Denmark software delivery: GDPR enforcement, MitID, NemHandel and digital bookkeeping

OutsourcingVN is operated by Netbase JSC, so treat this guide as coming from an interested supplier rather than a neutral adviser. It lays out the Danish and EU rules a release has to clear, states what Netbase can evidence about its own delivery practice, and keeps the two apart. The guides index lists every other market guide, and the market index compares the first blocking question each one raises.

Contents

• Who enforces data protection for a Denmark-facing product?
• What can Netbase evidence for a Danish brief?
• Which requirement sits with which decision owner?
• Which steps come before a Denmark-facing launch?
• Worked scenario: a Danish public buyer expects a NemHandel invoice
• What has Netbase built that is relevant to a Danish brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

Who enforces data protection for a Denmark-facing product?

GDPR applies directly across the European Union, and Denmark's national supervisory authority is Datatilsynet, the independent authority that supervises compliance with the rules on the protection of personal data. Datatilsynet provides guidance and advice, handles complaints from individuals, carries out inspections, and runs a dedicated channel for organisations to report a breach. A controller must have a lawful basis for each use of personal data, honour access, correction, erasure and other subject-rights requests, and notify Datatilsynet of a qualifying breach without undue delay and, where feasible, within 72 hours of becoming aware of it.

None of that changes because the development team sits outside Denmark. What changes is who signs the processing agreement, who is named controller or processor, and who answers Datatilsynet's questions if a Danish user complains. A buyer should settle those three roles before discovery starts, not after a defect surfaces.

What can Netbase evidence for a Danish brief?

Procurement, security and data protection reviewers tend to ask for the same four statements. These are the ones Netbase can give.

• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. Deciding how GDPR applies to your own product, and who your Danish data protection contact is, remains your organisation's task.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement naming Datatilsynet as the competent authority sits on top of this baseline for a Danish-facing system.
• Information security management. Netbase JSC holds ISO 27001 certification for information security management. That certification sits at the company level, covering how Netbase itself runs information security, and is never read as extending to a client's own product or hosting setup in Denmark.
• Markets, language and hours. Netbase serves clients in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Delivery communication is in English, with Danish copy review owned by a reviewer the buyer names once interfaces or contracts need Danish copy. The Hanoi head office runs Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), which overlaps the Danish morning.

Which requirement sits with which decision owner?

Five different roles inside a typical buyer end up owning one piece of a Danish brief, so a supplier who collapses them into one compliance paragraph is easy to read and hard to verify later.

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Worked scenario: a Danish public buyer expects a NemHandel invoice

A software vendor wins a contract with a Danish municipal department and has to invoice it through NemHandel rather than by email.

A proposal that cannot describe step 4, specifically what happens when NemHandel rejects a submitted invoice, has not yet scoped Danish public-sector billing for this product.

What has Netbase built that is relevant to a Danish brief?

The closest published example relevant to Denmark is Netbase's web-to-print engineering in another EU market, the Netherlands: one of the web-to-print stores with online design tools Netbase built for print businesses in Singapore, France, the Netherlands (interior and furnishing panels) and South Korea; the four-country web-to-print record has the detail. Separately, Netbase JSC's Clutch profile carries client reviews from businesses in Romania, Spain, Sweden, France, Denmark, the Netherlands and Belgium, published between October 2020 and June 2021.

Which questions should you ask a supplier?

• Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract, not during a breach.
• What exactly does your security and compliance statement cover? A precise answer says what it does not cover as well as what it does.
• Can you show a NemHandel invoice your platform has actually submitted? Ask for the structure, not just a claim that the connection exists.
• Who decides whether our product counts as a digital bookkeeping system under the Act? Your own accountant or auditor should confirm the scope before the build is designed around it.
• Who holds the MitID integration relationship? It usually sits with your organisation, with the supplier building inside the access you grant.
• Who owns the Danish copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.

What usually goes wrong?

• Compliance copied from a company page straight into a proposal. Signal: no one has actually tested this product's data flows, access rules or breach-response plan. Owner: the data protection lead, who should ask for product-specific evidence rather than a restated policy.
• MitID added after sign-in is already built around another method. Signal: a late, disruptive change to the identity flow. Owner: the product owner, scoping it at discovery.
• NemHandel treated as an email attachment problem. Signal: invoices to a public buyer bounce because they never reach the registered access point. Owner: the finance systems owner.
• The Bookkeeping Act's reach assessed only for the buyer's own accounting software, not for the product being built. Signal: a feature that records transactions is shipped without checking whether it is itself a digital bookkeeping system under the Act. Owner: the finance systems owner, checked at discovery.

How this guide is sourced and where it stops

This guide draws on Datatilsynet's own description of its supervisory role, the European Commission's eInvoicing country sheet for Denmark, the Danish Agency for Digital Government's description of MitID, the Danish Business Authority's guidance on the Bookkeeping Act's digital bookkeeping timeline, and the European Commission's Your Europe business page on GDPR, all checked on 2026-10-17, together with company statements and delivery and review evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Denmark-facing brief. It does not decide whether a specific product counts as a digital bookkeeping system under the Act; your own advisers confirm that.

Plan the first release

Bring your data protection role split, your MitID scope, your NemHandel connection and your Bookkeeping Act assessment. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed for a European working day. For neighbouring markets, the Sweden guide covers BankID and Swish under the same Nordic EU law base, the Germany guide covers works-council consultation and German e-invoicing formats, the Netherlands guide covers Peppol e-invoicing and Dutch payment habits, and the Romania guide covers RO e-Factura and ANSPDCP's GDPR enforcement.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Denmark-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions

Sources

• Datatilsynet, About Datatilsynet
• European Commission, Denmark eInvoicing Country Sheet 2025
• Danish Agency for Digital Government, MitID
• Danish Business Authority (Erhvervsstyrelsen), Bogføring
• European Commission, Your Europe: data protection (GDPR) for business
• European Commission, Web accessibility