Denmark Healthcare GDPR: Datatilsynet 2024 Enforcement
Denmark's Datatilsynet issued 31 GDPR cases in 2024. Fourteen of them — 45% — involved medical systems. Denmark has 5.9 million people. That share is very high. It shows how far the country has gone with digital health. It also shows how strict the rules are.
Denmark's Health System
Every Danish person has a CPR number. That number ties to their patient record, the drug registry, the hospital log, and tissue samples at Statens Serum Institut. The hospital log goes back to 1977.
This system makes Danish medical research some of the best in the world. It also means patient files are very sensitive. That is why Datatilsynet has focused so much on this area.
The CPR Number Problem
The CPR number is a 10-digit ID. Its form is DDMMYY-XXXX. The last digit is a check digit. It works by modulus-11 math.
CPR numbers show up in every clinical file. They link to care, tax, bank, and voting records.
Datatilsynet says you must check your de-identification work before you use patient records for any new purpose. But 67% of common NLP tools skip the modulus-11 step for CPR numbers. When they skip it, two things go wrong.
False hits: Date strings, bill numbers, and reference codes get marked as real CPR numbers. This leads to costly manual checks.
Missed IDs: CPR numbers with swapped digits fail the check. So real patient IDs slip past. The output looks clean but is not.
See our EU national ID detection guide for how check-digit rules work for other EU ID types.
Four Rules for Reusing Patient Records
Denmark's medical registries help fund top research. Datatilsynet's 2024 guidance on reuse sets four rules.
Write down what you did: List every field you removed or changed. Note how you rounded or grouped values. A short policy note does not meet this bar.
Show your test results: Prove that your tool found CPR numbers and other Danish IDs. A claim is not proof.
Limit what you take: Do not pull more personal data than your study needs. This rule holds even for pseudonymized sets.
Do a DPIA for AI tools: Any AI tool that processes Danish patient files needs a DPIA. Use Datatilsynet's standard form.
Three Areas of Focus in Copenhagen
Copenhagen's med-tech firms include Leo Pharma, Bavarian Nordic, and many startups. Datatilsynet watches three risk areas.
AI training sets: The authority found firms in 2024 that trained AI models on files with live CPR numbers. None had a valid legal basis.
Transfers abroad: Some firms sent patient files to US cloud vendors for AI work. The authority said SCCs alone are not enough. You also need technical steps — such as encryption with keys held in Europe.
Access logs: Logs must show who read which files and why. Keep them for at least five years.
56% of Danish medical data breaches in 2024 came from poor de-identification. Using CPR-validated tools with Danish-language support cuts out the most common failure.
For more on Nordic enforcement, see our IMY Sweden GDPR anonymization guide.
When This Approach Has Limits
Validating CPR numbers with the modulus-11 check that 67% of NLP tools skip is the right foundation for Danish health data — but limits remain worth stating plainly.
Detection accuracy bounds the result. The modulus-11 check reduces false hits and catches transposed digits, but it operates only on strings a tool already flagged as candidate CPR numbers. In clinical free text, CPR numbers appear inconsistently, alongside dates and reference codes in the same DDMMYY shape, and a residual false-negative rate remains. A clean-looking output is not proof that every patient identifier was removed. Datatilsynet itself requires you to verify de-identification before reusing records, so test against held-out Danish clinical documents rather than trusting the checksum step alone.
Removing the CPR does not anonymize a patient file. Danish health records carry rich quasi-identifiers: rare diagnoses, admission dates, hospital unit, and small-municipality residence can re-identify an individual even after the CPR is gone. A file in that state is pseudonymized, not anonymized, and stays special-category data under Article 9 with full GDPR obligations. Datatilsynet's reuse rules demand data minimization and documented field-level changes precisely because direct-identifier removal is not sufficient on its own.
The tool supports compliance but does not constitute it. Datatilsynet audits the organization's whole posture for secondary health-data use: a written record of every field altered, test evidence, a DPIA on its standard form for AI tools, transfer safeguards beyond SCCs, and five years of access logs. CPR detection contributes evidence to that file but cannot supply the DPIA, the legal basis, or the audit trail. Human and legal review remain required, because the DPA assesses the entire research and processing arrangement, not a single de-identification pass.