ITER/DKDenmark
What the record establishes for Denmark: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Datatilsynet reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The relevant authority and the CSIRT, both of them, under § 12(1) reported | https://virk.dk/myndigheder/stat/SAMSIK/selvbetjening/Indberetning_af_brud_paa_sikkerhed/checked 2026-09-03 Not set by the act. The Agency for Digital Government states that notifications go «via virk.dk», through the self-service of the Styrelsen for Samfundssikkerhed, and that one submission is forwarded to the sector-responsible authority and the CSIRT. | dk lov 434 2025 · digst haendelsesunderretning |
| Financial supervisorDORA, article 19 | Finanstilsynet reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Finanstilsynet reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Lov nr. 434 af 6. maj 2025 om foranstaltninger til sikring af et højt cybersikkerhedsniveau |
|---|---|
| In force | 1 July 2025, by § 33 |
| Recipient | The relevant authority and the CSIRT, both of them, under § 12(1) |
| Moves a term | No. None. Paragraph 13 keeps every term and every anchor: the early warning «senest inden for 24 timer efter at enheden har fået kendskab til den væsentlige hændelse», the incident notification «inden for 72 timer» on the same footing, an interim report on the CSIRT's request, and the final report «senest 1 måned efter fremsendelsen af den hændelsesunderretning». Trust service providers give the second stage within twenty-four hours. Where the incident is still running when the final report falls due, a status report goes then and the final report within one month of the incident being handled. |
| Standing | Read in the act as published by Retsinformation. Two things it settles that the Directive leaves to the Member State: the report is owed to the competent authority and the CSIRT, not to one of them, and § 13(3) obliges the CSIRT to answer within twenty-four hours of the early warning. The act does not name the channel. |
| Source | dk lov 434 2025 |
An event in Denmark
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.