Key Takeaways
- The GDPR applies directly in Denmark and is supplemented by the Databeskyttelsesloven (Data Protection Act) with an enforcement procedure in which Datatilsynet recommends fines, but the courts impose them.
- Datatilsynet’s April 2022 Danske Bank referral illustrates the importance of retention rules and deletion evidence; a recommended fine is distinct from a final court outcome.
- Retention and deletion documentation is Denmark’s enforcement pressure point.
- Danish buyers evaluate in English but deploy documents in Danish.
Why Denmark’s Enforcement Model Is Different
Datatilsynet cannot fine you directly — the courts do. Under the Danish enforcement procedure, the Danish Datatilsynet does not impose administrative fines itself. It investigates, and where it finds a serious breach it reports the company to the police and recommends a fine to the courts, which then decide. This is a quirk of Danish constitutional law. The practical effect for companies is that a serious case becomes a criminal-justice matter with public visibility, which raises the reputational stakes even when the monetary amount is modest by EU standards.
A dated case illustrates the evidence gap. In its 5 April 2022 Danske Bank referral, Datatilsynet described missing documentation of retention rules and deletion across numerous systems and recommended a DKK 10 million fine. Use the factual lesson to test your own records; this article does not present that recommendation as the final judicial outcome.
The Databeskyttelsesloven supplements the GDPR with Danish rules. The Data Protection Act covers the age of consent, processing of national identification numbers (CPR numbers, a sensitive point in Denmark), and employment-context processing. Danish-language documentation is required in practice for staff and the authority.
Criteria That Matter for a Danish SME
| Criterion | Why it matters in Denmark | Minimum bar |
|---|---|---|
| Register (Art. 30) | Record available on authority request | Structured, exportable register |
| Retention / deletion rules | Danske Bank case turned on deletion | Documented retention + deletion evidence |
| CPR-number handling | Sensitive national identifier | Controls around identification numbers |
| DPIA module | Required for high-risk processing | Guided DPIA workflow |
| Danish-language output | Staff + authority read documents in Danish | Documents generated in Danish |
| Time-to-value | No dedicated privacy team | Trial using your own representative activities |
| EU hosting | Check hosting, support access and subprocessors | EU data centres |
The retention row is Denmark’s defining delta. Because Datatilsynet’s flagship case turned on the absence of documented deletion, a tool that captures retention periods per processing activity and lets you evidence deletion is doing exactly the work the Danish authority checks. Build the foundations from a GDPR compliance checklist. A written rule and its execution are different kinds of evidence. Keep both available and investigate systems that cannot carry out the intended deletion. The practical bar is a register where each activity carries a retention period and a demonstrable link to the deletion that actually happens.
Demonstrate deletion across an actual system chain
Use a hypothetical customer account whose service has ended. Give the vendor an invented account identifier, a retention rule and a list of places where records may exist: CRM, support tickets, invoice archive, export folder and backup. Ask the vendor to show how an owner finds these relationships and distinguishes an executable deletion task from a policy reminder.
First, assign different outcomes to the data categories. A record no longer needed for customer service may be deleted, while a specific accounting document may require restricted retention under an identified rule. The software must not convert the existence of one exception into a hold on the entire customer account. Ask how each decision is recorded and who can change it.
Next, run the task with one system intentionally unavailable. Check whether the workflow reports partial completion, preserves the outstanding action and alerts the responsible person. A green status after the first successful connector is not adequate evidence that the whole chain was handled. If the software only coordinates manual tasks, record that limitation and the external evidence required.
Finally, recreate the contact through an old import and test whether the process detects or prevents unwanted reactivation. This is especially relevant to marketing exports and separately maintained lists. The acceptance record should explain which systems were tested, what was deleted, what remained and why.
Use the general software comparison to establish a shortlist, then retain these Danish operational questions in the trial. Groups can compare the Swedish and Norwegian workflows without assuming that one national legal conclusion applies everywhere.
Request a scoped Danish proposal
Ask for the subscription, configuration, migration, support and integration work separately. Specify whether Danish documents and assistance are included, how many entities and users are priced, and who maintains the retention rules. If a consultant supplies the legal mapping, keep that work visible rather than assuming the subscription includes it.
Agree the currency, taxes, usage limits and renewal mechanism in the actual quote. There is no verified universal budget in this guide. The cost worksheet is useful for comparing offers on the same assumptions.
A hypothetical trial may show that two platforms have similar subscriptions but require different manual reconciliation. Measure the remaining tasks in that trial and assign an internal owner. Do not extrapolate a vendor’s demonstration speed into a guaranteed implementation deadline for your organisation.
Recommendations by Situation
- Danish SaaS / data-heavy company: an EU platform that documents retention periods and evidences deletion — the exact gap the Danske Bank case exposed.
- Traditional SME 50-300 employees: an EU platform with genuine Danish output; validate controls around CPR-number processing.
- Danish entity of an EU group on OneTrust: keep the group instance but confirm Danish document generation and documented deletion rules.
Implementation: Making Deletion Provable, Not Just Documented
Denmark rewards evidence over policy, so a Danish rollout should be built to prove deletion, not merely to promise it. Start by giving every processing activity in the register a retention period tied to its purpose or a statutory basis — bookkeeping records under Danish accounting law, employment files, marketing data all carry different clocks. Then map each activity to the system where the data actually lives, because deletion has to happen in the CRM, the backup and the analytics store, not only in the policy document. Finally, keep a deletion log: when a retention period expires, the record of what was deleted and when is the artefact that answers Datatilsynet’s central question.
Where identifiers such as CPR numbers are used, record why they are necessary, who can access them and which national provisions apply. The purchase should make that analysis and its implementation reviewable, without assuming a standard template settles it.
FAQ
Who enforces the GDPR in Denmark?
Datatilsynet, the Danish Data Protection Agency. It supervises the GDPR and the Databeskyttelsesloven, but it does not impose fines itself: it recommends fines to the courts and reports serious cases to the police. Its guidance and cases are published in Danish and English.
How does Denmark’s fine model work?
Datatilsynet investigates and, in serious cases, reports the company to the police and recommends a fine amount; a court then decides whether to impose it and how much. This makes serious GDPR breaches a criminal-justice matter in Denmark, with the reputational exposure that entails, even where the monetary figure is modest.
How should a Danish company compare the total cost?
Use a scoped quote and the work observed in the deletion trial. Specify entities, users, language needs, integrations, advisory assistance and termination support. Ask which tasks the platform performs and which remain with your staff. Compare the same configuration and service boundaries across offers rather than relying on a universal annual budget.
What did the Danske Bank case mean for Danish companies?
Datatilsynet recommended a DKK 10 million fine because Danske Bank could not demonstrate documented rules for deleting personal data it no longer needed. For Danish companies it made retention and deletion documentation a priority: you must show not only a policy but evidence that data is actually deleted at end of its retention period.
Handover to the person who runs the process
Before acceptance, let the future process owner repeat the demonstration without the vendor driving the screen. They should locate a retention rule, change a responsible person, record an exception and retrieve the result of a failed deletion. A system that only the implementation consultant can operate will leave the original evidence gap unresolved.
Keep a short handover record with the tested workflow, unresolved integrations, review date and support contact. Include the process for staff absence: who handles an incident or rights request when the primary owner is unavailable? Recheck the Danish wording used in staff instructions and external replies so the exported document communicates the actual decision.
The applicable accountability, retention, processor and rights requirements remain those of the GDPR and relevant Danish rules. The completed trial establishes evidence of the functions observed in that configuration, not a certification of a vendor or of the business.
For deletion evidence, decide what the log itself should retain. An account identifier, task reference, scope, outcome and time may be enough to explain the operation; copying the deleted personal data into the log would defeat the purpose. Restrict access, assign a retention rule for the evidence and verify that a failed task remains visible until it is resolved or covered by a reasoned exception.