- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Danske Bank – €1,300,000 Fine (Denmark, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Danske Bank was fined EUR 1.3 million for failing to manage personal data deletion properly. The bank could not prove it had rules for deleting data in over 400 systems. This case shows that companies must document their data management practices to comply with regulations.
What happened
Danske Bank failed to document its rules for deleting personal data across more than 400 systems.
Who was affected
Individuals whose personal data was stored in the bank's systems.
What the authority found
The Danish Data Protection Authority ruled that Danske Bank breached its accountability obligations under GDPR by not having proper documentation.
Why this matters
This case highlights the need for businesses to maintain clear data management policies. Companies must ensure they can demonstrate compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 5 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Danish DPA has imposed a fine of EUR 1.3 million on Danske Bank. The DPA had opened an investigation against the bank after it informed the DPA that it had a problem with the deletion of personal data. During the investigation, the DPA found that the bank had failed to document the rules for deletion and storage of personal data in more than 400 systems. Consequently, the bank was unable to prove that such rules, which are required under the GDPR, existed. The DPA considered this to be a breach of the bank's accountability obligation under Art. 5 (2) GDPR.
Related Enforcement Actions (1)
Other enforcement actions involving Danske Bank in DK
Details
Fine Date
5 April 2022
Authority
Datatilsynet (Denmark)
Fine Amount
€1,300,000
Enforcement Tracker ID
ETid-1114
About this data
Cite as: Cookie Fines. Danske Bank - Denmark (2022). Retrieved from cookiefines.eu
Last updated: