persondatalovgivning

Persondatalovgivning refers to the legal framework that governs the processing of personal data to protect individuals’ privacy and regulate how organizations collect, store, use, share, and delete personal information. In the European Union, the core framework is the General Data Protection Regulation (GDPR), which member states implement through national legislation. In Denmark, this is complemented by the Danish Data Protection Act and related regulations to align national rules with GDPR requirements.

Key principles of persondatalovgivning include lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Data controllers determine the purposes and means of processing data, while data processors act on behalf of controllers. Data subjects have rights such as access to their data, correction, erasure (the right to be forgotten), restriction of processing, data portability, objection, and rights related to automated decision-making.

Legal bases for processing personal data include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, tasks carried out in the public interest, and legitimate interests of the controller, balanced against privacy rights. Transfers of personal data to third countries require appropriate safeguards or an adequacy decision.

Enforcement is conducted by the national supervisory authority; in Denmark this is Datatilsynet, which provides guidance, monitors compliance, and can impose penalties for violations. The regulatory framework affects many sectors, including employment, healthcare, finance, marketing, and digital services, and applies to both public and private bodies. Ongoing developments address technologies such as profiling, biometrics, and cross-border data flows.