Danske Bank – €1,340,000 Fine (Denmark, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Danske Bank was fined €1.34 million by the Danish DPA for not having proper policies to delete personal data. The bank couldn't prove it had deleted data it no longer needed, affecting millions of people. This case shows the importance of having clear data deletion policies.
What happened
Danske Bank failed to have policies for deleting personal data in over 400 systems.
Who was affected
Millions of individuals whose personal data was stored without proper deletion policies.
What the authority found
The Danish DPA found that Danske Bank breached GDPR by not deleting personal data it no longer needed.
Why this matters
This case highlights the need for businesses to implement clear data retention and deletion policies. It serves as a reminder that failing to manage personal data properly can lead to significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
No source text retrieved.
Check has limited source evidence — 5 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2020, Danish Bank reported an issue with personal data deletion to the Danish DPA. In its investigation, the DPA discovered that the bank lacked policies and procedures for storage and erasure of personal data in over 400 systems. The bank could not demonstrate that it had manually deleted personal data either. The systems contain the personal data of millions of data subjects. The Danish DPA Datatilsynet held that Danske Bank had breached a fundamental principle of the GDPR, where one is required to delete personal data one no longer needs (likely referring to Article 5(1)(e) GDPR). Due to this, the DPA has filed a police report against Danske Bank and proposed a fine of €1,345,000 (DKK 10 million). The police will investigate the case before a final decision is made in the courts.
Related Enforcement Actions (2)
Other enforcement actions involving Danske Bank in DK
Fine
€1.3M
Details
Fine Date
5 April 2022
Authority
Datatilsynet (Denmark)
Fine Amount
€1,340,000
10,000,000 DKK
GDPRhub ID
gdprhub-4840About this data
Cite as: Cookie Fines. Danske Bank - Denmark (2022). Retrieved from cookiefines.eu
Last updated: