General information about processing of personal data by the Tax Agency

The Danish Tax Agency (Skattestyrelsen) is part of the Danish Customs and Tax Administration (Skatteforvaltningen). The Customs and Tax Administration is the data controller for the processing of your personal data.

The Customs and Tax Administration comprises the following seven agencies:

Administration and Services Agency of the Danish Ministry of Taxation (Administrations- og Servicestyrelsen)
Danish Debt Collection Agency (Gældsstyrelsen)
Danish Motor Vehicle Agency (Motorstyrelsen)
Danish Tax Agency (Skattestyrelsen)
Danish Customs Agency (Toldstyrelsen)
IT and Development Agency of the Danish Ministry of Taxation (Udviklings - og Forenklingsstyrelsen)
Danish Property Assessment Agency (Vurderingsstyrelsen)

On this page you can find more information about why and how the Tax Agency processes personal data about you or about your personally owned business.

When you see "we", "our" or "us" below, we mean the Tax Agency. If we mean the Customs and Tax Administration or any of its other agencies we write the Customs and Tax Agency.

The Customs and Tax Agency process information required to undertake its tasks.

Its core tasks are assessment and collection of a number of taxes and duties. These include personal, business and corporation taxes, labour market contributions, property taxes, duties, VAT and customs duties. In addition, the Customs and Tax Administration collects debt to public authorities.

Below you can read about the tasks of the Tax Agency and find information about the tasks of the other agencies of the Customs and Tax Administration.

Please note that compilation of information for compliance checks and development of IT systems listed below under Specific tasks of the Tax Agency (and specifically under Compilation).

The task of the Tax Agency is to ensure the timely payment of correct taxes and duties by all citizens and businesses. We undertake this task by making the payment of taxes and duties easy and safe and by having effective compliance checks integrated into every aspect of this task.

You can read more in Danish about our tasks at sktst.dk

We may also perform tasks on behalf of the other agencies under the Customs and Tax Administration. You can read more about these tasks at the end of this section.

Compilation

Compilation means that we gather information from various data across IT systems or registers, for example.

We compile information about you for complicance checks and development of IT systems when required so we can perform our regulatory tasks.

We compile information about you for assessments, billing and charging of taxes and duties and to target our guidance to your needs. When we develop IT systems the compilation is also made by use of artificial intelligence (AI), including machine learning.

The information is compiled with existing information in our IT systems and other sources when legislation allows. Other sources may be information from other public authorities and information accessible by the public.

You can read more about our options for compilation in the section Legal basis for processing.

Filing and data record obligation

As a public authority, the Customs and Tax Administration is subject to the filing and data record obligation under the Danish Access to Public Administration Files Act (Offentlighedsloven). This means that when you contact us by telephone or in writing, we will record the information that is subject to the Customs and Tax Administration’s filing and data record obligation as a public authority in our electronic case and documentation system.

Efficient and methodical case management, including statistics

We process personal information efficiently and methodically in our case management. It includes statistics to illustrate general trends of significance to our regulatory tasks. This also applies to case selection, management reporting and the satisfaction surveys that we perform to improve our case processing, communication and guidance.

The Customs and Tax Administration consists of a total of 7 agencies, including the Tax Agency. Please see the websites of the respective agencies for information on their tasks.

We only process the personal data for which we have a legal and professional processing purpose and which we deem necessary to perform our regulatory tasks.

Here, you can read more about the type of personal data that we may process about you.

General personal data can be both confidential and non-confidential information. Confidential information includes information about you subject to our special duty of confidentiality under section 17 of the Danish Tax Administration Act (Skatteforvaltningsloven).

The types of general personal data that we process may include:

identification details such as name, address, civil registration number or CVR number
financial and business circumstances, including income and assets
family relationships
housing-related matters

In certain situations, we use specific information about your personal relations (including your spouse or partner) and business relations if you have a business. It could be in cases of joint taxation between spouses or registration of obligations of tax and duties when a business is set up.

We handle criminal cases and are authorised to issue administrative fines for breaches of tax and excise legislation. Information concerning administrative fines comprises personal data in the category of “criminal convictions and offences".

We process information about criminal convictions and offences from other public authorities if the information is deemed necessary to support our regulatory tasks. If you or your possible representative has given us this type of information for your case, it will also be processed.

In some cases, we may process sensitive personal data, for example if the information is of significance to your tax assessment. This will typically concern information about:

membership of the Danish National Evangelical Lutheran Church (Folkekirken) (religious beliefs)
trade union membership

If you or your representative has submittes other sensitive personal information for your case, including health details, it will also be processed.

When we process personal data about you or your business, the processing must be based on law (also called a legal basis).

The legal basis depends on such matters as how the personal data we process about you is categorised in the EU’s General Data Protection Regulation (GDPR) and which processing we undertake. In the section Which personal data do we process? you can see which personal data concerning you and your business we may process and how the data is categorised.

In this section you read about the legal basis for our processing.

The processing of your general personal data is based on GDPR, the Danish Data Protection Act (Databeskyttelsesloven) and special legislation. In principle, Article 6(1) (c) and (e) of GDPR is the basis for our processing of your general personal data.

Article 6(1) (c) of GDPR concerns the processing that is necessary for compliance with our legal obligation.

Article 6(1) (e) of GDPR concerns the processing of personal data that is necessary for the performance of a task carried out in the public interest or as an element of the exercise of official authority imposed on the Customs and Tax Administration.

As a public authority, in principle we don't use consent as a legal basis for the processing of personal data. In the special instances where we use consent, you will always be informed specifically in connection with the consent.

The rules on consent as the legal basis for the processing of general personal data can be found in Article 6(1) (a) of GDPR. Consent is always voluntary and can always be withdrawn.

We process your civil registration number in order to uniquely identify you and/or for filing purposes. The basis for this processing is section 11(1) of the Data Protection Act.

When we process sensitive personal data about you, the data will in principle be based on Article 9(2) (f) of GDPR, if the processing is necessary for the establishment, exercise or defence of legal claims.

We also process sensitive personal data about you under section 7(4) of the Danish Data Protection Act when the processing is based on essential societal interests with suitable and specific measures in relation to you as a registered party.

The processing may also be based on Article 9(2) (e) of GDPR if you have clearly published the information yourself and we deem that the information is relevant for your case.

Furthermore, sensitive data will only be processed if such processing is also authorised under Article 6(1) (c) or (e) of GDPR. This means that the processing must either be necessary to fulfil our legal obligation, or necessary for the performance of a task carried out in the public interest or as an element of the exercise of official authority imposed on us.

Furthermore, a number of special acts and executive orders govern our processing of personal data.
This includes:

Danish Tax Administration Act (Skatteforvaltningsloven)
Danish Tax Reporting Act (Skatteindberetningsloven)
Danish Tax Control Act (Skattekontrolloven)

You find applicable acts concerning tax and excise duties in Danish at skat.dk/skattelove.

Furthermore, we also processes personal data on the basis of the provisions of other special legislation, such as the Danish Anti-Money Laundering Act (Hvidvaskloven), the Danish Public Administration Act (Forvaltningsloven) and the Danish Public Records Act (Offentlighedsloven).

Our access to compile information is laid down in chapter 7 of the Danish Tax Control Act.

The rule concerning our access to use information in all of our systems for compilation can be found in section 68(1) of the Tax Control Act.

We have access to necessary information from the income register to compile information. The specific rule can be found in section 68(2) of the Tax Control Act.

For the purpose of compilation, we may access all necessary information from the records of other public authorities. The specific rule can be found in section 68(3) of the Tax Control Act.

We may collect required information from publicly accessible sources for the purpose of compilation. The specific rule can be found in section 68(4) of the Tax Control Act.

Additionally, we may compile required information from the Customs and Tax Administration's IT systems, other public authorities and publicly available source.

In addition, for the development of IT systems we may compile necessary information from the Customs and Tax Administration’s systems, other public authorities and publicly available sources. This apply, for example, to the training of artificial intelligence (AI), including machine learning. The specific rule can be found in section 67 a of the Tax Control Act. Certain rules have been established for the development of IT systems in Executive Order no. 2660 of 28 December 2021 on the Customs and Tax Administration’s collection and processing of certain information for the development of IT systems.

We receive information about you both from yourself and from other parties. In this section you can read more about where we receive your personal data from.

Information from yourself

We process the personal data that we receive from you. This might be information that you have provided in connection with your preliminary income assessment and tax assessment notice, or on registering your business, or the information we obtain during phone calls with you or from our written communication.

In special cases, we also use personal data from social media etc., which was clearly published by yourself, if we deem this to be justified and relevant to your case. We can do this in accordance with an opinion from the Parliamentary Ombudsman of 15 January 2011 (J. no. 2011-2657-2091).

Information from other parties

We also receive information from parties other than yourself. This might be from:

register information such as the Danish civil registration system (Det centrale personregister (CPR)), CVR (business) register, eIndkomst (income register) and other authorities’ registers
private businesses, such as your employer, your bank or other reporting entities such as attorneys and investment platforms
a possible guardian
your relatives (such as spouse or partner), other private individuals and information from other individuals’ tax matters
other public authorities, such as other authorities under the Danish Ministry of Taxation, municipalities, Udbetaling Danmark and the police
non-Danish authorities, in particular tax authorities in EU/EEA countries and in non-EU/EEA countries (third countries)

We may disclose your personal data to other parties, including other public authorities and private entities.

Other authorities under the Ministry of Taxation

We may disclose your data to another authority under the Ministry of Taxation when this is necessary for their case processing. This might be to the Department of the Ministry of Taxation in connection with service to the minister, or to the Danish Tax Appeals Agency (Skatteankestyrelsen) concerning an appeal.

Other public authorities

We may also disclose your personal data to other public authorities if we deem the data to be of significant importance to the official tasks of another authority or to the extent that we, as a public authority, have a statutory duty to make such disclosure.

This might be to:

the Danish Police
the Danish courts
Udbetaling Danmark
the municipalities
the Danish Business Authority
non-Danish tax authorities in EU/EEA countries and non-EU/EEA countries (so-called third countries)
Statistics Denmark.

Private entities

Furthermore, in certain situations we may disclose your information to private citizens, businesses and party representatives when we are obliged to do so or have received your consent. This might be in connection with requests for access to documents, or if a party is represented by a professional adviser or a related party. You may also give your consent to giving your bank information about you for loan purposes, for example.

We are subject to a duty of confidentiality, including a special duty of confidentiality under section 17 of the Tax Administration Act. As a result, we don't disclose personal data to unauthorised persons.

For more information about our duty of confidentiality, see section A.A.6.1, concerning the duty of confidentiality, of our Danish-language legal guide. You can also read about examples of particular statutory authority that may involve the passing of information to private individual in section A.A.6.1.2.4.2 of our Danish-languge legal guide.

Data processors

Moreover, the Customs and Tax Administration discloses personal data to data processors under data processing agreements in accordance with Article 28 of GDPR.

We only retain and process your personal data for as long as necessary for the purpose for which we use the data, or until a statutory deadline expires.

This is necessary for the purpose of compliance checks and filing and documentation of the decisions we make, with due consideration of, among other things, your opportunities to object to the decision with regard to pending appeals or court cases etc.

Moreover, we have to keep your personal data because of legal or administrative requirements due to the Danish Archives Act (Arkivloven).

When the purpose of processing no longer applies, your personal data will be erased, made anonymous or transferred to an archive in accordance with the rules of the Danish Archives Act(Consolidation Act no. 1201 of 28 September 2016).

We disclose personal data to third countries (countries outside the EU/EEA) in connection with double taxation agreements and other international agreements, including the OECD and the Council of Europe’s Convention on Mutual Administrative Assistance in Tax Matters.

You can read about the Convention on Mutual Administrative Assistance in Tax Matters in section C.F.8.1.2.3, the OECD and the Council of Europe’s Convention on Mutual Administrative Assistance in Tax Matters, of our Danish-language legal guide. And you can obtain an overview of the agreements with individual countries and jurisdictions in section C.F.9.2, Danish double taxation agreements and international agreements, of our Danish-language legal guide.

You can also find double taxation agreements and international agreements in Danish at skm.dk.

When we pass personal data to third countries, we are also obliged to state the reason why we do so.

Below, you can read more about the reason for passing information to secure and unsecure third countries in relation to double taxation agreements and other international agreements.

Secure third countries

We disclose information to third countries that are secure based on the adequacy decisions of the European Commission under Article 45 of the EU’s General Data Protection Regulation (GDPR). Such countries are: Andorra, Argentina, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, the United Kingdom, South Korea and Uruguay.

You can read more about the European Commission’s adequacy decisions at europa.dk.

Unsecure third countries

When we disclose information to third countries outside under double taxation agreements and international agreements, the disclosure is based on Article 46(2) (a) of GDPR, which concerns a legally binding and enforceable instrument between public authorities or bodies.

You have a number of rights when we processes data about you. Here, you can read about your right under GDPR.

We are obliged to notify you when we collect and process personal data about you. Among other things, you have the right to be notified of the purpose of and legal basis for such processing. For example, you will receive this notification when you are made aware of this privacy policy.

In certain situations, we may be exempt from the obligation to notify you. This will apply, for example, if you are already familiar with the information, or your interest in receiving the information should cede to the consideration of private or public interests.

We are not required to notify you if the information was received from another authority or business, where the collection or disclosure is expressly stipulated in legislation. The same applies if notification will probably prevent or seriously impede the fulfilment of the purposes of processing (for example an audit purpose). No notification is required either if the information is to remain confidential under a statutory duty of confidentiality, for example the extended duty of confidentiality in section 17 of the Tax Administration Act.

You have a number of other rights as mentioned below. If you want to avail yourself of these rights, you have to contact us. See how you do that in the section Do you need to contact the Tax Agency?

Right of access to data

As a general rule, you have a right of access concerning our processing of your personal data. This means that you have the right to receive confirmation that personal data about you is subject to processing, as well as various additional information about the processing of your data

Right to rectification (correction)

You have the right to rectification of any incorrect information about you.

Usually, we need to be able to document the original information from our case processing due to our briefing an recording obligation as a public authority. As a result, rectification (correction) will typically be made by adding the correct information to the case without deleting the incorrect information. The incorrect information may not influence our future case processing.

We may also note your points of view even if we assess your information to be correct.

Right to erasure

In special cases, you have the right to erasure of data about you before we would normally erase the data. You do not have the right to erasure of data if one of the below conditions are met:

Processing is required in order to meet a legal obligation.
processing is required in order to perform a task which is either in the interest of society and as part of our regulatory tasks.

As a general rule, we may not erase information due to our filing and data record obligation as a public authority. This also applies to incorrect information which you can read more about in the section Right to rectification (correction).

Right to restriction of processing

In some cases, you have the right to have the processing of your personal data restricted. In such cases, we may only store information if one of the below conditions is met:

You have given your consent.
The processing is done for the establishment, exercise or defence of legal claims.
The processing is done for protecting a natural or legal person or important public interest.

Right to object

You are entitled to object against our processing of your ordinary personal data for several reasons relevant to your particular situation. This applies when our processing of your personal data happens based on a task performed in the interest of society or as part of our regulatory tasks.

In such case, we may no longer use personal dato to solve our tasks unless we can document heavy legitimate reasons that prevail over your interests or if the processing is required to establish, exercise or defend legal claims.

Please contact our Data Protection Officer (DPO) if you have any questions about data protection.

You can contact our DPO in the following ways:

By email: DPO@sktst.dk. We recommend that you don't send CPR numbers or other confidential and sensitive personal data by unencrypted email to the DPO.
By post:
Databeskyttelsesrådgiveren
Skattestyrelsen
Hannemanns Allé 25
2300 København S

The job of the DPO includes guiding us as an authority on the processing of personal data and monitoring that we comply with the rules in the data protection area.

Organisation

The Customs and Tax Administration is part of the Ministry of Taxation and the DPO works for both.

Our DPO is organisationally anchored in the Tax Agency under the Customs and Tax Agency.

You have the right to lodge a complaint with the Data Protection Agency if you are dissatisfied with how we process your personal data.

You can read more about how to complain to the Data Protection Agency at Datatilsynet.dk. The Data Protection Agency has prepared a complaint form that can be used if you wish to complain.

The Data Protection Agency recommends that you send your complaint via Digital Post, but you may also send it by regular post to:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark

General information about processing of personal data by the Tax Agency

Need to contact the Tax Agency?

The purpose of the processing of personal data by the Customs and Tax Administration

Which personal data do we process?

Legal basis for processing

From where do we receive your information?

Who can receive your information?

For how long do we process and retain your data?

Automatic decisions

Is data transferred to non-EU/EEA countries (third countries)?

What are your rights?

How to contact our data protection officer (DPO)

Information about complaints to the Data Protection Agency

Changes to this information text