Denmark · Certification
ISO/IEC 27701 certification in Denmark
Achieve ISO 27701 certification in Denmark with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Enschede office team
- Effivity software included
- Academy training included
Who asks for ISO 27701 in Denmark
Clients include
ISO 27701 certification in Denmark at a glance
Accreditation of GDPR certification bodies under the Data Protection Act is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Denmark ask for evidence that you meet it.
No single certificate shows GDPR compliance in Denmark, which is why many processors and controllers look to ISO/IEC 27701 as a structured, auditable privacy management system. Datatilsynet supervises the GDPR and Act No. 502 of 23 May 2018, publishes a catalogue of security measures drawn partly from ISO information security standards, and the Act itself gives it and the national accreditation body powers over GDPR certification bodies. Certification to ISO/IEC 27701 is a separate route, issued by a body accredited by DANAK or an equivalent accreditation body, and it complements rather than replaces records of processing, notices and contracts. Sterling's Enschede office extends an existing ISO/IEC 27001 system with privacy controls, role definitions and processor oversight, with Effivity and Sterling Academy included in the engagement.
Who needs ISO 27701 in Denmark, and what happens without it
In Denmark the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.
- Processors such as SaaS, payroll and hosting providersControllers ask processors for evidence of privacy controls, and Datatilsynet's catalogue of measures shows the safeguards it has in mind.
- Danish controllers wanting an external benchmark for GDPR workThe Act gives Datatilsynet and the accreditation body powers to accredit GDPR certification bodies, but there is no general certificate, so a management-system standard fills the gap.
- Groups that already hold ISO/IEC 27001A privacy extension builds on the existing management system rather than starting a new one.
- Life sciences and health-technology firmsPatient and trial data raise customer expectations on privacy governance.
- Employers with internal reporting channelsWhistleblower reports carry personal data that must be handled under the GDPR.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO/IEC 27701 readiness checkISO 27701 requirements in Denmark
Strip away the vocabulary and ISO/IEC 27701 requires a company to prove six things about how it handles personal data.
In Denmark these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO/IEC 27701 explained →
How to get ISO 27701 certified in Denmark
One team from the Enschede office carries the work from scoping to certificate. Clients in Denmark are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO/IEC 27701 and the Danish requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 27701 certification take in Denmark?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Denmark these are the factors that set the timeline.
- State of ISO/IEC 27001 and the records of processing
- Number of controller and processor roles
- International transfers and processor contracts
- Certification body scheduling
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 27701 certification cost in Denmark?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Denmark these factors move both.
- Processing activities and entities in scope
- Privacy control remediation
- Certification body audit fees, quoted separately
- Integration with an existing ISO/IEC 27001 system
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 27701 consultants and certification bodies in Denmark
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 27701 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Denmark are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 27701 in Denmark (4)
| Instrument | How it treats the standard |
|---|---|
| Datatilsynet catalogue of security measures | Regulator guidance The Authority says its examples draw on its inspections, breach notifications, EDPB guidance and information security requirements highlighted by ISO information security standards, the national cybersecurity centre and the security requirements for state authorities. |
| Accreditation of GDPR certification bodies under the Data Protection Act | The instrument itself The Act gives Datatilsynet and the national accreditation body powers to accredit certification bodies under the GDPR's certification provisions. |
| Act No. 502 of 23 May 2018 supplementing the GDPR (databeskyttelsesloven, the Data Protection Act) | The instrument itself It supplements and implements the GDPR, applies to establishments in Denmark and to non-EU controllers who offer goods or services to people in Denmark or monitor their behaviour there, and entered into force on 25 May 2018. |
| DANAK (Den Danske Akkrediteringsfond) as Denmark's national accreditation body | Recognition DANAK describes itself as the national accreditation body for laboratories, certification bodies, inspection bodies and validation and verification bodies. |
Accreditation, audit language and remote audits in Denmark
Choose a certification body accredited for this standard by DANAK, Denmark's national accreditation body, or by another accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Check that the body's accreditation scope covers the standard and your sector. No body is named here. Edition and transition details: ISO/IEC 27701 hub →
Audit language
Danish is the official language and English is widely used in business. Agree the audit language and the language of controlled documents with the certification body at application, and follow any language requirement in a contract or a regulator's procedure.
Remote and on-site
Audits are normally on-site with document review remote at the certification body's discretion.
ISO 27701 in Denmark: questions clients ask
Does ISO/IEC 27701 prove GDPR compliance in Denmark?
No. Act No. 502 of 23 May 2018 supplements the GDPR and Datatilsynet supervises compliance with both; neither treats an ISO certificate as proof. The standard supplies a structured privacy management system, which helps evidence accountability. Datatilsynet or your counsel decides whether a given practice complies.
Is there an official GDPR certification scheme in Denmark?
The Data Protection Act provides for one: Datatilsynet and the national accreditation body have powers to accredit certification bodies under the GDPR's certification provisions. That is a different route from an ISO/IEC 27701 certificate. Ask Datatilsynet whether any approved scheme covers your processing before treating either as equivalent.
What does Datatilsynet say about security measures?
Its catalogue of measures gives examples of technical and organisational safeguards, built on its inspections, breach notifications, EDPB guidance and information security requirements highlighted by ISO standards and state authorities. The examples show the level it expects without prescribing a list. Use them when drafting the privacy controls an auditor will test.
Who issues an ISO/IEC 27701 certificate to a Danish company?
A certification body holding the right accreditation, from DANAK or an equivalent body. Check that the scope covers privacy information management, since EA records DANAK's management system certification scope in general terms only. Sterling builds the privacy management system around your existing controls and does not certify.
More on ISO 27701 for Danish organisations
Other standards Danish businesses ask Sterling for
Organisations in Denmark often combine ISO/IEC 27701 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Datatilsynet catalogue of security measures — datatilsynet.dk (accessed 11 Oct 2026)
- Accreditation of GDPR certification bodies under the Data Protection Act — datatilsynet.dk; retsinformation.dk (accessed 11 Oct 2026)
- Act No. 502 of 23 May 2018 supplementing the GDPR (databeskyttelsesloven, the Data Protection Act) — datatilsynet.dk; retsinformation.dk (accessed 11 Oct 2026)
- DANAK (Den Danske Akkrediteringsfond) as Denmark's national accreditation body — danak.dk (accessed 11 Oct 2026)
- DANAK (Den Danske Akkrediteringsfond, the Danish Accreditation Fund) — danak.dk; european-accreditation.org; ilac.org (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice