DenmarkGDPR Articles 33-34, Breach Notification in Denmark
Regulation (EU) 2016/679, Arts. 33-34
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
These lines are LexLint's reading of the law's text. Also read by: Datatilsynet (the Danish Data Protection Agency) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datatilsynet.dk/Media/637886298435856391/H%C3%A5ndtering%20af%20brud%20p%C3%A5%20persondatasikkerheden.pdf
- Guidance body
- Datatilsynet (the Danish Data Protection Agency)
- Open questions
- Must a controller notify the persons concerned under Article 34 of the GDPR while it suspects, without a decision from the police, that telling them would hamper a criminal investigation, given that section 22(6) of the Databeskyttelsesloven lets only the police decide that Article 34 does not apply?
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller documents every personal data breach, whether or not it is notified; the text names the facts, the effects and the remedial action but no fixed log fields.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5)
- Trigger
- security_incident
What this law does
A controller must notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Section 22(1) and (2) of the Databeskyttelsesloven disapply Article 34 where the person's interest in the information must yield to decisive private or public interests.
Under section 22(6), Article 34 does not apply while telling the persons would be assumed to hamper the investigation of criminal offenses, a decision only the police can take.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .