Denmark

Denmark's supplementary AI Act law designates Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen as the national competent authorities under Article 70(1) of the EU AI Act.

Digitaliseringsstyrelsen is the notifying authority and central contact point and is the market-surveillance authority for Article 5(1)(a) to (c), (e) and (f) of the prohibited-practices list, which includes the untargeted scraping of facial images from the internet or CCTV footage to build a facial-recognition database.

Datatilsynet is the market-surveillance authority for Article 5(1)(d) and (g), covering individual predictive-policing profiling and biometric categorization that infers a protected characteristic. Domstolsstyrelsen covers the courts' own use of AI systems outside their judicial capacity. The authorities may demand information, enter business premises without a court order, run technical inspections of an AI system, publish their decisions, and issue compliance orders or temporary bans.

A violation of Article 5's prohibited practices, giving inaccurate, incomplete or misleading information on request, failing to answer an information demand, obstructing an inspection, or not complying with an order or temporary ban is punishable by a fine, and the limitation period is 5 years.

The law states no monetary ceiling, but the bill's notes on section 10 say the ceilings in Article 99(3) and (5) of the EU AI Act must be respected, which are EUR 35,000,000 or 7 percent of worldwide turnover for an Article 5 violation and EUR 7,500,000 or 1 percent for inaccurate information.

Act No 1322 of 20 November 2025 implements parts of Directive (EU) 2023/2225 on consumer credit agreements. Where the creditworthiness assessment uses automatic processing of personal data, section 7 c(9) of the Credit Agreements Act, as redrafted by section 1, point 15 of the Act, gives the consumer the right to request and obtain human intervention from the creditor.

That right includes a clear and comprehensible explanation of the assessment, covering the logic and risks of the automatic processing and its significance and effect on the decision, the right to express a view to the creditor, and the right to request a review of the assessment and of the decision to grant credit. Section 7 c(10) requires that the consumer be informed of these rights.

Section 7 c(11) requires the creditor to inform the consumer without delay of a refusal of a credit application and, where relevant, to refer the consumer to easily accessible debt advice services, and in that case also to tell the consumer that the assessment rests on automatic data processing, of the right to a human assessment and of the procedure for contesting the decision.

The Act comes into force on 20 November 2026 and does not apply to credit agreements concluded before then, apart from the exceptions that section 6 lists.

A controller must notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Denmark, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Section 22(1) and (2) of the Databeskyttelsesloven disapply Article 34 where the person's interest in the information must yield to decisive private or public interests.

Under section 22(6), Article 34 does not apply while telling the persons would be assumed to hamper the investigation of criminal offenses, a decision only the police can take.

The Danish Data Protection Act gives the General Data Protection Regulation (GDPR) domestic effect in Denmark and supplements it with Denmark-specific derogations for matters GDPR leaves to member states.

Section 6(2) and (3) set the digital age of consent at 15 years, section 11 lets a private party process a CPR (civil registration) number only on listed grounds such as the person's consent, section 2(4) applies the Act and the GDPR to every form of television surveillance, and section 3(8) disapplies chapters II to VII and IX of the GDPR to processing carried out solely for journalistic purposes, except Articles 28 and 32.

The age was raised from 13 to 15 by Act No. 1783 of 28 December 2023, in force from 1 January 2024. Datatilsynet, the Danish Data Protection Agency, enforces it, with the distinctive feature that Denmark cannot itself impose an administrative fine (see the enforcement instrument below).

Transferring personal data of a person in Denmark outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

Section 31 of the Databeskyttelsesloven lets Datatilsynet, absent an adequacy decision and in special cases, prohibit, restrict or suspend the transfer of special categories of data under General Data Protection Regulation (GDPR) Article 9(1) to a third country or international organisation.

General Data Protection Regulation (GDPR) Article 22 gives a person in Denmark the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Databeskyttelsesloven adds no rule of its own on automated decisions.

General Data Protection Regulation (GDPR) Articles 12 to 21 apply directly in Denmark: access, rectification, erasure, restriction, portability, and objection, generally exercisable against the controller within one month. Section 22(1) of the Databeskyttelsesloven narrows them for a private controller: the information, access and breach-notice duties (Articles 13, 14, 15 and 34) do not apply where the person's interest in the information must yield to decisive private interests, including their own.

Section 22(2) allows the same exception where the person's interest must yield to decisive public interests, such as public security, crime prevention or the enforcement of civil-law claims. Under section 22(5), access, rectification, restriction and objection do not apply to processing solely for scientific or statistical purposes.

Datatilsynet holds the General Data Protection Regulation (GDPR) Article 58 corrective toolkit directly, warnings, reprimands, compliance orders and processing bans, but GDPR Recital 151 records that Denmark's legal system does not allow the supervisory authority itself to impose an administrative fine.

Where a violation is expected to lead to no more than a fine, section 42 of the Databeskyttelsesloven lets Datatilsynet offer a fine notice (bødeforelæg) that settles the case without trial if the person pleads guilty and pays the stated fine, and acceptance ends the prosecution. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for the purpose of uniquely identifying a natural person as a special category of personal data, prohibited absent an Article 9(2) ground such as explicit consent. The Danish Data Protection Act does not mention biometric data: its section 7 treats every Article 9(1) category alike, so the Act has no list of biometric identifier types and no biometric-specific rule.

Section 263, subsection 1, punishes with a fine or imprisonment of up to 1 year and 6 months whoever unlawfully obtains access to another's data system or to data intended for use in a data system. The provision does not state that the access must defeat a security measure, so its text does not on its face exclude reading a public, unauthenticated page.

Subsection 3 raises the maximum to imprisonment of up to 6 years where the access is made with intent to learn a business's trade secrets or under other especially aggravating circumstances, including systematic or organized offending. A related section, 263a, separately punishes commercial trafficking in access credentials to a data system.

A person with lawful access to a work may extract from it and make copies of it for text and data mining, defined as any automated analytical technique for analysing text and data in digital form to generate information such as patterns, trends and correlations, provided the rights holder has not expressly reserved the use of the work in an appropriate manner, and the resulting copies may be kept as long as needed for the mining.

A separate, non-waivable exception in section 11c lets a research organization or cultural heritage institution with lawful access extract from and copy a work for text and data mining carried out for scientific research, including within a public-private partnership, without the reservation that limits the general exception. Act number 680 of 6 June 2023, which inserted these sections, provides that it takes effect on publication in Lovtidende, and it came into force on 7 June 2023.

Whoever produces a catalogue, table, database or similar compilation in which a large number of items of information are assembled, or which results from a substantial investment, has the exclusive right to control the whole work or a substantial part of it, by reproducing it or by making it available to the public.

The right also reaches a repeated and systematic reproduction or making available of insubstantial parts of the compilation's content where that conflicts with normal exploitation of the compilation or unreasonably harms the maker's legitimate interests.

The protection lasts 15 years from the end of the year the work was made, extended to 15 years from the end of the year it was first made available to the public if that made-available date falls within the original term, and a contract term that extends the maker's right under subsection 1 in respect of a published work is void.

Act No. 435 of 6 May 2025 on security and preparedness in the telecoms sector (Lov om sikkerhed og beredskab i telesektoren) implements parts of the European Electronic Communications Code (Directive (EU) 2018/1972) and parts of NIS2 (Directive (EU) 2022/2555) for providers that make public electronic communications networks or publicly available electronic communications services available in Denmark for commercial purposes.

Under Section 3 a provider is essential if it employs 50 people or more, or has an annual turnover and a balance sheet each above EUR 10 million, and a provider that meets one of the listed criteria, such as being the only provider of a network or service essential for critical societal or economic activities, is essential whatever its size; under Section 4 the other providers are important.

Section 5(1) requires essential and important providers to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems they use and to prevent incidents or minimise their impact, covering at least ten categories that mirror NIS2 Article 21. Section 5(2) requires a provider that does not meet a Section 5 requirement to take all necessary corrective measures without undue delay.

Under Section 6 the provider's management body must approve the measures and supervise their implementation, and its members must attend courses on managing information-security risks. Section 7 requires a provider to register with the Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed) within two weeks of falling under the Act and to report changes within two weeks. Section 31 punishes a violation of Section 5(1) or (2) with a fine. The Act entered into force on 1 July 2025.

Section 6 requires an essential entity or an important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems it uses for its operations or to provide its services, and to prevent an incident or minimise its impact on the recipients of its services and on other services, covering at minimum risk-analysis and information-system-security policy, incident handling, operational continuity, supply-chain security, secure acquisition and development including vulnerability handling and disclosure, effectiveness-assessment policy, cyber hygiene and training, cryptography policy, personnel and access-management security, and, where relevant, multi-factor or continuous authentication and secured communications (Section 6(1)); an entity that falls short must take corrective measures without undue delay (Section 6(2)).

Section 7 requires the entity's management board (ledelsesorgan) to approve these measures, oversee their implementation, and ensure its own members receive cybersecurity risk-management training.

Section 9 requires a DNS provider, a top-level-domain registry, a domain-name-registration-service provider, and a provider of cloud-computing, data-centre, content-delivery-network, managed, managed-security, online-marketplace, online-search-engine or social-networking-services-platform services to register with the relevant competent authority within 3 months of first falling within the Act's scope; Section 10 requires other essential and important entities to register within 2 weeks.

This Act, Lov nr 434 af 6. maj 2025 (NIS 2-loven), transposes NIS2 Directive Articles 20 and 21. By Section 1(2), it does not apply to an entity covered by Denmark's separate energy-sector preparedness Act, its telecommunications-sector security and preparedness Act, or the financial entities the Financial Business Act's Section 333(1) designates, each of which runs its own parallel regime.

By Section 33(4) to (7), it also repeals Denmark's four 2018 NIS1-era security laws (Lov nr 436, 437, 440 and 441 af 8. maj 2018).

Section 8(2) of Act No. 435 of 6 May 2025 on security and preparedness in the telecoms sector requires telecoms providers to notify the Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed) and the computer security incident response team (CSIRT) of every significant incident under the procedure in Section 9.

Under Section 8(3) an incident is significant if it has caused or can cause severe operational disruption of networks or services or financial loss to the provider, or has affected or can affect other persons by causing considerable material or non-material damage.

Under Section 9(1) the provider sends an early warning without undue delay and within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours, an interim report on the authority's request, and a final report no later than one month after the incident notification, with a status report and a final report within one month of the incident being handled if it is still ongoing.

Section 11 requires the provider to tell the recipients of its services without undue delay when a significant incident is likely to affect their service negatively, and to tell recipients potentially affected by a significant cyber threat of the measures they can take. The Act entered into force on 1 July 2025.

Section 12 requires an essential entity or an important entity to notify the relevant competent authority and Denmark's computer security incident response team (CSIRT) of every significant incident, defined as one that has caused or can cause serious operational disruption or financial loss for the entity, or that has affected or can affect another person through significant physical or non-physical harm.

Section 13 sets the notification clock: an early warning without undue delay and no later than 24 hours after becoming aware of the incident (Section 13(1)(1)); a notification without undue delay and in any case within 72 hours, updating the early warning with an initial severity and impact assessment (Section 13(1)(2)); an interim report on the CSIRT's request (Section 13(1)(3)); and a final report no later than one month after the notification, or, if the incident is still ongoing, a status report at that point and a final report within one month of the incident being handled (Section 13(1)(4) and (5)).

A trust-service provider must send the Section 13(1)(2) notification of a significant incident without undue delay and within 24 hours (Section 13(2)); the CSIRT must acknowledge an early warning within 24 hours and, on request, can offer guidance and operational advice (Section 13(3)).

Section 15 separately requires an essential or important entity to notify its service recipients, without undue delay, of a significant incident likely to adversely affect the delivery of their service, and to inform any recipient potentially affected by a significant cyber threat of the protective or responsive measures available to them.

This Act, Lov nr 434 af 6. maj 2025 (NIS 2-loven), transposes NIS2 Directive Article 23 and, by Section 33(4) to (7), repeals Denmark's four 2018 NIS1-era security laws (Lov nr 436, 437, 440 and 441 af 8. maj 2018).

Section 10, paragraph 1 of the Marketing Practices Act (markedsføringsloven) bars a trader from contacting anyone by electronic mail, an automatic calling system or fax for direct marketing unless that person has given prior consent. Section 10, paragraph 1 requires the person to be told before consenting that the consent can be withdrawn, and requires the trader to offer an easy and free way to withdraw it.

Section 10, paragraph 2 lets a trader that received a customer's electronic address in connection with a sale market its own similar products to the customer by electronic mail without prior consent, if it gives the customer a clear and unambiguous, easy and free opportunity to object both when the address is given and in every later contact.

Section 10, paragraph 3 requires a direct-marketing electronic mail to be clearly identifiable as marketing, to make the conditions of promotional measures easy to reach and clearly presented, to show on whose behalf it is sent, not to urge the recipient to visit websites that fail those requirements, and to carry an address the recipient can use to stop such contact. Section 24, paragraph 2 makes an act in breach of the Act a ground for damages under the general rules of Danish law.

Section 25, paragraph 1 has the Consumer Ombudsman (Forbrugerombudsmanden) supervise compliance with the Act. Section 32, paragraph 1 lets anyone with a legal interest bring an action for an injunction, an order, damages and compensation under section 24. Section 37, paragraph 3 punishes a breach of section 10 with a fine, unless a higher penalty is deserved under section 279 of the Penal Code or other legislation. The Act takes effect on 1 July 2017. Law 1309 of 6 December 2019, in force from 17 January 2020, amended section 10, paragraph 1.

Section 3, paragraph 1 of the Cookie Order bars a natural or legal person from storing information in, or gaining access to information already stored in, an end user's terminal equipment, or letting a third party do so, unless the end user consents after receiving full information about the storage or access.

Section 3, paragraph 2 makes the information full only if it is clear, precise and easy to understand, states the purpose, identifies each person arranging the storage or access, gives immediate access to refuse or withdraw consent with clear guidance on using it, and is immediately accessible to the end user.

Section 3, paragraph 2 also requires information on storage or access through an information and content service to be permanently available through a direct and clearly marked access on that service. Section 4, paragraph 1 lifts the ban where the storage or access has the sole purpose of carrying communication over an electronic communications network, or is required to enable the provider of an information society service the end user expressly requested to deliver it.

Section 4, paragraph 2 treats storage or access as required where it is a technical precondition for delivering a service that works in line with its purpose. Section 5, paragraph 1 punishes a breach of section 3 with a fine. The Order takes effect on 14 December 2011.

Section 9, paragraph 1 of the Whistleblower Protection Act requires employers with 50 or more employees to set up an internal whistleblower scheme in which employees can report the matters the Act covers. Section 24, paragraph 1 requires oral reports to be documented by recording the conversation or meeting with the whistleblower's consent, or by accurate minutes that the whistleblower can check, correct and accept by signing.

Section 24, paragraph 2 also allows an oral report made through a telephone system to be documented by an accurate transcript of the conversation that the whistleblower can check, correct and accept by signing. Section 31 provides that the Act takes effect on 17 December 2021 and that chapter 3 takes effect for private-sector employers with 50 to 249 employees on 17 December 2023.

Section 10, paragraph 4 of the Marketing Practices Act bars a trader from contacting a specific natural person for direct marketing by means of distance communication other than electronic mail, an automatic calling system or fax if the person has told the trader not to, if the quarterly register kept by the Central Person Register (CPR) shows that the person has opted out of direct marketing, or if the trader has learned from a CPR lookup that the person has.

Section 10, paragraph 5 disapplies the two CPR limbs of paragraph 4 where the person has previously asked the trader to make the contact. Section 10, paragraph 6 requires a trader that first contacts a specific natural person by those means to state clearly and unambiguously the right to opt out of its direct marketing, and to always offer an easy and free way to opt out of such contact.

Section 37, paragraph 7 lists unsolicited telephone contact for direct marketing with a natural person on the Robinson list, or who has opted out of the trader's marketing, as a breach of section 10, paragraph 4 for which the duration or extent of the breach counts in setting the fine. Section 25, paragraph 1 has the Consumer Ombudsman (Forbrugerombudsmanden) supervise compliance with the Act.

Section 32, paragraph 1 lets anyone with a legal interest bring an action for an injunction, an order, damages and compensation under section 24. Section 37, paragraph 3 punishes a breach of section 10 with a fine, unless a higher penalty is deserved under section 279 of the Penal Code or other legislation. The Act takes effect on 1 July 2017.

Section 1 applies the Act to the liability of a producer and an intermediary for damage caused by a defect in a product that the producer or intermediary produced or supplied. Section 3 defines a product as any movable object (løsøregenstand), whether processed or a natural product, including one incorporated as a component of another movable object or of immovable property. Section 3 extends the rules on products to electricity.

The Ministry of Justice's memorandum to Bill L 32 says that it has been unclear to what extent intangible products such as software are covered by the product concept of the Act. The same memorandum takes it that damage caused by a physical object that contains software is covered by the Act, whether the damage comes from the object or from the software itself. Section 2 covers compensation for personal injury and loss of a provider.

Section 2 covers damage to a thing only where the thing is by its nature ordinarily intended for non-business use and was mainly used that way by the injured person. Section 2 leaves damage to the defective product itself outside the Act. Section 4 treats as producer the person who makes a finished product, a part product or a raw material, and the person who puts its name, mark or other distinguishing feature on a product to present itself as the producer.

Section 4 also treats as producer the person who, in the course of its business, imports a product into the European Community for resale, hire, leasing or another form of circulation. Section 4 treats every intermediary as the producer where the injured person cannot establish who produced the product, or who imported it from outside the European Community.

That treatment does not apply where the intermediary gives the injured person, within a reasonable time, the name and address of the producer or importer or of the person who supplied the product to it. Section 5 makes a product defective when it does not offer the safety that can rightly be expected, taking account of all circumstances, in particular its marketing, the use that can reasonably be expected and the time it was put into circulation.

Section 6 makes a producer liable to compensate damage caused by a defect in a product that it produced or supplied. Section 6 leaves the injured person to prove the damage, the defect and the causal link between them.

Section 7 releases the producer where it proves that it did not put the product into circulation, that it did not make or circulate it in the course of a business, that the defect results from mandatory rules issued by a public authority, or that the state of scientific and technical knowledge when the product was put into circulation made the defect impossible to discover.

Section 7 also releases the producer where it must be assumed that the defect that caused the damage did not exist when the producer put the product into circulation. Section 7 releases the producer of a part product that proves that the defect results from the design of the product into which the part was incorporated or from instructions given by the maker of the finished product. Section 8 deducts DKK 4,000 when compensation for damage to a thing is fixed.

Section 10 makes an intermediary liable for product damage covered by section 2 unless it shows that the damage is not due to its own fault or negligence. Section 11 makes two or more persons who are liable under the Act for the same damage jointly and severally liable. Section 12 provides that the Act cannot be departed from by prior agreement to the detriment of the injured person.

Section 13 leaves the injured person's access to compensation under the general rules on compensation in or outside contract in place. Section 14, as rewritten by Act 523 of 6 June 2007, subjects claims for product damage to the limitation rules of the Limitation Act. The rewritten section 14 makes limitation of a claim against the producer under section 6 occur at the latest 10 years after the day the producer put the damaging product into circulation.

Act 523 of 6 June 2007 entered into force on 1 January 2008. The Ministry of Justice's memorandum to Bill L 32 states that the general limitation period under the Limitation Act is 3 years. Section 17 of the original Act brought it into force on the day after its publication in Lovtidende. Retsinformation dates the publication of the original Act, Act 371 of 7 June 1989, to 9 June 1989. Retsinformation shows the consolidated text, Lovbekendtgørelse 261 of 20 March 2007, as in force.

Bill L 32 would repeal the Act. Under the bill the present rules would keep applying to products put into circulation or into use before the new Act enters into force.

Section 1(1) applies the Act to consumer computer hardware systems and operating systems for general purposes, payment terminals, cash machines, ticketing machines, check-in machines and interactive information terminals intended for the services the Act covers (other than those installed as an integral part of vehicles, aircraft, ships or rolling stock), consumer terminal equipment with interactive computing capability used for electronic communications services or to access audiovisual media services, and e-readers.

The Act implements parts of Directive (EU) 2019/882, the European Accessibility Act. Article 31(2) of the Directive requires EU countries to apply their implementing measures from 28 June 2025. Section 59(1) of the Act applies it to products and services placed on the market or supplied from 28 June 2025. Section 4 of the Act allows a product to be placed on the market only if it meets the relevant accessibility requirements in Annex 1.

Section 5(1) requires products to meet the requirements in parts 1 and 2 of Annex 1. Section 5(2) requires self-service terminals to meet only the requirements in part 1 of Annex 1. Section 14 presumes a product that conforms to harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union to meet the accessibility requirements the standards cover.

Section 15(1) gives the same presumption to conformity with the technical specifications that the Commission adopts under Article 15(3) of the Directive. Section 8(1) disapplies the accessibility requirements to the extent that compliance would need a significant change that fundamentally alters the basic nature of the product, or would impose a disproportionate burden on the trader.

Article 14(1) of the Directive likewise applies the accessibility requirements only to the extent that compliance requires no fundamental alteration and imposes no disproportionate burden. Section 8(2) denies the disproportionate-burden defence to a trader that does not use only its own funds to improve accessibility. Sections 9(1) and 9(2) require the trader to assess the defence against the criteria in Annex 5 and to document the assessment.

Section 9(3) requires the documentation to be kept for at least 5 years after the product was last made available. Section 9(4) requires the trader to give the control authority a copy of the documentation on request. Section 10(1) exempts a microenterprise that trades in products from documenting the assessment. Section 10(2) requires such a microenterprise, when it relies on section 8, to give the authority on request the information relevant to the assessment.

Section 12(1) requires a trader that relies on section 8 to send that information to the relevant control authority. Section 12(2) exempts microenterprises from that duty. Section 17(1) requires a manufacturer to draw up the technical documentation, to have the conformity assessment procedure carried out except where section 8 applies, and to draw up the EU declaration of conformity and affix the CE marking.

Section 25(2) requires an importer to check the conformity assessment procedure, the CE marking and the EU declaration of conformity of every product except one that is exempt from the accessibility requirements under section 8(1). Section 29(2) requires a distributor to check the CE marking of every product except one that is wholly exempt under section 8(1).

Executive Order 823 of 8 June 2022, made under section 33(2) of the Act, requires a trader dealing in products to be able to give, for a period of 5 years, the information on every other trader that supplied it with a product or that it supplied with a product. Section 38(2) requires the EU declaration of conformity of a product that is partly exempt under section 8(1) to state which accessibility requirements the product is exempt from.

Section 45(2) makes the Danish Safety Technology Authority (Sikkerhedsstyrelsen) the control authority for the products in section 1(1). Section 47(1) gives the control authority access to business premises and means of transport at any time, on proper identification and without a court order. Section 49(1) lets the control authority order a trader to put a non-conforming product right within a set time.

Section 49 then lets it order the trader to stop selling the product or to withdraw it from the market within a set time. Act 637 of 11 June 2024 added a paragraph to section 49 that lets the authority order a trader dealing in products to put right a misplaced or missing CE marking, a missing or incorrect EU declaration of conformity, missing technical documentation, missing identification details or any other administrative requirement on manufacturers and importers.

Section 50(2) lets the authority order a trader to stop selling a product that wrongly bears the CE marking and, if necessary, to withdraw it from the market. Section 50(3) lets it order a manufacturer or importer to remove the CE marking within a set time. Section 55(1) lets a consumer bring a matter before the relevant control authority. Section 56 bars an appeal against the control authorities’ decisions to any other administrative authority.

Section 57(1) punishes with a fine anyone who breaches sections 4 and 5, 9(2) and 9(3), 12(1), 38 to 40 or 43 and 44, fails to give the authority information under sections 9(4), 10(2), 33(1) or 46, fails to fulfil the manufacturer, importer and distributor obligations in sections 16 to 21 and 24 to 31 or the obligations of an authorised representative’s mandate under section 23(1), obstructs the authority’s access under section 47(1), disregards its decisions or evades or attempts to evade its control, or wrongly uses the CE marking, unless a higher penalty is incurred under other legislation.

Section 57(3) allows companies and other legal persons to be held criminally liable in accordance with chapter 5 of the Penal Code. Section 57 states no amount for the fine. The remarks to bill L 131 of the 2021-22 session, which became the Act, leave the size of the fine to the courts’ assessment of all the circumstances of each case. The same remarks state that the Ministry found no basis for imprisonment for breaches of the Act.

Article 30(1) and (2) of the Directive require EU countries to lay down penalties for infringements of the national provisions that are effective, proportionate and dissuasive. The remarks to bill L 8 of the 2026-27 session state that Sikkerhedsstyrelsen merged with the Danish Business Authority (Erhvervsstyrelsen) on 1 January 2026 and is now part of it. Bill L 8, as presented on 7 October 2026, would write Erhvervsstyrelsen in place of Sikkerhedsstyrelsen in section 45(2) of the Act.

The bill would also add a section 49 a, under which the control authority informs the Commission and the other Member States when a product’s non-compliance is not limited to products made available in Denmark. Section 4 of the bill sets 1 January 2027 for its entry into force. Section 58 of the Act brought it into force on 28 June 2022.

Act 637 of 11 June 2024 also added section 51 a, which requires the control authority to give consumers on request, in an accessible format, its own information on traders’ compliance with the accessibility requirements and on their exemption assessments. Section 5(2) of Act 637 brought its section 4, which amended the Accessibility Act, into force on 12 June 2024, the day after its publication in Lovtidende on 11 June 2024.

Section 1(2) applies the Act to electronic communications services other than machine-to-machine transmission services, services that give access to audiovisual media services, elements of air, bus, rail and ship passenger transport, consumer banking services, e-books and dedicated software, and e-commerce services, when they are supplied to consumers.

For passenger transport, section 1(2), item 3 covers websites, services for mobile devices, electronic tickets and ticketing services, travel information including real-time information (on information screens, only interactive screens in the European Union), and interactive self-service terminals in the European Union, and for urban, suburban and regional transport only the self-service terminals. The Act implements parts of Directive (EU) 2019/882, the European Accessibility Act.

Section 59(1) of the Act applies it to products and services placed on the market or supplied from 28 June 2025. Section 4 of the Act allows a service to be supplied only if it meets the relevant accessibility requirements in Annex 1. Section 6(1) requires services to meet the requirements in parts 3 and 4 of Annex 1. Section 6(2) requires urban, suburban and regional transport services to meet only the requirements in part 4 of Annex 1.

For electronic communications, part 4 of Annex 1 requires real-time text in addition to voice communication, total conversation where video is provided in addition to voice, and emergency communications that are synchronised and sent by the providers of electronic communications services to the most appropriate alarm centre, including the emergency communications referred to in Article 109(2) of Directive (EU) 2018/1972.

Section 6(3) exempts microenterprises that provide services from the requirements in parts 3 and 4 of Annex 1 and from every obligation connected with them. Article 4(5) of the Directive exempts microenterprises providing services from the accessibility requirements for services and from any obligation relating to compliance with them.

Act 637 of 11 June 2024 added section 13 a, which obliges the business, climate-energy-utilities and transport ministers to prepare guidelines and tools for microenterprises.

Section 2 excludes from the Act pre-recorded time-based media and document formats published before 28 June 2025, online maps and mapping services where essential navigation information is given in an accessible digital manner, third-party content the trader neither finances, develops nor controls, and archive content not updated or edited after 28 June 2025.

Section 7 deems a service that meets the accessible-information requirements of the EU passenger rights regulations and of the acts adopted under Directives 2008/57/EC and (EU) 2016/797 to meet the corresponding requirements of the Act, and applies the Act’s additional requirements in full.

Section 8(1) disapplies the accessibility requirements for services to the extent that compliance would need a significant change that fundamentally alters the basic nature of the service, or would impose a disproportionate burden on the trader. Section 8(2) denies the disproportionate-burden defence to a trader that does not use only its own funds to improve accessibility.

Sections 9(1) and 9(2) require the trader to assess the defence against the criteria in Annex 5 and to document the assessment. Section 9(3) requires the documentation to be kept for at least 5 years after the service was last supplied. Section 11 requires a service provider that relies on the disproportionate-burden defence to renew the assessment for each category or type of service when the service changes or the authority asks, and in any event at least every five years.

Section 12(1) requires a trader that relies on section 8 for a service to send that information to the relevant control authority. Section 12(2) exempts microenterprises from that duty. Section 14 presumes a service that conforms to harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union to meet the accessibility requirements the standards cover.

Section 34 requires a service provider to ensure that the services it designs and supplies conform to the Act. Section 35(1) requires a service provider, before supplying a service, to prepare the information required by Annex 4 and to explain how the service meets the accessibility requirements. Section 35(2) and (3) require the information to be published in writing and orally, including in a way accessible to persons with disabilities, and kept for as long as the service is offered.

Section 37(2) requires a service provider to inform the relevant control authority in every Member State where the service is supplied of any non-conformity and the measures taken. Section 59(2) lets a service provider keep supplying similar services with products lawfully used for services before 28 June 2025 until 28 June 2030. Section 59(3) lets service agreements concluded before 28 June 2025 continue unchanged until they expire and at the latest until 28 June 2030.

Section 59(4) lets payment terminals and self-service terminals within section 1(1), items 2 and 3, lawfully used to provide services before 28 June 2025 keep providing similar services until the end of their economic life and at most 20 years after they were put into use. Article 32(1) of the Directive requires the Member States to provide for a transitional period ending on 28 June 2030 for services provided with products lawfully used before that date.

Article 32(2) of the Directive allows the Member States to let such self-service terminals stay in use until the end of their economically useful life and for no longer than 20 years. Section 45(2) makes the Danish Safety Technology Authority (Sikkerhedsstyrelsen) the control authority for services that give access to audiovisual media services, consumer banking services, e-books and dedicated software, and e-commerce services.

Section 45(3) makes the Danish Energy Agency (Energistyrelsen) the control authority for electronic communications services. Section 45(4) makes the Danish Transport Authority (Trafikstyrelsen) the control authority for the elements of air, bus and rail passenger transport and for the self-service terminals of ship passenger transport. Section 45(5) makes the Danish Maritime Authority (Søfartsstyrelsen) the control authority for the other elements of ship passenger transport.

Section 47(1) gives the control authority access to business premises and means of transport at any time, on proper identification and without a court order. Section 49(1) lets the control authority order a trader to put a non-conforming service right within a set time. Section 49 then lets it order the trader to stop offering the service within a set time. Section 55(1) lets a consumer bring a matter before the relevant control authority.

Section 55(2) lets public bodies, private associations, organisations and other legal entities with a legitimate interest take part in any judicial or administrative proceeding before the courts or the control authority, on behalf of or in support of the complainant. Section 55(4) lets the business minister set rules for a complaints board for consumer complaints pursuant to the Act. Section 56 bars an appeal against the control authorities’ decisions to any other administrative authority.

Section 57(1) punishes with a fine anyone who breaches section 4, section 6(1) or (2), 9(2) and 9(3), 11 or 12(1), fails to give the authority information under sections 9(4) or 46, fails to fulfil the service provider obligations in sections 34 to 37, obstructs the authority’s access under section 47(1), or disregards its decisions or evades or attempts to evade its control, unless a higher penalty is incurred under other legislation.

Section 57(3) allows companies and other legal persons to be held criminally liable in accordance with chapter 5 of the Penal Code. Section 57 states no amount for the fine. The remarks to bill L 131 of the 2021-22 session, which became the Act, leave the size of the fine to the courts’ assessment of all the circumstances of each case. The same remarks state that the Ministry found no basis for imprisonment for breaches of the Act.

Article 30(1) and (2) of the Directive require EU countries to lay down penalties for infringements of the national provisions that are effective, proportionate and dissuasive. The remarks to bill L 8 of the 2026-27 session state that Sikkerhedsstyrelsen merged with the Danish Business Authority (Erhvervsstyrelsen) on 1 January 2026 and is now part of it.

The same remarks state that the Danish Agency for Digital Government (Digitaliseringsstyrelsen) has taken over responsibility for electronic communications services following a royal resolution of August 2024. Bill L 8, as presented on 7 October 2026, would write Erhvervsstyrelsen in place of Sikkerhedsstyrelsen in section 45(2) of the Act and Digitaliseringsstyrelsen in place of Energistyrelsen in section 45(3).

The bill would also add a section 2(2) under which the Act does not apply to matters covered by the Copyright Act or by Regulation (EU) 2017/1563. It would add a section 2 a under which products and services that meet the Act may not be prevented from being made available or supplied in Denmark for reasons related to accessibility requirements. Section 4 of the bill sets 1 January 2027 for its entry into force.

Act 637 of 11 June 2024 also added section 51 a, which requires the control authority to give consumers on request, in an accessible format, its own information on traders’ compliance with the accessibility requirements and on their exemption assessments. Section 5(2) of Act 637 brought its section 4, which amended the Accessibility Act, into force on 12 June 2024, the day after its publication in Lovtidende on 11 June 2024.

Executive Order 944 of 18 June 2020 is made under section 48(2) of the Radio and Television Act. Section 48(2) of that Act requires the Minister for Culture to lay down provisions that make programme activity gradually more accessible to persons with disabilities by proportionate measures. The Order implements parts of Directive 2018/1808/EU, which amended the Audiovisual Media Services Directive.

Section 1(1) applies the Order to providers of television and on-demand audiovisual media services under Danish jurisdiction that are covered by chapter 8 of the Radio and Television Act, which governs programme activity under a licence or registration. Section 1(2) excludes the public service programme activity of DR, TV 2 DANMARK A/S and the regional TV 2 companies, and the public service programme activity under section 11(2) of the Radio and Television Act.

Section 1(3) sets their accessibility obligations in their public service contracts and licence. Section 1(4) sets accessibility conditions for the public service programme activity of section 11(2) of the Radio and Television Act in the permits that the Radio and Television Board grants after tender. Section 2(1) requires a provider to make its programme activity gradually and continuously more accessible to persons with disabilities by proportionate measures.

Section 2(2) names as measures sign-language interpretation, subtitling for deaf and hard-of-hearing viewers, read-aloud subtitles and audio description. Section 3(1) requires a provider to submit action plans to the Radio and Television Board that state how it will seek to meet section 2, and the plans apply as a rule for three years. Section 3(2) requires account to be taken of technological development, user needs, usefulness and resources in choosing the measures offered.

Section 3(3) has the Board assess whether an action plan can be noted or needs changes. Section 4(1) requires a provider to report regularly to the Board on carrying out the action plans. Section 5(1) makes the Radio and Television Board (Radio- og tv-nævnet) the supervisor of the action plans, the accessibility measures and the reporting. Section 5(2) has the Board issue a formal reprimand (påtale) for a breach of the rules.

Section 5(3) lets the Board decide whether the rules are complied with. Section 6(1) has the Board hear complaints about whether a provider has put accessibility measures in place. Section 6(2) makes information and guidance on the rules, and on the complaint route, available at an easily accessible online contact point on the website of the Agency for Culture and Palaces (Slots- og Kulturstyrelsen).

Section 7 lets the Board require a provider to supply information, documents and written statements about its operations. Section 8 refers to section 50 of the Radio and Television Act, under which the Board may withdraw a programme licence temporarily or permanently, or suspend or end programme activity, if the provider grossly or repeatedly breaches the Act or rules made under it.

Section 93(1), item 7 of the Radio and Television Act punishes with a fine anyone who disregards a decision to suspend or end programme activity under section 50(2) or (3). Section 9 brought the Order into force on 1 July 2020.

Executive Order 823 of 8 June 2022 is made under sections 33(2) and 57(2) of the Act on accessibility requirements for products and services. The Order implements parts of Directive (EU) 2019/882, the European Accessibility Act. Section 1 applies the Order to the products covered by section 1(1) of the Act and to the traders who deal in them.

Section 2(1) requires a trader dealing in those products to be able, for a period of 5 years, to give information on every other trader that supplied it with a product or that it supplied with a product. Article 12(2) of the Directive requires economic operators to be able to present that information for five years after they were supplied with the product and for five years after they supplied it.

Section 2(2) requires the information to be given to Sikkerhedsstyrelsen on request under section 33(1) of the Act. The remarks to bill L 8 of the 2026-27 session state that Sikkerhedsstyrelsen merged with the Danish Business Authority (Erhvervsstyrelsen) on 1 January 2026 and is now part of it. Section 3(1) punishes a breach of section 2 with a fine, unless a stricter penalty is incurred under other legislation.

Section 3(2) allows companies and other legal persons to be held criminally liable in accordance with chapter 5 of the Penal Code. Section 4(1) brought the Order into force on 28 June 2022, and section 4(2) applies it to products placed on the market from 28 June 2025.

Executive Order 1078 of 29 June 2022 is made under sections 176(4) and 194(2) of the Public Procurement Act. Section 1(1) of the Order requires contracting entities to comply with the provisions of the Utilities Directive. Section 1(2) defines the Utilities Directive as Directive 2014/25/EU of 26 February 2014.

Article 60(1) of Directive 2014/25/EU requires the technical specifications for all procurement intended for use by natural persons, whether the general public or staff of the contracting entity, to take account of accessibility criteria for persons with disabilities or design for all users, except in duly justified cases.

Article 24(1) of Directive 2019/882 makes the accessibility requirements in its Annex I mandatory accessibility requirements within the meaning of Article 60(1) of Directive 2014/25/EU. Section 18(1) of the Public Procurement Act takes contracts covered by Directive 2014/25/EU out of titles II and III of that Act, which hold its section 40. Section 19(1) brought the Order into force on 1 July 2022 and applies it to tenders under the Utilities Directive started from that day.

Section 52(1) of the Accessibility Act names Executive Order 1624 of 15 December 2015 alongside section 40(3) of the Public Procurement Act in making the accessibility requirements of its Annex 1 mandatory accessibility requirements. Sections 55(3) and 57(4) of the Accessibility Act also name Order 1624 in taking utilities tender procedures out of that Act’s consumer complaint route and its penalty provisions.

Section 19(2) of Order 1078 repealed Order 1624, and section 19(3) keeps Order 1624 for tenders under the Utilities Directive started before 1 July 2022. Section 195(1) of the Public Procurement Act lets a question of breach of rules made under that Act be brought before the Complaints Board for Tenders (Klagenævnet for Udbud).

Section 40(1) of the Public Procurement Act (udbudsloven) requires a contracting authority to state the technical specifications in the tender documents. Section 40(3), first sentence, requires the technical specifications for all procurement intended for use by natural persons to be drawn up, except in duly justified cases, with regard to accessibility for persons with disabilities or design for all users.

Section 40(3), second sentence, requires accessibility requirements that are mandatory by virtue of EU rules to be set by reference to those rules. Section 52(1) of the Accessibility Act makes the accessibility requirements in Annex 1 to that Act mandatory accessibility requirements within section 40(3) of the Public Procurement Act.

Article 24(1) of Directive 2019/882 makes the accessibility requirements in its Annex I mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU.

Section 52(2) of the Accessibility Act deems a product or service whose functionalities, elements and functions meet the relevant requirements in Annex 1 and conform with part 6 of that Annex to meet the corresponding obligations in Danish law that arise from EU acts other than the Accessibility Directive, as regards accessibility of those functionalities, elements and functions, unless those acts provide otherwise.

Title II of the Public Procurement Act, which holds section 40, applies to contracts at or above the value thresholds in section 6, tiered by the type of contract and of contracting authority. Section 9 requires contracting authorities to apply the thresholds in force at the time, which the European Commission revises every second year.

Section 195(1) lets anyone with a legal interest, or a right of complaint under the Act on the Complaints Board for Tenders, bring a question of breach of the Public Procurement Act or of rules made under it before the Complaints Board for Tenders (Klagenævnet for Udbud).

Under section 7(1) of the Act on the Complaints Board for Tenders, a complaint by an undertaking that it was not selected in a restricted procedure, a competitive procedure with negotiation, a competitive dialogue or an innovation partnership must be filed within 20 calendar days of the day after the notice of who was selected was sent.

Section 7(2) of that Act sets the time limits for other complaints about tenders under titles II and III, including 45 calendar days after the contracting authority has published a contract award notice in the Official Journal of the European Union. Section 13(1) of that Act lets the Board suspend the contracting authority’s procedure or decisions, annul its unlawful decisions, order it to bring the procedure into line with the rules, or impose an economic sanction on it.

Sections 16 and 17 of that Act let or require the Board to declare a contract ineffective in the cases they list. Section 55(3) of the Accessibility Act takes tender procedures under the Public Procurement Act out of that Act’s consumer complaint route. Section 57(4) of the Accessibility Act takes those tender procedures out of its penalty provisions. Section 196(1) brought the Public Procurement Act into force on 1 January 2016.

A provider of a video-sharing platform service under Danish jurisdiction must register with Radio- og tv-naevnet. The Culture Minister sets rules requiring such a provider to take appropriate measures to protect minors from harmful content, and rules that a minor's personal data collected or generated by the provider may not be processed for commercial purposes.

The Culture Minister separately sets rules requiring such a provider to take appropriate measures to protect the public from content that incites violence or hatred, or whose spread is a criminal offence: public incitement to terrorism, child pornography under Straffeloven section 235, or racism and xenophobia. Radio- og tv-naevnet registers providers, supervises them and prosecutes violations of the Act and of rules made under it.

Radio- og tv-naevnet may decide to stop a provider's activity, temporarily or permanently, for a gross or repeated violation.

A press publication may not be reproduced online, or made available to the public at a place and time individually chosen by them, by a provider of an information-society service without the publisher's consent, until 2 years have elapsed after the end of the year the publication or announcement occurred. The right does not apply to a press publication first published or announced before 6 June 2019, regardless of any later use after the provision's own entry into force.

The right applies to press publications published by publishers whose head office is in a European Economic Area country. The right does not apply to individual users' private or non-commercial use, to hyperlinks, or to single words or very short extracts of a press publication, per paragraph 2 of section 69 a. Authors of works in a press publication are entitled to an appropriate share of the revenue the publisher receives for that use, per paragraph 4 of section 69 a.