- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Syddanmark Region – €67,200 Fine (Denmark, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Syddanmark Region in Denmark was fined EUR 67,200 for a data breach involving personal information of nearly 4,000 patients. This is important because it shows that organizations must take proper steps to protect sensitive data, especially health information.
What happened
Syddanmark Region was fined EUR 67,200 for failing to protect personal data in a PowerPoint presentation that was publicly accessible.
Who was affected
The personal data of 3,915 patients, including health information and ID card numbers, was affected.
What the authority found
The Danish data protection authority ruled that the region did not implement adequate security measures to protect sensitive personal data, violating GDPR requirements.
Why this matters
This case serves as a warning to organizations about the need for strong data protection measures. Companies should regularly review their security protocols to prevent similar breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish DPA imposed a fine of EUR 67,200 on Syddanmark Region. On March 9, 2020, the DPA received a notification from Syddanmark Region regarding a personal data breach according to Art. 33 GDPR. The Syddanmark Region states that since May 2011, a PowerPoint presentation was available on its website that had been created at Odense University Hospital for training purposes and contained charts with personal data - including health information and ID card number details - of 3,915 patients. The region used a screening tool to periodically check for inadvertent postings of personal identity numbers on its website. However, the screening tool was unable to scan the underlying data in PowerPoint presentations. In this context, the DPA found that the region had not implemented appropriate technical and organizational measures to ensure a level of protection appropriate to the risk. In assessing whether a fine should be imposed, the DPA took into aggravating consideration the fact that Syddanmark Region processes large amounts of personal data, including health data - which is of a sensitive nature.
Related Enforcement Actions (0)
No other enforcement actions found for Syddanmark Region in DK
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
17 September 2021
Authority
Datatilsynet (Denmark)
Fine Amount
€67,200
About this data
Cite as: Cookie Fines. Syddanmark Region - Denmark (2021). Retrieved from cookiefines.eu
Last updated: