Digitaliseringsstyrelsen (Danish Agency for Digitalisation) – Violation Found (Denmark, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Danish Agency for Digitalization faced scrutiny after multiple data breaches occurred in its new digital post system. This is significant because it shows that even government agencies can struggle with data security. Organizations should learn from these mistakes to improve their own data protection efforts.
What happened
The Danish Agency for Digitalization reported several data breaches due to technical errors in its new digital post system.
Who was affected
Users of the digital post system, including citizens and companies, were affected by the breaches.
What the authority found
Datatilsynet found that the agency's technical implementation led to multiple security failures, but no fines were issued.
Why this matters
This case underscores the need for thorough testing and security measures in digital systems. Organizations should prioritize data security to prevent similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 11 April 2026.
Processing notes: authority corrected, scope corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2022 Denmark replaced it digital post system with a new system, the Next Generation Digital Post (Næste generations Digital Post). The system was operated by the Danish Agency for Digitalization (Digitaliseringsstyrelsen- the controller). The controller notified four data breaches to the DPA between 2022 and 2023. Additionally, the controller admitted a fifth breach in a statement explaining a system update. In 2023 the DPA started an ex officio investigation. It found that all the breaches were caused by technical errors in the system’s implementation: * In March 2022 about 15,000 users were accidentally granted reading right to other people’s mailboxes. The breach was due to a misunderstanding between the providers of the new and old systems during the migration of the database. * In February 2023 a coding error caused the incorrect revocation of reading rights for a small number of users; * Another migration error caused users to lose reading rights. The error affected about 7,000 users with reading rights for a large number of mailboxes; * In November 2022 yet another migration error caused 42,000 citizens to be enrolled by mistakes. This sometimes prevented them from responding to official communication carried out via the digital post system. * Finally, a bug in a 2023 system update resulted in the removal of more than 116,000 natural persons and 1,700 companies from the system and in the accidental enrolment of about 30,000 Greenland residents. The DPA reprimanded the controller for the unsecure processing of personal data, in violation of Article 32(1) GDPR. The DPA emphasized that an official digital post system should be held to high security standards. Such systems process a large amount of data, including sensitive data and the content of communications between authorities. Furthermore, the system carries official communications and the delivery of the communication sometimes has legal value (e.g. when a defendant is notified of a legal proceeding).
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Digitaliseringsstyrelsen (Danish Agency for Digitalisation) in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Digitaliseringsstyrelsen (Danish Agency for Digitalisation) - Denmark (2025). Retrieved from cookiefines.eu
Last updated: