- Enforcing jurisdiction
- Denmark · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Danske Bank – €1,340,000 Fine (Denmark, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Danske Bank faced a proposed fine of EUR 1.34 million for not having proper policies for data storage and deletion. The bank could not show that it deleted personal data when it was no longer needed. This situation stresses the importance of having clear data handling procedures.
What happened
Danske Bank lacked policies for the storage and deletion of personal data in over 400 systems.
Who was affected
Millions of individuals whose personal data was stored in the bank's systems.
What the authority found
The Danish Data Protection Authority found that Danske Bank breached GDPR principles by failing to delete unnecessary personal data.
Why this matters
This case serves as a warning to companies about the necessity of having robust data management practices. Businesses must ensure they comply with data deletion requirements to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
No source text retrieved.
Check has limited source evidence — 5 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In 2020, Danish Bank reported an issue with personal data deletion to the Danish DPA. In its investigation, the DPA discovered that the bank lacked policies and procedures for storage and erasure of personal data in over 400 systems. The bank could not demonstrate that it had manually deleted personal data either. The systems contain the personal data of millions of data subjects. The Danish DPA Datatilsynet held that Danske Bank had breached a fundamental principle of the GDPR, where one is required to delete personal data one no longer needs (likely referring to Article 5(1)(e) GDPR). Due to this, the DPA has filed a police report against Danske Bank and proposed a fine of €1,345,000 (DKK 10 million). The police will investigate the case before a final decision is made in the courts.
Related Enforcement Actions (1)
Other enforcement actions involving Danske Bank in DK
Details
Fine Date
5 April 2022
Authority
Datatilsynet (Denmark)
Fine Amount
€1,340,000
10,000,000 DKK
GDPRhub ID
gdprhub-4840About this data
Cite as: Cookie Fines. Danske Bank - Denmark (2022). Retrieved from cookiefines.eu
Last updated: