Centre for Cyber Security (CFCS) vs Supervisory authority

Why they differ

CFCS dealt with cyber threats to Danish firms and society; Datatilsynet checks how personal data is handled under GDPR - easily mixed up when a breach must be reported.

Centre for Cyber Security (CFCS)

Compliance & regulation

Denmark's national cyber security body from 2012, which in January 2025 became part of the Danish Resilience Agency (SAMSIK).

Formal

A Danish public body set up in 2012 under the Defence Intelligence Service to warn, advise and assist against serious cyber attacks. Since January 2025 its advice and threat work sits in the Danish Resilience Agency, while incident reports go to the Defence Intelligence Service as national response team.

In plain English

Like a national weather service for storms on the internet - it watched the sky, sent out warnings and told people how to prepare, and was later folded into a larger agency.

In practice

An IT manager in a Danish municipality still finds CFCS guides and threat assessments when she searches online; for current advice she now uses the versions the Danish Resilience Agency publishes.

Why it matters

Much Danish guidance and course material still names CFCS; without knowing where its tasks went, a firm may look for advice in the wrong place or be unsure where to report a serious incident.

Supervisory authority

Compliance & regulation

The public body in each EU country that oversees GDPR, handles complaints and can seek fines; in Denmark, Datatilsynet.

Formal

An independent public authority that each member state must set up under GDPR Article 51 to monitor the rules, investigate complaints and breaches, issue orders and bans, and impose fines - or, as in Denmark, report cases to the police so that the courts set the fine.

In plain English

Like the food inspector who can turn up at any restaurant, ask to see the fridge, order a clean-up and, if nothing changes, take the owner to court.

In practice

A citizen complains that a Danish municipality will not delete old case notes about her; Datatilsynet asks the municipality to explain, finds no legal ground for keeping them and orders them deleted.

Why it matters

Rights on paper mean little if nobody enforces them; the authority gives people somewhere to turn without hiring a lawyer and gives organisations a real reason to comply.