DenmarkAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Significant Incident Notification
Lov nr. 435 af 6. maj 2025, §§ 8, 9 og 11
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are an essential or important telecoms provider under Sections 3 and 4 of the Act, this Act binds you.
- Notify the Danish Agency for Societal Security and the CSIRT of every significant incident: an early warning without undue delay and within 24 hours of becoming aware of it, stating whether it is suspected to be caused by unlawful or malicious acts or could have a cross-border effect; an incident notification within 72 hours; an interim report when the authority asks; and a final report within one month of the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Sections 8(2) and 9(1)).
- Tell the recipients of your services, without undue delay and to the relevant extent, when a significant incident is likely to affect their service negatively, and tell recipients potentially affected by a significant cyber threat of any measures they can take in response (Section 11).
These lines are LexLint's reading of the law's text, as of . Also read by: Styrelsen for Samfundssikkerhed (Danish Agency for Societal Security, SAMSIK) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 31 punishes a violation of Section 8(2), Section 9(1) or Section 11(1) or (2), among others, with a fine (bøde); a legal person can be held liable under Chapter 5 of the Criminal Code.
Who enforces it
Enforcement body
Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed), which can apply enforcement measures under Sections 20 to 23.
Settledness
- As of
- Guidance link
- https://samsik.dk/tele/underretning/
- Guidance body
- Styrelsen for Samfundssikkerhed (Danish Agency for Societal Security, SAMSIK)
- Open questions
- Does the notification of incidents with a 'væsentlig indvirkning på driften' (significant effect on operations) under Sections 8 to 11 of Order No. 1069 of replace, or run alongside, the 24-hour early warning and 72-hour notification that Section 9(1) of the Act requires for a significant incident?
What this law does
Section 8(2) of Act No. 435 of on security and preparedness in the telecoms sector requires telecoms providers to notify the Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed) and the CSIRT of every significant incident under the procedure in Section 9.
Under Section 8(3) an incident is significant if it has caused or can cause severe operational disruption of networks or services or financial loss to the provider, or has affected or can affect other persons by causing considerable material or non-material damage.
Under Section 9(1) the provider sends an early warning without undue delay and within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours, an interim report on the authority's request, and a final report no later than one month after the incident notification, with a status report and a final report within one month of the incident being handled if it is still ongoing.
Section 11 requires the provider to tell the recipients of its services without undue delay when a significant incident is likely to affect their service negatively, and to tell recipients potentially affected by a significant cyber threat of the measures they can take. The Act entered into force on .
When LexLint raises it
When your app profile says your app provides telecom services or runs an essential service.