measures or countermeasures they can take in response, and of the threat itself where relevant.

NIS 2-loven, §§ 6-10 · Read the law's page

• This binds an essential entity (Section 4) or an important entity (Section 5) drawn from Annex 1 or Annex 2; Annex 1's digital-infrastructure entry (item 8) names an internet-exchange-point provider, a DNS provider other than a root-server operator, a top-level-domain registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider, and a provider of a public electronic-communications network or service, and Annex 2's digital-provider entry (item 6) separately names an online marketplace, an online search engine, and a social-networking-services-platform provider, so a service in any of those lines is reached. Size matters for most: an essential entity has 250 or more staff, or turnover over EUR 50 million and a balance sheet over EUR 43 million (Section 4(1)), and an important entity 50 or more staff, or turnover and balance sheet each over EUR 10 million (Section 5(1)). It does not matter for a qualified trust-service provider, a top-level-domain registry or a DNS provider, each essential whatever its size (Section 4(3)(1)), nor for any other trust-service provider, which is important whatever its size (Section 5(3)). The wider sector classes (energy, transport, water, health, waste, chemicals, food, manufacturing and the rest) are reached too, by declaring that you are an essential or important entity; the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or to provide your services, and to prevent an incident or minimise its impact on the recipients of your services and on other services.
• Cover at minimum: risk-analysis and information-system-security policies; incident handling; operational continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in acquiring, developing and maintaining your network and information systems, including vulnerability handling and disclosure; policies and procedures for assessing the effectiveness of your cybersecurity risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies and procedures on the use of cryptography and, where relevant, encryption; personnel security, access-control policies and asset management; and, where relevant, multi-factor or continuous authentication, secured voice, video and text communication, and secured internal emergency-communication systems.
• Where you fall short of any of these requirements, take without undue delay all necessary, appropriate and proportionate corrective measures.
• Have your management board (ledelsesorgan) approve these measures and oversee their implementation, and ensure its members attend relevant cybersecurity risk-management training and encourage similar training for your other staff.
• If you are a DNS provider, top-level-domain registry, domain-name-registration-service provider, or a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services, register with the relevant competent authority within 3 months of first falling within the Act's scope, stating your name, address, sector and sub-sector, contact details, and the EU member states where you provide services. Other essential and important entities register within 2 weeks of first falling within scope. Anyone already in scope when the Act commenced had to register by 1 October 2025.