GDPR Articles 82-83 and Datatilsynet Enforcement in Denmark

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Databeskyttelsesloven Section 41 punishes, with a fine or imprisonment of up to 6 months, violations of the GDPR's core obligations (controller and processor duties under Articles 8, 11, 25 to 39, 42 or 43; the basic processing principles and consent conditions under Articles 5 to 7 and 9; data-subject rights under Articles 12 to 22; and international transfer rules under Articles 44 to 49) and of a parallel list of Danish Act provisions and supervisory-authority orders (Section 41(2)). This is Denmark's mechanism for enforcing conduct that GDPR Article 83 elsewhere treats as an administrative fine: the same conduct can draw both a fine and up to 6 months' imprisonment, imposed through the ordinary criminal courts or a fine notice (boedeforelaeg) from Datatilsynet that the person accepts under Section 42, rather than through a Datatilsynet administrative decision. Corporate criminal liability runs through Criminal Code chapter 5 (Section 41(6)); notwithstanding Criminal Code Section 27(2), which otherwise exempts public authorities from corporate criminal liability, a Danish public authority or institution covered by the Public Administration Act Section 1(1) or (2) can be punished under Section 41 for a violation committed in an activity that does not correspond to, or is not comparable with, activity carried out by a private party, meaning ordinary public-sector administrative activity is effectively shielded while business-like public activity is not.

Penalty structure

GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets the narrower EUR 10,000,000 or 2 percent tier for the Article 25 to 39 obligations. Denmark implements this fine through its own criminal law rather than a separate administrative-fine track: Databeskyttelsesloven Section 41(3) requires GDPR Article 83(2)'s proportionality factors to be followed when imposing punishment under Section 41, and Section 41 itself sets the punishment as a fine or imprisonment of up to 6 months (see the criminal exposure note), and Datatilsynet can offer a fine notice (bødeforelæg) under Section 42 that ends the prosecution once accepted, rather than issuing an administrative fine decision itself. The Danish statute does not restate a separate Danish-law fine ceiling; the operative monetary ceiling remains the GDPR's own EUR 20,000,000 / 4 percent figure via the Article 83(2) cross-reference.

Rule

Higher of

As of

2 September 2026

Currency

EUR

Fixed cap

20,000,000

Turnover percentage cap

4

Enforcement body

Datatilsynet (the Danish Data Protection Agency), Denmark's supervisory authority under the GDPR. It does not itself issue administrative fine decisions: GDPR Recital 151 records that in Denmark the fine is imposed by the competent national courts as a criminal penalty. Where Datatilsynet expects a violation to lead to no more than a fine, it may offer the person a fine notice (bødeforelæg) under Databeskyttelsesloven Section 42, which ends the prosecution if the person pleads guilty and pays the stated fine; otherwise Datatilsynet reports the matter to the police with a recommendation of a fine, and the ordinary criminal courts decide it.

Enforcement record

Datatilsynet annual report for 2025: "Datatilsynet har i 2025 indgivet 2 politianmeldelser med indstilling om bøde for overtrædelse af databeskyttelsesreglerne" (in 2025 Datatilsynet filed 2 police reports recommending a fine for violating the data protection rules). The count is of police reports with a fine recommendation, since the courts and not Datatilsynet impose the fine; it does not count private claims under Article 82, which run through the ordinary courts, and the report states no fine total.

As of

30 October 2026

Source link

https://www.datatilsynet.dk/Media/639105380237831502/Datatilsynets%20%C3%A5rsberetning%202025.pdf

Actions per year

2

Settledness

As of

12 October 2026

Case citation

Højesteret, judgment of 24 August 2026, case BS-44501/2025-HJR (A and B v Hillerød Kommune)

Open questions

Which part of the 30,000 kr. that Højesteret awarded on 24 August 2026 rests on Article 82(1) and section 40 of the Databeskyttelsesloven, and which part on the principle in section 26 of the Erstatningsansvarsloven read with Article 13 of the Convention, for a controller that is not a public authority?

How the hook was established

express

What makes it apply

Operator establishment, Market targeting, User location, Place of effect

Obligation class

Governance

Applicability criteria

As of

30 October 2026

Combinator

Any of

Criteria

• the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not
• the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union
• the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the monitoring of their behaviour as far as their behaviour takes place within the Union

Logging duty

Article 82 gives a right to compensation and Article 83 sets the conditions for administrative fines. Neither states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation.

Kind

None

As of

12 October 2026