Denmark

Denmark's supplementary AI Act law designates Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen as the national competent authorities under Article 70(1) of the EU AI Act.

Digitaliseringsstyrelsen is the notifying authority and central contact point and is the market-surveillance authority for Article 5(1)(a) to (c), (e) and (f) of the prohibited-practices list, which includes the untargeted scraping of facial images from the internet or CCTV footage to build a facial-recognition database.

Datatilsynet is the market-surveillance authority for Article 5(1)(d) and (g), covering individual predictive-policing profiling and biometric categorization that infers a protected characteristic. Domstolsstyrelsen covers the courts' own use of AI systems outside their judicial capacity. The authorities may demand information, enter business premises without a court order, run technical inspections of an AI system, publish their decisions, and issue compliance orders or temporary bans.

An intentional or grossly negligent violation of Article 5's prohibited practices, a failure to give accurate information on request, obstruction of an inspection, or non-compliance with an order is punishable by a fine set by the courts, with no statutory ceiling stated in this law; the limitation period is 5 years.

A controller must notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Danish derogation from this timeline is confirmed.

The Danish Data Protection Act gives the General Data Protection Regulation (GDPR) domestic effect in Denmark and supplements it with Denmark-specific derogations for matters GDPR leaves to member states, including the digital age of consent, processing of CPR (civil registration) numbers, CCTV, and journalism. Datatilsynet, the Danish Data Protection Agency, enforces it, with the distinctive feature that Denmark cannot itself impose an administrative fine (see the enforcement instrument below).

The Act's specific derogation sections were not independently read against the Act's own text; the sections named in secondary commentary are not restated here as confirmed provisions.

Transferring personal data of a person in Denmark outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Danish derogation broadening or narrowing General Data Protection Regulation (GDPR) Chapter V is confirmed.

General Data Protection Regulation (GDPR) Articles 15 to 21 apply directly in Denmark: access, rectification, erasure, restriction, portability, and objection, generally exercisable against the controller within one month. Article 22 gives a qualified right against a decision based solely on automated processing that produces legal or similarly significant effects, applied in Denmark through the Databeskyttelsesloven. No Danish derogation narrowing these rights was confirmed against the Act's own text.

Datatilsynet holds the General Data Protection Regulation (GDPR) Article 58 corrective toolkit directly, warnings, reprimands, compliance orders and processing bans, but GDPR Recital 151 records that Denmark's legal system does not allow the supervisory authority itself to impose an administrative fine. In practice, Datatilsynet reports a violation it considers fine-worthy to the Danish police with a recommended amount, and the fine is set and imposed by the Danish courts as a criminal penalty rather than by Datatilsynet directly.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for the purpose of uniquely identifying a natural person as a special category of personal data, prohibited absent an Article 9(2) ground such as explicit consent.

No Danish statutory enumeration or illustrative list of biometric identifier types is confirmed, and none is asserted; Datatilsynet has engaged case by case with facial recognition deployments through its authorization and guidance practice, but no voiceprint specific guidance or enforcement decision was located.

Section 263, subsection 1, punishes with a fine or imprisonment of up to 1 year and 6 months whoever unlawfully obtains access to another's data system or to data intended for use in a data system. The provision does not state that the access must defeat a security measure, so its text does not on its face exclude reading a public, unauthenticated page.

Subsection 3 raises the maximum to imprisonment of up to 6 years where the access is made with intent to learn a business's trade secrets or under other especially aggravating circumstances, including systematic or organized offending. A related section, 263a, separately punishes commercial trafficking in access credentials to a data system.

A person with lawful access to a work may extract from it and make copies of it for text and data mining, defined as any automated analytical technique for analysing text and data in digital form to generate information such as patterns, trends and correlations, provided the rights holder has not expressly reserved the use of the work in an appropriate manner, and the resulting copies may be kept as long as needed for the mining.

A separate, non-waivable exception in section 11c lets a research organization or cultural heritage institution with lawful access extract from and copy a work for text and data mining carried out for scientific research, including within a public-private partnership, without the reservation that limits the general exception.

Lov nr. 680 af 6. juni 2023, which inserted these sections, provides that it takes effect on publication in Lovtidende; a specific commencement day beyond that is not confirmed in the primary text.

Whoever produces a catalogue, table, database or similar compilation in which a large number of items of information are assembled, or which results from a substantial investment, has the exclusive right to control the whole work or a substantial part of it, by reproducing it or by making it available to the public.

The right also reaches a repeated and systematic reproduction or making available of insubstantial parts of the compilation's content where that conflicts with normal exploitation of the compilation or unreasonably harms the maker's legitimate interests.

The protection lasts 15 years from the end of the year the work was made, extended to 15 years from the end of the year it was first made available to the public if that made-available date falls within the original term, and a contract term that extends the maker's right beyond that to a published work is void.

Section 6 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its operations or to provide its services, and to prevent an incident or minimise its impact on the recipients of its services and on other services, covering at minimum risk-analysis and information-system-security policy, incident handling, operational continuity, supply-chain security, secure acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policy, cyber hygiene and training, cryptography policy, personnel and access-management security, and, where relevant, multi-factor or continuous authentication and secured communications (Section 6(1)); an entity that falls short must take corrective measures without undue delay (Section 6(2)).

Section 7 requires the entity's management board (ledelsesorgan) to approve these measures, oversee their implementation, and ensure its own members receive cybersecurity risk-management training.

Section 9 requires a DNS provider, a top-level-domain registry, a domain-name-registration-service provider, and a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services to register with the relevant competent authority within 3 months of first falling within the Act's scope; Section 10 requires other essential and important entities to register within 2 weeks.

This Act, Lov nr 434 af 6. maj 2025 (NIS 2-loven), transposes NIS2 Directive Articles 21 and 24. By Section 1(2), it does not apply to an entity covered by Denmark's separate energy-sector preparedness Act, its telecommunications-sector security and preparedness Act, or the financial entities the Financial Business Act's Section 333(1) designates, each of which runs its own parallel regime.

By Section 33(4) to (7), it also repeals Denmark's four 2018 NIS1-era security laws (Lov nr 436, 437, 440 and 441 af 8. maj 2018).

Section 12 requires an essential entity or an important entity to notify the relevant competent authority and Denmark's CSIRT of every significant incident, defined as one that has caused or can cause serious operational disruption or financial loss for the entity, or that has affected or can affect another person through significant physical or non-physical harm.

Section 13 sets the notification clock: an early warning without undue delay and no later than 24 hours after becoming aware of the incident (Section 13(1)(1)); a notification without undue delay and in any case within 72 hours, updating the early warning with an initial severity and impact assessment (Section 13(1)(2)); an interim report on the CSIRT's request (Section 13(1)(3)); and a final report no later than one month after the notification, or, if the incident is still ongoing, a status report at that point and a final report within one month of the incident being handled (Section 13(1)(4) and (5)).

A trust-service provider instead sends only the Section 13(1)(2) notification, without undue delay and within 24 hours (Section 13(2)); the CSIRT must acknowledge an early warning within 24 hours and, on request, can offer guidance and operational advice (Section 13(3)).

Section 15 separately requires an essential or important entity to notify its service recipients, without undue delay, of a significant incident likely to adversely affect the delivery of their service, and to inform any recipient potentially affected by a significant cyber threat of the protective or responsive measures available to them.

This Act, Lov nr 434 af 6. maj 2025 (NIS 2-loven), transposes NIS2 Directive Articles 23 and 30 and, by Section 33(4) to (7), repeals Denmark's four 2018 NIS1-era security laws (Lov nr 436, 437, 440 and 441 af 8. maj 2018).

A provider of a video-sharing platform service under Danish jurisdiction must register with Radio- og tv-naevnet. The Culture Minister sets rules requiring such a provider to take appropriate measures to protect minors generally from harmful content.

The Culture Minister separately sets rules requiring such a provider to take appropriate measures to protect minors and the public from content that incites violence, hatred or terrorism, or that depicts child sexual abuse material within the meaning of Straffeloven section 235, racism or xenophobia, and bars a provider from processing a minor's personal data, collected or generated through its age or parental-control tools, for commercial purposes.

Radio- og tv-naevnet enforces the registration duty and these rules, and may order a provider to suspend its activity for a gross or repeated violation.

A press publication may not be reproduced online, or made available to the public at a place and time individually chosen by them, by a provider of an information-society service without the publisher's consent, until 2 years have elapsed after the end of the year the publication or announcement occurred. The right does not apply to a press publication first published or announced before 6 June 2019, regardless of any later use after the provision's own entry into force. The right binds a publisher established in a European Economic Area country.