GDPR for Employees (GDPR for medarbejdere)

The Regulation requires the controller to implement appropriate technical and organisational measures, and requires that people who process data under the employer's authority do so only on instructions (Articles 24, 29 and 32). The law does not mention a specific course or certificate. Training employees is a common way of meeting the requirements.

No. It is a certificate showing that you have completed the course and passed the test. It is not a regulated qualification, and the course is not approved, certified or accredited by the Danish Data Protection Agency (Datatilsynet) or any other authority. It is up to the employer to decide whether the course covers the company's needs.

The employer is the controller and must have its own policies and instructions for your job and your systems, keep a record of processing activities where required, conclude data processing agreements, carry out risk assessments and security measures, have procedures for breaches and for requests from data subjects, and appoint a data protection officer where the rules require one. Employees in, for example, HR, health, social services or marketing also need training in the systems and tasks they work with themselves. A general course cannot take over that responsibility.

The General Data Protection Regulation (EU 2016/679) and the Danish Data Protection Act (databeskyttelsesloven, Act no. 502 of 23 May 2018, as amended), including the principles, lawful bases, special category data, the CPR number (§ 11), the rights of data subjects, security and phishing, personal data breaches and sanctions. The rules may change. Read more at the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

No. In Denmark Datatilsynet cannot impose fines itself. It can issue orders and bans and refer a case to the police, after which the prosecution service and the courts decide whether to punish (Data Protection Act § 41). In simple cases the Agency can offer a fine notice (bødeforelæg), which the person can choose to accept (§ 42). The course explains this in the last lesson.

The course covers the rules that apply to all workplaces. Some sectors have special rules, for example health care, schools, municipalities and financial companies. Ask your manager which special rules and systems apply where you work.

Most people spend about an hour on the eight lessons and the test of 25 questions. You can take a break and continue later on the same device.

It costs nothing. You can see which lessons you should read again, and you can take the test as many times as you like.

Only after you have passed: 249 DKK for the certificate. The course and the test are free.

Every certificate has a number and a QR code. When someone scans the code or types the number on our verification page, your name, the course and the date you passed are shown.

No law sets an expiry date for this kind of training. It is common practice to refresh it at regular intervals, and the rules change. The certificate therefore shows a renewal date 24 months after you passed. Ask your employer what is required where you work.