Firms To Watch: Data privacy and data protection

Data privacy and data protection in Denmark

Hopp & Partners Advokatpartnerselskab

Hopp & Partners Advokatpartnerselskab is a boutique firm home to a well-experienced team of data protection and privacy specialists advising on a full scope of GDPR, DORA and AI Act matters. The firm is jointly led by Michael Hopp, Peter Østerby Mønsted, Frederik Lindboe Refsgaard, Jesper Husmer Vang and David Knobel.

Principaux dossiers


Bech-Bruun

Bech-Bruun covers the full array of data protection issues, particularly noted for its GDPR expertise and cybersecurity incident response. The team frequently advises its well-established client base, which includes global corporations, Danish businesses, and public bodies. The practice is spearheaded by Mikkel Friis Rossa, who excels in contesting fines imposed by authorities and navigating complex international data transfers. Egil Husum advises public authorities and private enterprises on a wide array of GDPR and integration of technology matters. Nilas Monberg is equipped to handle all aspects of data protection, including data security, personal data mapping, security breach management and risk assessments.

Responsables de la pratique:

Mikkel Friis Rossa


Autres avocats clés:

Egil Husum; Nilas Monberg; Kasper Bilde Nielsen; Cecilie Frey Dreisler


Les références

‘With a law firm of this calibre, one would expect the professional expertise to be top-notch – and it certainly is. What makes it truly unique, however, is that most of the team possesses an outstanding ability to build relationships and show immense approachability. As a client, you sense a genuine team spirit, which shines through not only in the advice they provide but also in networking meetings and other interactions. It is a real pleasure to witness this.’

‘Bech-Bruun’s data privacy and data protection team stands out for its exceptional depth of expertise, clear commercial approach, and consistent ability to translate complex regulation into practical guidance. Bech-Bruun delivers tailored solutions that balance regulatory requirements with clients’ operational realities.’

‘The team is particularly strong in cross-border matters, ensuring seamless navigation of GDPR and other international frameworks. Their collaboration across departments is a genuine differentiator, as it allows for holistic advice that addresses privacy issues in a wider business context.’

Principaux clients

Jyske Bank


Tivoli


Pandora


Mercedes-Benz


IMPACT


NRGi


Arp-Hansen Hotel Group


DSV Group


T. Hansen Group


Kamstrup


Lessor Group


L’Oréal


CNA Hardy Denmark


LEO Pharma


ALK Abelló


One.com


Kereby


AllUnite


The Danish Cancer Society


ROCKWOOL


Bang & Olufsen


Save the Children


Principaux dossiers


  • Assisting Bang & Olufsen with a large project focusing on new digital legislation, covering all aspects of the GDPR and focusing on the synergies between the GDPR and new digital legislation.
  • Representing the Southern Region of Denmark in a GDPR case concerning non-compliance with Article 32 of the GDPR.
  • Representing ILVA A/S, a Danish chain of furniture stores part of Lars Larsen Group, in a matter regarding the interpretation of Article 5(1)(e) of the GDPR.

Gorrissen Federspiel

Gorrissen Federspiel is noted for its capabilities in handling complex data protection, cybersecurity, digital transformation and regulatory work, including large-scale GDPR compliance projects, cross-border data transfers, implementation projects and novel AI data privacy issues. The practice is jointly led by data privacy and protection specialist Tue Goldschmieding, advising on digital transformations, complex outsourcing and IT transactions, and David Telyas, excelling in marketing, consumer and cookie law relating to websites, apps and software solutions. Max Gersvang Sørensen advises Danish and multinational companies, reputed for his marketing, adtech and GDPR expertise.

Responsables de la pratique:

Tue Goldschmieding; David Telyas


Autres avocats clés:

Max Gersvang Sørensen


Les références

‘I have had the great pleasure of working with Max Gersvang Sørensen on several occasions. More than once, he has been an invaluable partner in handling complex data protection matters. Max has a remarkable ability to navigate the intricate landscape of overlapping laws, regulations, and directives governing personal data, and he distinguishes himself by communicating his advice in a clear and accessible way, even to non-specialists. I consider Max to be an exceptionally talented professional.’

‘Professional, available, and exhibits a thorough business understanding, which enables the team to provide clear, actionable, and pragmatic advice based on the reality in which the business finds itself. This makes it easy for the business to navigate and ensure compliance. Highly recommendable.’

‘I have worked with Tue Goldschmieding for many years, and he remains my go-to external lawyer for advice and support on data privacy and data protection. Tue consistently exhibits a complete and deep understanding of the law and how it impacts businesses, and what actions to take. He excels at presenting pragmatic and reasonable approaches to complex problems, which makes him a credible and very trustworthy collaboration partner.’

Principaux clients

A.P. Møller A/S


NNE A/S


Novo Nordisk A/S


Danmarks Eksport- og Investeringsfond


Vestas Wind Systems A/S


Rambøll Group


Aller A/S


FOSS A/S


Schibsted Denmark ApS


Principaux dossiers


Kromann Reumert

Kromann Reumert maintains a strong position in the market for its expertise advising on the full spectrum of data protection, and GDPR matters in highly regulated sectors including financial, pharma and energy. The team frequently assist with international data transfers, security breaches, risk assessments, and internal investigations. Pia Kirstine Voldmester spearheads the practice with over two decades of experience, reputed for her capabilities in GDPR and all aspects of personal data regulation. Birgitte Toxværd‘s expertise spans from individual processing assignments to large compliance projects, with significant experience in the financial, media and pharma sectors. Daiga Grunte-Sonne specialises in data protection matters intersecting marketing and consumer law.

Responsables de la pratique:

Pia Kirstine Voldmester


Autres avocats clés:

Birgitte Toxværd; Daiga Grunte-Sonne; Sara Goul Ærthøj


Les références

‘Kromann Reumert’s data protection team stands out from other firms due to their ability to combine deep legal expertise with a practical and business-oriented approach. The team not only delivers solid compliance advice but also contributes strategically to our business objectives. Their collaborative approach and understanding of our specific needs make them an invaluable partner, especially when dealing with complex and cross-disciplinary issues within data protection.’

‘The individuals in Kromann Reumert’s data protection team stand out for their exceptional expertise, professionalism, and ability to deliver tailored, practical solutions. Their deep understanding of both legal frameworks and the commercial realities of data protection challenges sets them apart from competitors.’

‘The team’s capabilities are great, and it seems like they are good at collaborating. They are the most capable privacy law firm in Denmark, and their advice is always thought out and specific to their clients’ needs.’

Principaux clients

The Danish Cancer Society


Demant


Danish State Railways


Experian


Pandora


PensionDanmark


The Danish Organisation of General Practitioners


Danish Medical Association


Taxa 4×35


Tryg Forsikring


TV 2 Danmark


Principaux dossiers


  • Acted as defence for the Danish Cancer Society (Kræftens Bekæmpelse) in a case regarding GDPR fines before the courts.
  • Advised Experian on all matters relating to data protection in combination with complex regulations applying to credit information agencies.
  • Advised DSB on a large project regarding GDPR compliance and risk assessments.

Accura Advokatpartnerselskab

Accura Advokatpartnerselskab's wide-ranging practice encompasses full-scope GDPR compliance programmes, risk mapping, regulatory audits and due diligence, frequently assisting highly regulated life sciences, finance and insurance sector clients. Jens Harkov Hansen heads the practice, with nearly two decades of experience specialising in data protection, advising leading banks, financial institutions and insurance companies on GDPR, cybersecurity and transfer impact assessment matters. Dan Ermose is well-versed in complex system acquisition and license agreements, as well as DORA and GDPR guidelines. Rasmus Holm Pederson leverages his background from the data protection unit at the Danish National Police, equipping him to handle all aspects of data protection and cybersecurity intersection law enforcement.

Responsables de la pratique:

Jens Harkov Hansen


Autres avocats clés:

Dan Ermose; Rasmus Holm Pedersen


Les références

‘The team combines deep GDPR expertise with a rare ability to give pragmatic, business-ready advice. They are responsive, collaborative, and operate like an extension of our in-house team. Their international outlook and second-to-none understanding of technology set them apart from other firms, making complex compliance issues manageable and commercially sound.’

‘The practice head, Jens Harkov Hansen, is technically brilliant, pragmatic, and available. He cuts through complexity and provides business-ready solutions faster and more clearly than any other privacy lawyer I’ve ever worked with.’

‘Accura operates with a distinctly professional ethos, clear communication, disciplined execution, and partner-led engagement at critical junctures. The team combines strong legal craftsmanship with solid commercial understanding, enabling advice that is both precise and pragmatic.’

Principaux clients

Scandinavian Airlines System


Lån & Spar Bank


Sparekassen Danmark


Sparekassen Kronjylland


Sydjysk Sparekasse


Sparekassen Thy


Middelfart Sparekasse


The Norwegian Oil Fund


Fiskars Group


Copenhagen Infrastructure Partners


Bank J. Safra Sarasin AG


Moove Group A/S


Paychex Europe Lessor ApS


OrderYOYO A/S


Howden Danmark


Red Barnet


BL – Danmarks Almene Boliger


GF Forsikring


Lærernes Pension


NFIT


IDG Capital


Principaux dossiers


  • Advised Scandinavian Airlines System (SAS) on data protection and cybersecurity matters in relation to the establishment and operation of a virtual captive team, as well as contract negotiations.
  • Advised the Norwegian Oil Fund on assessments regarding contractual cybersecurity measures related to the NIS2 Directive, which was implemented into Danish law in July 2025, during a transaction.
  • Advising a broad group of Danish, Swedish, Norwegian, and Faroese financial institutions on the sale of the data centre SDC to Netcompany A/S.

Bird & Bird Advokatpartnerselskab

Bird & Bird Advokatpartnerselskab is noted for its capabilities advising on cross-border data transfers, with strong credentials in breach investigations and enforcement defence, and sector expertise spanning tech, financial services, healthcare and the public sector. Michael Gorm Madsen spearheads the team with over two and a half decades of experience, well-versed in transformational projects for leading financial institutions and multinational corporations, as well as cross-border compliance programmes. Camilla Bjerning Schack stands out for her work in third-country transfers, including the implementation of adequate safeguards and transfer impact assessments.

Responsables de la pratique:

Michael Gorm Madsen


Autres avocats clés:

Camilla Bjerning Schack


Les références

‘The team has deep subject matter expertise yet takes a very pragmatic approach towards finding solutions to the issues we have faced.’

‘They are subject matter experts, very well versed within their fields, making them credible and ensuring the advice they deliver is timely. The individuals we have worked with have also taken a very pragmatic approach and quickly grasped our needs, tailoring their advice to our request. They have been timely with their advice.’

‘We experience a strong ‘synergistic’ team effort from Bird & Bird, always on their toes, ensuring all perspectives are taken into account.’

Principaux clients

Carlsberg Breweries A/S


WSAudiology


Danish Centre for AI Innovation A/S


Data for Good Foundation


Kombit A/S


Veo Technologies


E-nettet A/S


Milestone Systems A/S


Synsam Group


medico-Abello Nordic A/S


Saxo Bank


Scalepoint Technologies A/S


Nordic InfuCare Danmark


UNEEG medical A/S


Danmarks Miljøportal


Dentsu Danmark A/S


Tempur + Sealy


Danpilot


APC Forsikringsmæglerne A/S


Bofælleskabet Lykke Marie


Danmarks Apotekerforening


Principaux dossiers


  • Advised Carlsberg Breweries A/S on data protection matters, developing GDPR compliance templates and contract guidelines, drafting processor agreements for EU and non-EU markets, delivering multi-jurisdictional training programmes, and providing ongoing advisory support on international data transfers and global compliance requirements.
  • Advised WSAudiology on privacy compliance for innovative hearing aid fitting solutions.
  • Advised Danish Centre for AI Innovation A/S on establishing contractual infrastructure for Denmark’s national AI supercomputer initiative.

DLA Piper Denmark

DLA Piper Denmark is particularly impressive for its specialist knowledge of biometrics regulation, cybersecurity and AI matters. The team frequently act for clients in the tech, public sector and healthcare sectors, assisting with GDPR, DORA, personal data and data breach issues. The practice is spearheaded by Marlene Winther Plas, a specialist in tech-related law advising on a wide array of cloud, AI projects, EU Data Act matters, as well as complex tech contract litigation. Jon Lauritzen combines his experience with employment law when handling HR-related data protection issues.

Responsables de la pratique:

Marlene Winther Plas


Autres avocats clés:

Jon Lauritzen; Martin Hjørlund Nielsen; Christian Wiese Svanberg


Les références

‘Christian Wiese Svanberg is a true subject matter expert with a breadth of knowledge within data privacy, and he also provides top-notch level when it comes to practical guidance. He has a deep understanding of the topic and was part of the negotiations of the GDPR, which gives further nuances to his guidance. He is very approachable and always makes himself available.’

‘DLA Piper Denmark’s data privacy practice stands out for pragmatic, risk-based advice, fast turnaround, and strong cross-border GDPR capability. They blend legal depth with technical fluency and coordinate seamlessly with employment, IP, IT and commercial teams.’

‘Commercially sharp, accessible, calm under time pressure; strong on regulator expectations and practical remediation plans.’

Principaux clients

NIO


Brøndbyernes IF Fodbold


Danish Dental Organisation


People Test Systems


Kirkens Korshær


The Velux Foundation


TM Group


BlueKolding


The City of Copenhagen


FlightLogger


Landsbyggefonden


Sønderborg Forsyning


Kirkens Korshær


Divisionsforeningen


Principaux dossiers


  • Assisting Divisionsforeningen in relation to the processing of personal data in connection with the enforcement of the common regulation on law and order for football stadiums.
  • Assisting the City of Copenhagen in connection with the development of various AI-based services aimed at improving efficiency and quality of documentation for the treatment of citizens with reduced functional capacity.
  • Assisting a private dentist and the Danish Dental Association in a High Court case regarding GDPR brought by a labour union in HK regarding non-material damages.

Poul Schmith

Poul Schmith is noted for advising governmental entities on complex data protection and privacy matters relating to the improvement of Denmark’s digital public infrastructure. The firm is also focusing on the growth of its private sector work, adding pharma companies and online gaming providers to its client roster. The team frequently handles high-profile privacy projects advising on data protection regulations, regulatory frameworks and impact assessments, with capabilities extending to representing personal data cases before the High Court. Jakob Kamby leads the practice with a depth of expertise on the Danish Public Information Act, Danish Data Protection Act and European data protection rules.

Responsables de la pratique:

Jakob Kamby


Autres avocats clés:

Martin Sønnersgaard; Milena Anguelova Krogsgaard


Les références

‘High theoretical level of the legal specialists, good service and ability to connect to our practice. When I reach out to a law firm, it is important that it can deliver legal services at the highest level. You get that here!’

‘Martin Sønnersgaard and Milena Anguelova Krogsgaard have high professionalism and integrity and are very easy to work with. I am impressed by their ability to familiarise themselves with the area my organisation works in and thus their ability to link data protection law with special legislation.’

‘The team combines a deep knowledge of the law and legal state-of-play with a good understanding of technology.’

Principaux clients

The Danish Agency for Public Finance and Management


The Capital Region of Denmark


The Danish Agency for Digital Government


The Danish Prime Minister’s Office


The Capital Region of Denmark


The Danish Agency for ICT and Learning


Frederiksberg Municipality


Principaux dossiers


  • Assisted the Danish Agency for Public Finance and Management with handling the data protection legal issues associated with the use of cloud computing within the Danish state by all state authorities.
  • Assisting the Capital Region of Denmark with data protection legal compliance, including the preparation of a data protection impact assessment, in the research project PHAIR (Pharmacovigilance by Al Real-time Analyses), which explores the possibilities of detecting unwanted effects of medicines more quickly and thereby increasing the quality of treatment with medicines.
  • Assisting the Danish Agency for Digital Government (Digitaliseringsstyrelsen) with the preparation of a new regulatory framework for the Agency’s use of the Nemkonto system, a public payout system that contains information on the accounts of Danish citizens and companies.

Bruun & Hjejle

Bruun & Hjejle provides a comprehensive GDPR and data protection offering, frequently advising on large-scale compliance projects, investigations and regulatory enforcement proceedings, as well as day-to-day cross-border data sharing, outsourcing and cyber incidents. Anna de Vos-Zehngraff leads the practice, regularly advising Danish and international clients on GDPR compliance, M&A transactions and innovative digital projects. Millie Albech excels in regulatory compliance in the telecoms and healthcare sectors.

Responsables de la pratique:

Anna de Vos-Zehngraff


Autres avocats clés:

Mille Albech


Les références

‘Bruun & Hjejle makes a whole team available for direct contact, which is great. We can always count on a response from the team, and not only do they deliver a quick response, but they are also ready in situations that require a hasty response – they always deliver. The team complements each other very well, it seems, which makes it a pleasure to have them as advisors. ’

‘The team is led by Anna de Vos-Zehngraff, who masterfully combines strong professional expertise, solid business acumen, and outstanding interpersonal skills.’

‘Anna de Vos-Zehngraff is the primary advisor of my work area, GDPR compliance, and she stands out because she listens and understands the different challenges that we are faced with and always offers support. She is also an expert that we can rely on, both because of her vast knowledge of data protection and also because of her presence. Her team is also fantastic, competent and available. Everyone is very helpful as well.’

Principaux clients

TV2 Danmark


Danske Bank


Berlingske Media


Auditdata


Nordea Danmark


G.S.V. Materieludlejning


Den Blå Planet


Kirk Kapital


Copenhagen Infrastructure Partners


Copenhagen Infrastructure Service Company


Alm. Brand Group


International Woodland Company


Aktieselskabet Arbejdernes Landsbank


Triple Private Equity Denmark ApS


Telenor


Copenhagen Fintech


Secomea


Autorola


Kirk Kapital


Lavazza Denmark


G.S.V. Materieludlejning


UNICEF Danmark


PKA


Principaux dossiers


  • Advised Aktieselskabet Arbejdernes Landsbank (a major Danish bank) on the acquisition of Pensam Bank A/S, including advice on GDPR and data protection compliance as well as financial regulatory requirements relating to the processing of customer data.
  • Advised Triple Private Equity on the acquisition of the GRC platforms Risma, ComplyCloud and Wired Relations, including advice on GDPR and data protection compliance in relation to the processing of customer and compliance data, as well as on strategic and commercial considerations relating to the overall business case.
  • Advised on the sale of Berlingske Media A/S to the Norwegian media group Amedia, including advice on GDPR and data protection compliance as well as marketing law.

HortenDahl

Bolstered by its recent merger, HortenDahl is equipped to handle all aspects of data protection and privacy, with specialist teams across various sub-disciplines. The firm is also adept in GDPR compliance projects, including international data transfers, data processing agreements and risk assessments. GDPR specialist Anne Baandrup spearheads the firm, equipped to handle all aspects of designing, implementing and maintaining compliance programmes, as well as extensive experience handling personal data breaches. Mads Nygaard Madsen is the name to note for GDPR compliance, personal data breaches, data processing agreements and compliance programs. Tim Krarup Nielsen regularly advises IT, tech companies and research organisations on complex privacy and security matters, including international data transfers and crime, while Frederik Bruhn is well versed in outsourcing, licensing, project and acquisition agreements.

Responsables de la pratique:

Anne Baandrup


Autres avocats clés:

Mads Nygaard Madsen; Tim Krarup Nielsen; Frederik Bruhn


Les références

‘Their ability to mobilise quickly and effectively, assigning the right competencies from the very beginning. This immediate alignment of expertise ensures that clients experience value from day one, no time is lost on onboarding or knowledge gaps. The team’s responsiveness and precision in matching skills to the task at hand is a clear differentiator compared to other firms.’

‘We had the privilege of working with Horton and Anna Baandrup, whose understanding of the regulatory landscape for data protection has been instrumental in navigating a complex challenge. Her insights on regulatory frameworks and operational best practices have helped us make informed decisions quickly and confidently. ’

‘The data privacy team stands out for their deep commercial understanding of complex data protection issues. Unlike other firms that can be overly academic in their advice, Horten is highly pragmatic and solutions-oriented. They quickly grasp our business needs and provide clear, actionable guidance.’

Principaux clients

Energinet


Volkswagen Semler Finans Danmark


Principaux dossiers


  • Advising on data processing agreements, Article 30 Record of Processing Activities (RoPA), Data Processing Impact Assessment (DPIA), privacy policies, and legal basis.

Lund Elmer Sandager

Lund Elmer Sandager provides a comprehensive data protection and privacy offering, and is geared to support on GDPR matters, frequently working in conjunction with the employment team to assist with HR data handling and employee privacy issues. GDPR expert Torsten Hylleberg leads the practice, advising Danish and international clients across the energy, hospitality and automotive sectors on all aspects of Danish data protection law.

Responsables de la pratique:

Torsten Hylleberg


Les références

‘What makes this practice stand out is its combination of deep legal expertise, commercial understanding, and a highly service-oriented approach. One of the key strengths is the team’s flexibility and responsiveness; they are able to step in on short notice and deliver high-quality legal support without compromising on thoroughness or insight. This agility is a major asset, particularly in fast-paced or high-stakes situations.’

‘Clients benefit from easy and direct access to senior partners, ensuring that advice is always both strategic and actionable. The team is very approachable and committed to building close, long-term client relationships, which fosters trust and effective collaboration.’

‘Compared to other firms, this practice stands out for its pragmatic and solution-oriented mindset. Rather than over-complicating matters, they focus on what really matters to the client’s business.’

Principaux clients

Flair Group


Bagu IT


De 5 stjerner


Arthur Hotels Group


Djøf


Justface


Autobranchen Danmark


Toyota Danmark


Toyota Financial Services


FREJA Transport & Logistics


Nextway Softway


Momentum Energy Group


Milestone Systems


Delta Galil Inc.


Viggo Energy


Egmont publishing


DanOffice IT ApS


ParkDepot


WorldManuals


Nordico Supply


Nymølle Stenindustrier


Nordic Leasing Finans


Fact Leasing


Principaux dossiers


  • Advised Toyota Danmark A/S on the preparation and implementation of a comprehensive Record of Processing Activities in accordance with Article 30 of the General Data Protection Regulation.
  • Assisted Nextway Software with drafting and implementing a suite of new Data Processing Agreements to ensure compliance with the General Data Protection Regulation and other applicable data protection laws.
  • Assisted Nordfyns Finans A/S with overall GDPR compliance in providing ongoing GDPR service-as-a-service, including managing annual reviews, sample control, documentation, reporting to the management team on compliance and other applicable data protection laws.

Skau Reipurth

Skau Reipurth has a particular focus on advising unions, NGOs and non-corporate entities on personal data and privacy matters, including GDPR compliance projects, risk analysis and whistleblowing matters. Louise Letman excels in employment and data privacy issues, while Christine Børglum Sørensen is specialised in GDPR and IT. Emil Brockstedt Marburger bolsters the team with his November 2025 arrival, bringing additional expertise in cyber security, data protection and GDPR. Mette Vestergaard Huss left the firm in December 2025.

Autres avocats clés:

Louise Letman; Christine Børglum Sørensen; Emil Brocksted Marburger


Les références

‘The Skau Reipurth data privacy team is unique. The team has an incredible ability to direct me as a client in the right direction by giving me straight-to-the-point answers to my questions. Additionally, the team has a unique commercial focus, where they assess the client’s situation and provide needed advice on subjects that we do not always know are relevant, but that are indeed of importance and oftentimes even critical.’

‘On top of local legislation, combining it with a strong understanding of the business. A talented team with diversified capabilities, with a personal and « down-to-earth » approach.’

Principaux clients

DM


Pack Tech


Pharmadanmark


Femern Link Contractors


Konica Minolta


Mobility Denmark


Ejendom Danmark


Georg Jensen


Resea Projects


B Cool


Dyrenes Beskyttelse


ProIndats


Ase Lønmodtager


Arbejdsløshedskassen Ase


Contura


Luxplus


Initiate


Den Danske Skovforening


Renell


Anders Langballe


Geelmuyden Kiese


Red Barnet Ungdom


Prescriba


Det Danske Spejderkorps


Principaux dossiers