Pexels abdul kayum 10845119

What you should know about GDPR in Denmark

Nicholas Ørum Keller Dec 14, 2023

Personal data protection’s rules are almost the same in all the EU-countries. In Denmark, however, there are some additional national rules that you have to be acquainted with, particularly rules on employment conditions

When doing business in Denmark, your business is likely to be a so-called “data controller” – primarily if you have employees. However, your business might also become a “data processor” if a core part of your business is to handle personal data from other companies. Examples could be bookkeeping companies or IT-companies processing personal data for others. 

Your obligations vary depending on whether your business is classified as a data controller or data processor.

Read more about Corporate law in Denmark

The practical GDPR-challenges when dealing with human behavior

In practice, it is our experience that most companies are very GDPR-aware on a strategic level. Usually businesses will have all the relevant documents, inventories, and GDPR plans prepared and approved on the higher levels of management. The real challenge, however, is the practical implementation; the art of actually getting employees to understand the significance of complying with a wide variety of new security routines on personal data protection. We have been successful in taking the strategic GDPR-documents and transforming them into every-day behavior with our clients. But it takes know-how on both a legal- and behavioral level.


Aside from the behavioral issues, we know that the major challenges businesses in Denmark experience, is completing a full inventory of all their various IT systems and tools. It is relatively easy to complete an inventory of your business’ main ERP system but what about all the various tools your organization is using? If your business is anything like ours, you will be using a wide range of the following: CRM/marketing tools; Mailchimp, Active Campaign, HubSpot. Task management tools; Anything from OneNote, Slack,, to Trello. Do not forget to include these in your GDPR-analysis.

You need to be able to document and disclose the following if the authorities come knocking:

An internal inventory of your IT systems:

  • which personal information you have in the different IT systems,
  • what is the purpose of obtaining and handling personal information,
  • the legal basis for processing personal data,
  • which internal users have access to the personal information (you are obligated to minimize the number of internal users with access),
  • which external companies / persons / programs receive the personal data of your customers and employees? (and are these external companies GDPR Data Privacy Framework compliant if they are in non-EU locations?)
  • what is the legal basis for sharing such personal data with these external companies / persons? (if you don’t have  a clear cut right under the Act you are not allowed to share the info at all),
  • whether the external companies / persons are within the EU / EEA or not – and in the latter case, what is the legal basis to disclose personal data to them,
  • when the personal data is deleted (and practically: by whom and how?).

Is your business 100 % ready for a surprise inspection by the Danish Data Protection Agency?

Let us be honest. Of course your business is not 100 % ready for a so-called “dawn raid” (surprise inspection) by the authorities. No business is.

However, with our help you can get to 95 %, which should keep you away from GDPR-breaches, large fines and loss of reputation.

The Danish Data Protection Agency (Datatilsynet) is the competent authority in Denmark for monitoring compliance with GDPR rules. They are advising, guiding and handling complaints and inspections of authorities and companies. 

If the Danish Data Protection Agency carries out a surprise inspection, e.g. in relation to a potential data breach, you need to be able to provide them with the internal information on data handling described above.

In addition, your business needs to document that your employees have received instructions – and regular training – on personal data management. 

During an inspection, you would be required to document how you inform your customers of your data collection. This needs to include the customers’ rights in relation to the collected personal data, as well as the purpose of processing their data.

We know that getting to the mythical state of being “GDPR-compliant” in Denmark might seem like an impossible task. However, at Baker Tilly Legal, we have lawyers who specialize in GDPR and are ready to help you quickly and easily through your GDPR-implementation in Denmark. We understand that your business needs practical solutions to its legal challenges – including GDPR.

Contact attorney-at-law Nicholas Ørum Keller, Baker Tilly Legal.

Read about
Photo of Nicholas Ørum Keller
Nicholas Ørum Keller
Attorney (L) | Partner

Related content

Article Real Estate Private Clients
Sajitha Sureshkanna • Jan 3, 2024
Article Real Estate Private Clients
Sajitha Sureshkanna • Jan 3, 2024
Article Commercial Law
Nicholas Ørum Keller • Jan 3, 2024
Article Commercial Law
Nicholas Ørum Keller • Jan 2, 2024
Article Corporate Law
Wivi H. Larsen • Dec 20, 2023
Article Corporate Law
Nicholas Ørum Keller • Dec 19, 2023
Article Employment law
Nicholas Ørum Keller • Dec 12, 2023
Article Corporate Law
Wivi H. Larsen • Dec 7, 2023
Article Employment law
Nicholas Ørum Keller • Dec 7, 2023
Article M&A
Nicholas Ørum Keller • Dec 4, 2023