DenmarkNIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds the same essential and important entities as this jurisdiction's companion risk-management row: Annex 1's digital-infrastructure entry (item 8) and Annex 2's digital-provider entry (item 6), at the size thresholds Sections 4 and 5 set; the wider sector classes are reached as on that row, and the entities Section 1(2) routes to Denmark's separate energy-sector, telecom-sector or financial-entity regimes are outside this Act.
- Notify your competent authority and Denmark's computer security incident response team (CSIRT) of every significant incident, one that has caused or can cause serious operational disruption or financial loss for you, or has affected or can affect another person through significant physical or non-physical harm.NIST CSF 2.0RS.CO-02
- Send an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.NIST CSF 2.0RS.CO-02
- Follow with a notification, without undue delay and in any case within 72 hours of becoming aware of the incident, updating the early warning with an initial assessment of the incident's severity and impact, including any indicators of compromise where available.NIST CSF 2.0RS.CO-02
- Submit an interim report if your CSIRT asks for one, and a final report no later than one month after your notification, describing the incident in detail, its severity and impact, the likely threat or root cause, mitigating measures applied and under way, and any cross-border effects. If the incident is still ongoing at that point, submit a status report instead and the final report within one month of the incident being handled.NIST CSF 2.0RS.CO-03
- If you are a trust-service provider, send the notification described in the previous step without undue delay and no later than 24 hours after becoming aware of the significant incident, rather than within 72 hours.NIST CSF 2.0RS.CO-02
- Notify the recipients of your service, without undue delay, of a significant incident likely to adversely affect the delivery of your service to them, and inform any recipient potentially affected by a significant cyber threat of the measures or countermeasures they can take in response, and of the threat itself where relevant.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 32(1) punishes a violation of, among other provisions, Section 12(1) or Section 13(1) or (2) or Section 15 with a criminal fine (bøde), not an administrative fine the competent authority itself may impose; the offence is prosecuted through Denmark's ordinary criminal process (police and public prosecutor, with the courts where contested) rather than a supervisory penalty decision. Section 32(2) attaches corporate (legal-person) criminal liability under Chapter 5 of the Criminal Code (straffeloven). The Act states no fixed monetary maximum and no turnover-percentage cap of its own; the amount of a Section 32 fine is set case by case under Denmark's general criminal-sentencing principles rather than by a statutory ceiling, unlike the EUR 10 million/2 percent and EUR 7 million/1.4 percent administrative-fine tiers most other Member States' NIS2 transpositions enact.
Who enforces it
Enforcement body
The authority the Minister for Societal Security and Preparedness designates by executive order as competent authority for the entity's sector (Section 20(1)), with the CSIRT receiving the incident notifications directly (Section 12(1)); retsinformation.dk listed no order or circular issued under this Act as of , so the named authority for the digital-infrastructure and digital-provider lines this row flags is not yet settled in the primary record.
Settledness
- As of
- Open questions
- Has the responsible minister issued the further rules Section 12(3) reserves the power to set on when an incident counts as significant, beyond the two general triggers Section 12(2) already states, since retsinformation.dk's own register listed no order under this Act as of ?
What this law does
Section 12 requires an essential entity or an important entity to notify the relevant competent authority and Denmark's computer security incident response team (CSIRT) of every significant incident, defined as one that has caused or can cause serious operational disruption or financial loss for the entity, or that has affected or can affect another person through significant physical or non-physical harm.
Section 13 sets the notification clock: an early warning without undue delay and no later than 24 hours after becoming aware of the incident (Section 13(1)(1)); a notification without undue delay and in any case within 72 hours, updating the early warning with an initial severity and impact assessment (Section 13(1)(2)); an interim report on the CSIRT's request (Section 13(1)(3)); and a final report no later than one month after the notification, or, if the incident is still ongoing, a status report at that point and a final report within one month of the incident being handled (Section 13(1)(4) and (5)).
A trust-service provider must send the Section 13(1)(2) notification of a significant incident without undue delay and within 24 hours (Section 13(2)); the CSIRT must acknowledge an early warning within 24 hours and, on request, can offer guidance and operational advice (Section 13(3)).
Section 15 separately requires an essential or important entity to notify its service recipients, without undue delay, of a significant incident likely to adversely affect the delivery of their service, and to inform any recipient potentially affected by a significant cyber threat of the protective or responsive measures available to them.
This Act, Lov nr 434 af 6. maj 2025 (NIS 2-loven), transposes NIS2 Directive Article 23 and, by Section 33(4) to (7), repeals Denmark's four 2018 NIS1-era security laws (Lov nr 436, 437, 440 and 441 af 8. maj 2018).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .