The General Data Protection Regulation (GDPR) has become mandatory for existing companies and for investors who wish to open a company in Denmark after the regulation has entered into force. The regulation is a harmonization of the data protection rules across Europe and is intended to allow for new rights to subjects. 

GDPR compliance in Denmark

1. The information as personal data: the information collected by the company first needs to be classified as a personal one; any types of details that can be used to identify a subject/natural person are included in this category.
2. Determine the personal data category: the GDPR rules establish two types of personal data, common personal ones, and sensitive ones; the company needs to determine which category it will process or if it will handle both.
3. The type of processing: the actual processing of the data should be made lawfully, meaning that the subject should have consented to the collecting, record, storage, usage, and transmission as well as the restriction or destruction of the data, as need be.
4. Consent: does the company provide for the lawful manner in which the subject can express his or her consent? Is the information well structures, transparent and unambiguous?

The rights of the individuals under the GDPR