The Danish Data Protection Agency initiates supervision of companies’ duty to provide information

The Danish Data Protection Agency has just announced a new supervisory initiative that will affect all companies processing personal data about employees and job applicants. The supervision is part of a coordinated European effort launched by the European Data Protection Board (EDPB) and aims to assess how data controllers comply with the rules on the duty to provide information.

Although the duty to provide information is a fundamental part of the GDPR, experience shows that many companies still struggle to provide sufficient and correct information to employees and candidates. The new supervision may therefore have practical consequences for HR processes, recruitment, and internal compliance.

This article gives you an overview of the content of the supervision and explains what your company should be aware of going forward.

Background for the supervision

In 2026, supervisory authorities in the EU/EEA will conduct a joint investigation into how companies comply with transparency requirements in their data processing. As part of this initiative, the Danish Data Protection Agency is participating again and has this year chosen to focus on the duty to provide information to employees and job applicants. This is because HR processes often involve extensive data processing, where the duty to provide information can be difficult to handle consistently.

The supervision covers 30 private companies selected to provide a broad picture of Danish practice. The purpose is to examine how companies inform employees and candidates about their data processing, and where shortcomings typically arise. The investigation will also assess whether the information is provided at the right time, whether it is sufficient and understandable, and whether companies can document that the duty to provide information has actually been fulfilled.

What the Danish Data Protection Agency focuses on

The supervision aims to determine whether companies meet the central requirements of the duty to provide information. This includes whether the information is correct, timely, and understandable, and whether the company can document that the duty has been fulfilled.

The Danish Data Protection Agency will look at whether job applicants receive information when data is collected, and whether employees receive it at the start of employment or when changes occur in the processing. It will also assess whether the information is accessible and formulated in a way that is easy for the target group to understand.

What the supervision means for companies

The supervision is a clear signal that the Danish Data Protection Agency is increasing its focus on transparency in HR processes. Companies should therefore ensure that their duty to provide information is updated, correct, and integrated into daily routines.

It is not enough that the information exists somewhere in the organisation. It must be easy to find, easy to understand, and tailored to the specific situation. Many companies have information sheets that have not been updated in line with changes in systems, processes, or data processing, which can create challenges during supervision.

What you should be aware of going forward

Companies should review their current practices and ensure that the duty to provide information is fulfilled at all relevant times. This applies during recruitment, onboarding, and when changes occur in data processing.

There should also be clear documentation of when and how the duty to provide information has been fulfilled. This may include internal procedures, recruitment flows, or logging of information provided.

Conclusion

The new supervision emphasises that the duty to provide information is a central element of GDPR compliance. Companies should ensure that their practices are updated, documented, and easily accessible to both employees and job applicants.

We recommend that companies implement fixed routines for how the duty to provide information is fulfilled and documented. This is a simple way to minimise the risk of supervisory cases and ensure transparency in HR processes.

Raadgiver is available if you would like a review of your duty to provide information or advice on other data protection matters.

This article does not constitute and cannot replace legal advice. Raadgiver.dk ApS assumes no liability for any damage or loss, directly or indirectly, attributable to the use of the information provided in the article.

Published September 2026