Denmark's Digitaliseringsstyrelsen has reopened consultation on a draft AI-hjemmelslov that would give public authorities and bodies a supplementary GDPR Article 6(1)(e) legal basis to develop and use AI systems, including decision support and profiling, on personal data they already lawfully process, with comments due by noon on 12 October 2026

A renewed consultation, not a new law

The letter from Digitaliseringsstyrelsen is dated 14 September 2026 and asks for comments by 12:00 on 12 October 2026. The portal record gives the same publication date, a hearing type of Lovforslag and an archive date of 12 December 2026. That is the whole procedural event: a draft has been put out for comment. Nothing in it binds anyone.

The same letter explains why the draft looks familiar. It was first sent for consultation on 12 February 2026, and that consultation was interrupted (the letter's word is afbrudt) when an election was called on 26 February 2026. The government now expects to introduce the bill in the 2026/2027 session and has reissued the draft for a fresh round. The letter says the earlier responses prompted a series of changes, so this is not exactly the same text; it lists six: a scope refocused on the Article 6(1)(e) processing basis, an adjusted power in section 3(2) to remove doubt about whether it applies only where the GDPR itself requires safeguards, inserted examples, an account of why the draft covers AI systems and not similar digital tools, expanded remarks on further processing, and technical changes. We have not compared the two drafts line by line and do not say which response produced which change.

Responses filed in the interrupted round are not republished unless resent. The letter invites parties to resubmit them, or to file new ones.

One date in the package does not fit. Section 11 of the explanatory notes (p. 54), the list of consulted bodies, says a draft was in consultation from 7 September 2026 to 5 October 2026 (29 days). The letter and the portal both say 14 September to 12 October. We report the discrepancy as we found it and rely on the dated letter for the operative dates.

Section 1 draws the boundary at Article 6(1)(e)

In the draft, section 1 would apply the act to all public authorities and bodies, but only insofar as they process personal data on the footing of GDPR Article 6(1)(e), that is, for tasks carried out in the public interest or in the exercise of official authority vested in the controller. The notes at pp. 14-15 read that breadth generously: state, regional and municipal administration, boards and councils such as valuation commissions and appeal boards, special administrative units such as ATP and Danmarks Nationalbank, purely advisory bodies such as Retslaegeraadet, temporary committees, and bodies performing public tasks such as municipally owned utilities. Courts and bodies covered by retsplejeloven are named as capable of falling within it.

Two limits would sit inside that breadth if the draft were enacted. A private actor that performs public-interest tasks only in part would be covered only for the processing that actually rests on Article 6(1)(e) (notes, p. 14). And section 6 of the draft would exclude the Faroe Islands and Greenland, because the GDPR and the Danish data protection act do not apply there directly (notes, pp. 80-81).

The scope is therefore a test of processing basis, not a roll-call of institutions. A body that processes under consent, contract or legal obligation for a given activity would get nothing from this draft, if enacted, for that activity.

What section 3 would permit, and what the notes say it would not

Section 3(1) is the operative provision. In the draft's own words, with the PDF line breaks joined: "§ 3. Offentlige myndigheder og organer kan udvikle og anvende AI-systemer, herunder gøre brug af beslutningsstøtte, til blandt andet evaluering af bestemte personlige forhold vedrørende en borger (profilering), på baggrund af personoplysninger, myndigheden eller organet behandler, for at understøtte myndighedens eller organets opgavevaretagelse efter anden lovgivning, jf. dog stk. 2." Our unofficial translation: Public authorities and bodies may develop and use AI systems, including making use of decision support, for, among other things, the evaluation of certain personal aspects relating to a citizen (profiling), on the basis of personal data that the authority or body processes, in order to support the authority's or body's performance of tasks under other legislation, subject however to subsection 2.

In the draft, development is defined widely in section 2(5): any activity contributing to the development of an AI system, including creation, training, testing and validation, and similar activities after deployment, including retraining and further development. Use, in section 2(6) of the draft, is any use including operation after the system is taken into service. The notes (p. 66) add that a body would not have to say which phase of the lifecycle it is in to rely on the basis.

If enacted as drafted, the practical value, as the notes describe it at pp. 70-71, would be in further processing. A body could then take personal data collected for one purpose, such as casework, and process it for another, namely developing an AI system, without carrying out a separate compatibility assessment, because Article 6(4) treats processing on the basis of national law as further processing permitted by that law. The notes say this covers both historical closed cases and active cases the body will handle later.

Then the notes set out the limits. The provision would not be a basis for processing new personal data; it supplements processing the body already carries out under Article 6(1)(e) (p. 68). It would not be a basis for developing or using AI systems to take fully automated decisions under GDPR Article 22 (pp. 8, 28, 68). It would reach only data the body has lawful authority to retain: no retrieving data from a public archive once internal copies are deleted, no treating possible AI development as a ground for longer retention, and no using data the body has already judged unnecessary but not yet deleted (p. 71). It would give no basis for disclosure to other public bodies (pp. 16, 71), no basis for collecting more data than current law allows, and no relief from other constraints such as duties of confidentiality (pp. 71-72). Sector rules on the use of data, the notes give health and tax as examples, would continue to apply (p. 72).

The notes are also clear that the act would run alongside existing sector legislation, not repeal it. At pp. 15-16 the ministry says the proposed scheme would not need to set aside sector legislation regulating the same field, that established sector bases on areas with special needs are to be maintained, and that the scheme would apply sideloebende, in parallel, with them. The aim stated at pp. 6-7 is narrower than replacement: to stop requiring a new AI-specific basis to be written into each sector law before AI can be used.

Decision support has four cumulative conditions, and no bright line to Article 22

In the draft, section 2(4) would define beslutningsstoette, decision support, as any suggestion or recommendation for decisions or significant measures towards the data subject, generated by an AI system, which a natural person incorporates into the overall professional assessment underlying the decision or measure, without the AI system itself taking the decision or initiating the measure. The special remarks (p. 63) break that into four cumulative conditions and give examples: a caseworker receiving suggested decisions or predictions, care-home staff receiving suggested prioritisation of residents, a system used to select cases for control.

Two boundaries follow from the notes. On one side, decision support would cover only cases where the AI system has significant influence on the course of the case; summarising meeting minutes or running a website chatbot would not qualify as decision support, though section 3 could still serve as a basis for such uses (pp. 64, 69). On the other side, the notes say the human involvement has to be meaningful and not an empty gesture: a caseworker could not simply forward or copy an AI-generated decision without genuinely engaging with it, and the person evaluating the output should have the competence and the ability to change it (p. 65).

Where decision support ends and an Article 22 automated decision begins is left open. The notes say twice (pp. 65, 68-69) that future practice is expected to clarify what degree of human involvement is required. A body relying on this draft, if it becomes law, would be relying on a category whose outer edge the drafters themselves decline to fix.

Ministers and Domstolsstyrelsen would get regulation-making powers, under conditions

Section 3(2) would let the competent minister, within that minister's own portfolio, lay down appropriate and specific measures to protect data subjects' rights and interests where processing under section 3(1) involves special-category data under Article 9(1) or criminal-conviction data under Article 10, including where such measures are required by the data protection rules. Section 3(3) would give Domstolsstyrelsen the same power for the courts. The notes (p. 72) say this creates no new basis for processing Article 9 data; a body would still need one of the Article 9(2) grounds, and the notes add that the use of AI is not in itself a substantial public interest under Article 9(2)(g).

Section 4(1) would let the competent minister lay down rules restricting Articles 12 and 15 to 21 of the GDPR in whole or in part, but only if one of the grounds in Article 23(1) applies, and such rules would have to contain the Article 23(2) specifications where relevant. Section 4(2) would give Domstolsstyrelsen the corresponding power for the courts. The section restricts nothing by itself. The notes (p. 77) say the ministry considered and rejected writing a general exception into the bill, because at least one Article 23(1) ground has to be met and the need weighed against the data subject's rights in each case; they also say (p. 78) that a general resource-saving rationale cannot on its own outweigh those rights.

Two further limits are worth a consultation response. Section 4 would not extend to the information duties in Articles 13 and 14; the notes (p. 79) point to databeskyttelsesloven section 22(2) and to Articles 13(4) and 14(5) for those. And before any regulation under section 3(2) or section 4 is issued, an opinion from Datatilsynet is to be obtained under databeskyttelsesloven section 28 (pp. 75, 79).

Domstolsstyrelsen's role is therefore specific. It would set safeguards and rights restrictions for the courts under sections 3(3) and 4(2). The courts' underlying permission would come from section 3(1) like everyone else's, and the notes (pp. 76, 80) say the act would not alter the competence arrangements in the Domstolsstyrelsen act or retsplejeloven.

Why the ministry says a general basis is needed, and what it says the bill costs

The notes (pp. 21-23, 27-28) locate the problem in Datatilsynet's practice. They describe a stricter approach to the legal-basis requirement where AI is used, departing from technology neutrality, and cite two cases: a 2023 decision on Koebenhavns Kommune's AI tool for identifying citizens needing maintenance training and rehabilitation (journal number 2023-212-0015), where the authority found a basis in serviceloven for development but not for operation, and a 2022 decision on the municipalities' Asta profiling tool for newly unemployed benefit recipients (journal number 2022-212-3676), where it required a clear supplementary basis. This is the ministry's account of that practice; we did not open either decision.

The consequences sections are short. The draft imposes no duty on any public body to use AI, so the notes attribute no cost to it as an obligation; bodies that choose to use AI would bear procurement, training and maintenance costs, which the ministry expects to be offset by efficiency gains (p. 48). Erhvervsstyrelsen's Omraade for Bedre Regulering assessed no economic or administrative consequences for business, with a caveat that regulations issued under the delegated powers would be assessed separately (p. 50). The ministry itself flags that section 4 could lead to interference with citizens' rights, particularly access and erasure under Articles 15 and 17, if the powers are used (p. 51).

The consulted list at p. 54 runs to 81 names. It includes Advokatsamfundet, Danske Advokater and Den Danske Dommerforening on the legal side, Datatilsynet and Dataetisk Raad, and on the vendor side IT-Branchen, KMD, KOMBIT, NNIT and Microsoft Danmark. Vendors appear as consultees. The draft gives them no permission and no access to public-sector data; it addresses what their public-sector customers could lawfully do.

What we did not verify

What we opened: the Hoeringsportalen record for hearing 71477, the three-page consultation letter dated 14 September 2026, and the 81-page draft bill PDF, of which we read sections 1 to 6 in full, the general notes at sections 1, 2.1.2, 2.2.1.1.1, 2.2.2, 5 to 7, 10 and 11, the summary table, and the special remarks to sections 1 to 6, including pp. 15-16 on sector legislation and pp. 68-72 on the limits of section 3. The Danish quotation in the third section of this article is section 3(1) as extracted from the PDF, with line breaks joined by spaces and no other change; the translation is ours and unofficial.

What this article relies on: the renewed draft, the consultation letter and the portal record, all read in the drafting pass that produced it. What the desk's earlier research opened but this article does not rely on: the February 2026 hearing record (71062) and the Datatilsynet notice of 16 September 2026. The earlier draft was not compared with the current one line by line, so we say nothing about what changed beyond what the letter lists, and nothing here rests on the notice. What we did not open at all: the two Datatilsynet decisions the notes cite; the consultation list (Hoeringsliste) as a separate document; the sector laws, the Danish data protection act and the GDPR provisions the notes discuss, which we describe only as the draft describes them.

What we refuse to claim: that Denmark has enacted or will enact this text; that it would replace or repeal sector-specific bases, because the notes say the opposite; that it would cover all processing by all public bodies, because section 1 limits it to Article 6(1)(e) processing and section 6 excludes two territories; that it would authorise new collection, inter-authority sharing, longer retention or vendor access to data, because the notes exclude each; that section 4 would itself restrict any right, because it only delegates a power subject to Article 23; that the February draft lapsed in the Folketing, because the letter describes an interrupted consultation and nothing more; that Datatilsynet has approved this draft or that specific changes answer its earlier objections; and any figure for how many AI systems, bodies or citizens would be affected, because the draft gives none. We use no unattributed obligation language in our own voice anywhere in this piece, because the draft binds no one.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Denmark's Datatilsynet publishes final reports from its AI sandbox
• CJEU SCHUFA ruling on GDPR Article 22 automated decisions
• EDPB anonymisation guidelines and generative AI
• Europe AI regulation tracker
• AI Regulation News hub