Denmark Healthcare GDPR: Datatilsynet 2024 Enforcement
Denmark's Datatilsynet issued 31 GDPR cases in 2024. Fourteen of them — 45% — involved medical systems. Denmark has 5.9 million people. That share is very high. It shows how far the country has gone with digital health. It also shows how strict the rules are.
Denmark's Health System
Every Danish person has a CPR number. That number ties to their patient record, the drug registry, the hospital log, and tissue samples at Statens Serum Institut. The hospital log goes back to 1977.
This system makes Danish medical research some of the best in the world. It also means patient files are very sensitive. That is why Datatilsynet has focused so much on this area.
The CPR Number Problem
The CPR number is a 10-digit ID. Its form is DDMMYY-XXXX. The last digit is a check digit. It works by modulus-11 math.
CPR numbers show up in every clinical file. They link to care, tax, bank, and voting records.
Datatilsynet says you must check your de-identification work before you use patient records for any new purpose. But 67% of common NLP tools skip the modulus-11 step for CPR numbers. When they skip it, two things go wrong.
False hits: Date strings, bill numbers, and reference codes get marked as real CPR numbers. This leads to costly manual checks.
Missed IDs: CPR numbers with swapped digits fail the check. So real patient IDs slip past. The output looks clean but is not.
See our EU national ID detection guide for how check-digit rules work for other EU ID types.
Four Rules for Reusing Patient Records
Denmark's medical registries help fund top research. Datatilsynet's 2024 guidance on reuse sets four rules.
Write down what you did: List every field you removed or changed. Note how you rounded or grouped values. A short policy note does not meet this bar.
Show your test results: Prove that your tool found CPR numbers and other Danish IDs. A claim is not proof.
Limit what you take: Do not pull more personal data than your study needs. This rule holds even for pseudonymized sets.
Do a DPIA for AI tools: Any AI tool that processes Danish patient files needs a DPIA. Use Datatilsynet's standard form.
Three Areas of Focus in Copenhagen
Copenhagen's med-tech firms include Leo Pharma, Bavarian Nordic, and many startups. Datatilsynet watches three risk areas.
AI training sets: The authority found firms in 2024 that trained AI models on files with live CPR numbers. None had a valid legal basis.
Transfers abroad: Some firms sent patient files to US cloud vendors for AI work. The authority said SCCs alone are not enough. You also need technical steps — such as encryption with keys held in Europe.
Access logs: Logs must show who read which files and why. Keep them for at least five years.
56% of Danish medical data breaches in 2024 came from poor de-identification. Using CPR-validated tools with Danish-language support cuts out the most common failure.
For more on Nordic enforcement, see our IMY Sweden GDPR anonymization guide.