Personal data (GDPR)

A company may only process personal data where there is a lawful basis for processing under the GDPR. This may, for example, be necessary to perform a contract, comply with a legal obligation, protect an individual’s vital interests, carry out a task in the public interest, or pursue a legitimate interest.

In certain circumstances, processing may also be based on the data subject’s consent. A company must always be able to demonstrate why personal data is being processed and ensure that the processing is carried out lawfully, fairly, and transparently.

For example, a company will generally act as the data controller in relation to its employee and customer data, while a payroll system, CRM platform, or cloud service provider will often act as a data processor. Clearly defining these roles and responsibilities is essential for ensuring compliance with the GDPR.

The first step is to gain a clear overview of what personal data the company processes, why the data is being processed, and who has access to it. The company should then ensure that the necessary privacy policies, records of processing activities, data processing agreements, and internal procedures are in place.

In addition, the company should continuously focus on information security, the management of data subject rights, and procedures for handling personal data breaches. A structured GDPR review can help identify compliance gaps and ensure that the company meets its obligations under applicable data protection legislation.

Under certain circumstances, you have the right to have your personal data erased under the GDPR. This will typically require that the data is no longer necessary for the purpose for which it was originally collected or that the company no longer has a lawful basis for retaining it.

However, the right to erasure is not absolute. A company or former employer may be required to retain certain information in order to comply with accounting requirements, employment law obligations, or other statutory duties.

If you believe that a company or public authority is processing your personal data in violation of the GDPR, you may submit a complaint to the Danish Data Protection Agency. As a general rule, it is advisable to first contact the data controller to seek clarification and attempt to resolve the issue directly.

A complaint can be submitted through the Danish Data Protection Agency’s website, where you will be required to describe the circumstances of the case and provide any relevant documentation. The Danish Data Protection Agency will then assess whether there are grounds for further investigation of the complaint.

Not necessarily. The GDPR does not automatically prevent a company from disclosing the name of an employee. Whether such information may be disclosed depends on the purpose of the disclosure, the employee’s role, and the specific circumstances of the case.

The names of employees who have customer-facing responsibilities or management roles can often be disclosed as part of the company’s ordinary business operations. Therefore, the GDPR cannot generally be relied upon as a blanket justification for refusing to disclose the name of an employee.

If personal data is shared without a valid legal basis, this may constitute a breach of the GDPR. As a tenant, you have the right to access information about the personal data that is being processed about you and, in certain circumstances, the right to rectification, restriction of processing, or erasure of your personal data.

If you believe that your rights have been violated, you may submit a complaint to the Danish Data Protection Agency.

A company is required to have a data processing agreement whenever an external service provider processes personal data on the company’s behalf. Examples include payroll systems, CRM platforms, cloud service providers, and IT support providers.

A data processing agreement should, among other things, specify the purpose of the processing, the categories of personal data being processed, the applicable security measures, the data processor’s obligations, and the rules governing the use of any sub-processors. The agreement is a legal requirement under the GDPR and serves to ensure that personal data is processed securely and in accordance with the data controller’s instructions.

Where joint controllership exists, the parties must enter into an agreement that clearly defines their respective responsibilities for GDPR compliance. Among other things, the agreement should regulate the handling of data subject rights, transparency obligations, security measures, personal data breaches, and communications with supervisory authorities. A clear allocation of responsibilities is important for minimising the risk of disputes and ensuring compliance with applicable data protection requirements.

When a personal data breach is discovered, the organisation should immediately investigate the incident, take steps to mitigate any harm, and document what has occurred. The organisation must then assess which personal data has been affected, the risks posed to the individuals concerned, and whether there is an obligation to notify the relevant supervisory authority or the affected individuals.

A well-defined incident response plan can be crucial for managing personal data breaches effectively and ensuring compliance with the GDPR.

A personal data breach must be reported to the Danish Data Protection Agency if it is likely to result in a risk to the rights and freedoms of the individuals affected. This may, for example, be the case where personal data has been lost, where unauthorised access to systems has occurred, or where personal data has been compromised as a result of a cyberattack.

As a general rule, the breach must be reported without undue delay and no later than 72 hours after the organisation becomes aware of the incident. Where the breach is likely to result in a high risk to the affected individuals, the organisation may also be required to notify those individuals directly.

It is therefore important to conduct a prompt legal and security assessment of the scope, impact, and potential consequences of the incident in order to determine the appropriate reporting and notification obligations.

When using photographs, companies, associations, and organisations should pay particular attention to whether the images are being used for marketing purposes, social media, or other public-facing activities. Where children are involved, enhanced requirements apply regarding the provision of information and, where necessary, obtaining consent from a parent or legal guardian.

A franchise business should, among other things, have a clear understanding of who acts as the data controller for the various processing activities involving personal data and whether, in certain situations, there is joint controllership between the franchisor and the franchisees.

In addition, the business should ensure that it has compliant privacy policies, data processing agreements, procedures for handling personal data, and processes that comply with the rules governing cookies and electronic marketing. Where websites or applications use non-essential cookies, valid consent must generally be obtained before those cookies are activated.

Establishing clear roles and responsibilities, together with robust data protection procedures, can help reduce compliance risks and ensure that the franchise business meets its obligations under the GDPR and applicable marketing regulations.

In many cases, it will be appropriate to anonymise or pseudonymise responses in order to protect employees’ privacy. The organisation should also ensure that employees are informed about how their personal data will be processed and that the survey is carried out in a manner that promotes trust and maintains the confidentiality of responses.