Runs an essential service, in Denmark

Lov nr. 435 af 6. maj 2025, §§ 3-7 og 31 · Read the law's page

• If you are an essential or important telecoms provider under Sections 3 and 4, meaning you make public electronic communications networks or publicly available electronic communications services available in Denmark for commercial purposes, this Act binds you; local authorities and regions providing such networks or services are outside it.
• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use and to prevent incidents or minimise their impact, covering at least risk-analysis and information-system security policies, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability handling and disclosure, effectiveness assessment, cyber hygiene and training, cryptography, personnel security, access control and asset management, and multi-factor authentication and secured communications (Section 5(1)).
• Where you do not meet a Section 5 requirement or a rule made under Section 5(3), take all necessary, appropriate and proportionate corrective measures without undue delay (Section 5(2)).
• Have your management body approve the measures and supervise their implementation, and have its members attend courses on managing information-security risks (Section 6).
• Register with the Agency, giving your name, address and contact details and the other EU member states where you provide services, within two weeks of falling under the Act, and report changes within two weeks (Section 7(1) to (3)).

Lov nr. 435 af 6. maj 2025, §§ 8, 9 og 11 · Read the law's page

• If you are an essential or important telecoms provider under Sections 3 and 4 of the Act, this Act binds you.
• Notify the Danish Agency for Societal Security and the CSIRT of every significant incident: an early warning without undue delay and within 24 hours of becoming aware of it, stating whether it is suspected to be caused by unlawful or malicious acts or could have a cross-border effect; an incident notification within 72 hours; an interim report when the authority asks; and a final report within one month of the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Sections 8(2) and 9(1)).
• Tell the recipients of your services, without undue delay and to the relevant extent, when a significant incident is likely to affect their service negatively, and tell recipients potentially affected by a significant cyber threat of any measures they can take in response (Section 11).

NIS 2-loven, §§ 12-13, 15 · Read the law's page

• This binds the same essential and important entities as this jurisdiction's companion risk-management row: Annex 1's digital-infrastructure entry (item 8) and Annex 2's digital-provider entry (item 6), at the size thresholds Sections 4 and 5 set; the wider sector classes are reached as on that row, and the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
• Notify your competent authority and Denmark's CSIRT of every significant incident, one that has caused or can cause serious operational disruption or financial loss for you, or has affected or can affect another person through significant physical or non-physical harm.
• Send an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.
• Follow with a notification, without undue delay and in any case within 72 hours of becoming aware of the incident, updating the early warning with an initial assessment of the incident's severity and impact, including any indicators of compromise where available.
• Submit an interim report if your CSIRT asks for one, and a final report no later than one month after your notification, describing the incident in detail, its severity and impact, the likely threat or root cause, mitigating measures applied and under way, and any cross-border effects. If the incident is still ongoing at that point, submit a status report instead and the final report within one month of the incident being handled.
• If you are a trust-service provider, send the notification described in the previous step without undue delay and no later than 24 hours after becoming aware of the significant incident, rather than within 72 hours.
• Notify the recipients of your service, without undue delay, of a significant incident likely to adversely affect the delivery of your service to them, and inform any recipient potentially affected by a significant cyber threat of the measures or countermeasures they can take in response, and of the threat itself where relevant.

NIS 2-loven, §§ 6-10 · Read the law's page

• This binds an essential entity (Section 4) or an important entity (Section 5) drawn from Annex 1 or Annex 2; Annex 1's digital-infrastructure entry (item 8) names an internet-exchange-point provider, a DNS provider other than a root-server operator, a top-level-domain registry, a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider, and a provider of a public electronic-communications network or service, and Annex 2's digital-provider entry (item 6) separately names an online marketplace, an online search engine, and a social-networking-services-platform provider, so a service in any of those lines is reached. Size matters for most: an essential entity has 250 or more staff, or turnover over EUR 50 million and a balance sheet over EUR 43 million (Section 4(1)), and an important entity 50 or more staff, or turnover and balance sheet each over EUR 10 million (Section 5(1)). It does not matter for a qualified trust-service provider, a top-level-domain registry or a DNS provider, each essential whatever its size (Section 4(3)(1)), nor for any other trust-service provider, which is important whatever its size (Section 5(3)). The wider sector classes (energy, transport, water, health, waste, chemicals, food, manufacturing and the rest) are reached too, by declaring that you are an essential or important entity; the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or to provide your services, and to prevent an incident or minimise its impact on the recipients of your services and on other services.
• Cover at minimum: risk-analysis and information-system-security policies; incident handling; operational continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in acquiring, developing and maintaining your network and information systems, including vulnerability handling and disclosure; policies and procedures for assessing the effectiveness of your cybersecurity risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies and procedures on the use of cryptography and, where relevant, encryption; personnel security, access-control policies and asset management; and, where relevant, multi-factor or continuous authentication, secured voice, video and text communication, and secured internal emergency-communication systems.
• Where you fall short of any of these requirements, take without undue delay all necessary, appropriate and proportionate corrective measures.
• Have your management board (ledelsesorgan) approve these measures and oversee their implementation, and ensure its members attend relevant cybersecurity risk-management training and encourage similar training for your other staff.
• If you are a DNS provider, top-level-domain registry, domain-name-registration-service provider, or a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services, register with the relevant competent authority within 3 months of first falling within the Act's scope, stating your name, address, sector and sub-sector, contact details, and the EU member states where you provide services. Other essential and important entities register within 2 weeks of first falling within scope. Anyone already in scope when the Act commenced had to register by 1 October 2025.