The largest GDPR fine upheld by a Danish court is DKK 1.5 million. It was imposed by the High Court in September 2025 on a retail chain that had kept information about former customers for too long. At the other end of the scale are fines and recommended fines of DKK 50,000 to 250,000 for smaller companies.
The ceiling is far higher. Under Article 83 of the GDPR, a fine can reach EUR 20 million or 4 percent of global annual turnover, whichever is higher. This article goes through how the system works in Denmark, what the cases have been about, and how often an employee’s mistake is the starting point.
How a GDPR fine is set in Denmark
In most EU countries, the supervisory authority issues fines itself. Denmark has chosen a different model. The Danish Data Protection Agency (Datatilsynet) investigates the case, reports it to the police and recommends a fine. The prosecution service then brings the case, and the courts decide whether a fine is to be paid and how much.
There are therefore two kinds of figures, and they are often mixed up in coverage: the amount the agency has recommended, and the amount a court has imposed.
The regulation works with two levels:
- up to EUR 10 million or 2 percent of global annual turnover for, among other things, inadequate security, missing data processing agreements and failure to report breaches
- up to EUR 20 million or 4 percent for violations of the basic principles, data subjects’ rights and the rules on transfers to countries outside the EU
The agency has described its calculation model in its guidance on fines for companies (in Danish). It starts from the nature of the violation and the company’s turnover and adjusts for aggravating and mitigating factors, including whether the violation was intentional, how many people were affected and whether the company cooperated.
The cases that have shaped the level of fines
The agency keeps its own overview of fine cases (in Danish), divided into decided and pending cases. The table shows a selection without names.
| Type of organisation | What went wrong | Recommended by the agency | Outcome |
|---|---|---|---|
| Retail chain | Information about several hundred thousand former customers sat in an older system without deletion | DKK 1.5 million | DKK 100,000 in the district court in 2021, raised to DKK 1.5 million in the High Court in 2025 |
| Transport company | Customer data was kept longer than necessary | DKK 1.2 million | DKK 100,000 in the district court, raised to DKK 250,000 in the High Court in 2025 |
| IT supplier | Security in a public digital solution | At least DKK 15 million | Pending. The largest recommendation to date |
| Private healthcare company | Security around health information | At least DKK 1.5 million | Pending |
| Advisory firm | Inadequate security for access to IT systems | DKK 500,000 | Pending |
The retail chain case is the most important. The district court found the violation negligent and based the fine on the company’s own turnover. The High Court referred the question to the Court of Justice of the EU, which ruled in February 2025 that the fine has to be calculated on the basis of the whole group’s turnover. The High Court then found the violation intentional and followed the agency’s recommendation. The Danish Chamber of Commerce has published a review of the ruling (in Danish).
For several years, the district courts cut the agency’s recommendations sharply. The two High Court rulings from 2025 point in the opposite direction, and for companies in larger groups, group turnover can raise the level considerably.
What triggers a fine?
Looking at the cases as a whole, four types of violation keep recurring.
Failure to delete. Both High Court cases were about information that stayed after the purpose was gone. Neither case began with a leak. They began with an inspection.
Inadequate security. Systems where the information was not protected well enough against access by unauthorised people.
Unintentional disclosure. Information that ends up with the wrong people because a file, an email or a storage device is shared by mistake.
Data subjects’ rights. Companies that do not respond when a person asks for access to their information.
How often is it an employee’s mistake?
The Danish Data Protection Agency received 9,849 personal data breach notifications in 2025, and the agency writes in its guide to the 10 typical breaches that most concern unintentional sharing of personal data with the wrong recipients. That type of breach usually begins with a single employee: a misdirected email, the wrong attachment, a link shared too widely.
By far most of those notifications end without a fine. The agency most often responds with criticism or an order. When a human error does lead to a recommended fine, the error itself is rarely what is emphasised. What is emphasised is that the company had not done enough to prevent it: no guidelines, no technical safeguards, no training.
Individual employees can be penalised too. The agency has separate guidance on fines for individuals (in Danish), which among other things covers employees who look people up in registers without a work-related reason.
The fine is rarely the whole bill
A breach costs money even when no fine follows. Hours go into investigating the incident, reporting it within 72 hours, informing those affected and answering enquiries. Customers and partners ask questions. The agency’s decisions are published with the company’s name, including when they end in criticism.
What can you do?
The cases point to a fairly short list:
- Set retention periods and check that deletion happens. This applies especially to old systems that are no longer in active use.
- Carry out a risk assessment and document it. We have written a step-by-step guide to GDPR risk assessment.
- Have a fixed procedure for access requests, so they do not get stuck in an inbox.
- Train employees and keep the documentation. When the agency assesses a case, it looks at which organisational measures were in place, and documented training is one of them.
The last point is what we work with at Grape. Our GDPR training is developed together with specialists in data protection law and the scenarios can be adapted to your organisation, so employees practise the situations where mistakes typically happen in your business. If you want to know more about the Danish framework, we have gathered it in the article on GDPR in Denmark.
