POL-EU-053PolicyEU1234PublicCritical path29 August 2026
Jurisdiction | DK
Denmark
GDPR and the Danish Data Protection Act, Datatilsynet's cloud position, international transfers after Schrems II, MedCom, NIS2 and EU MDR.
What the review turns on
Regulatory themes in this market
- GDPR
- Regulation (EU) 2016/679, with the Article 28 processor terms and the Standard Contractual Clauses Module Two written into the EU/EEA data processing agreement.
- Datatilsynet
- The Danish supervisory authority, and its published position on cloud processing, which is more specific than the GDPR text and is addressed directly.
- Schrems II
- Transfers to India require a transfer impact assessment and supplementary measures. One exists, and DM-3 or DM-4 removes the transfer question altogether.
- MedCom
- Denmark's messaging certification, per standard. Pensieve holds none today and the gate analysis says which standard would be needed for which scope.
- NIS2
- The supply-chain security obligations an essential entity passes to its suppliers. Pensieve publishes a supplier statement rather than answering the same annexe forty times.
- EU MDR
- Rule 11 and MDCG 2019-11 Rev.1: where software becomes a medical device. The boundary statement says which side of it Pensieve sits on, and why.
Bound values
What Pensieve’s paper resolves to in Denmark
These are not descriptions of the contract. They are the values the contract binds to when it is rendered for this market, taken from the same token registry the documents themselves read from, so a clause and this table cannot disagree.
| Field | Value | Why it matters |
|---|---|---|
| Governing law | the laws of Denmark | The law the master agreement is construed under. |
| Courts | the Danish courts | Where a matter goes if arbitration is not used or is set aside. |
| Arbitration seat | Copenhagen, Denmark | The legal seat, which fixes the supervisory court. |
| Arbitration rules | the Rules of the Danish Institute of Arbitration | The procedural rules the reference runs under. |
| Data protection law | the GDPR and the Danish Data Protection Act | The statute the processing agreement is written against. |
| Regulator | Datatilsynet | Who the hospital, as controller or fiduciary, reports to. |
| Breach notification | 72 hours | The controller's statutory clock. Pensieve notifies the hospital inside 4 hours of its own awareness, in every market. |
| Currency | DKK | The currency the order form and every invoice are denominated in. |
| Tax | MOMS | The indirect tax that appears on the invoice. |
| Standard rate | 25% | Applied unless an exemption or reverse charge is evidenced. |
| Invoice format | OIOUBL via NemHandel / Peppol | The format the hospital's accounts payable system will accept. |
| Document language | da-DK | The language documents are issued in for this market. |
| Stamp duty | Not applicable | Whether execution attracts duty, which, where it does, sits directly on the critical path to cash. |
0 artefacts | jurisdiction DK
Written for Denmark, not translated into it
No Denmark artefact is visible at your access level.
The global set below applies in this market in full, and it is public.
1 artefact | EU / EEA
The EU/EEA set also applies here
Denmark sits inside the EU/EEA regime, so the GDPR variants govern alongside the national layer above. Where the two differ on a Denmark question, the Denmark document governs and says so on its face.
18 artefacts | jurisdiction GL
The global set, which applies in Denmark too
Most of the register carries no jurisdiction because it carries all of them: how the platform is built, how it is defended, how data leaves at the end. Every market page sits on top of these. The eight below are the ones a hospital’s reviewers open first.
WPR-GL-001WhitepaperGL1234NDACritical path31 July 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
WPR-GL-002DisclosureGL1234NDACritical path01 August 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
WPR-GL-004WhitepaperGL1234NDACritical path31 July 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
WPR-GL-005WhitepaperGL1234PublicCritical pathReview due29 August 2026
DPA-GL-001ContractGL1234NDACritical path29 August 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
SLA-GL-001ContractGL1234NDACritical path29 August 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
DIS-GL-009DisclosureGL1234NDACritical pathReview due29 August 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
WPR-GL-400WhitepaperGL1234NDACritical path31 July 2026
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
Open the whole global setWhat Pensieve holds, and what it does notWhich deployment model suits this market