Datatilsynet guidance: public authorities' use of artificial intelligence

What it is

Offentlige myndigheders brug af kunstig intelligens, Inden I går i gang is guidance from Datatilsynet, the Danish Data Protection Agency, published in October 2023. Its title translates as public authorities’ use of artificial intelligence, before you get started. It is written for the staff who run AI projects in public authorities and for those who advise them on data protection, and it aims to help authorities make the initial data protection assessments an AI project needs before it starts.

Datatilsynet published the guide alongside a mapping of AI use in the Danish public sector, and later added a template for impact assessments of AI. Its starting point is that innovation and data protection are not opposites, and that data protection should be built into an AI project from its first phases, because changing a finished system to fix a problem such as discrimination or a missing legal basis is costly and technically hard.

The guide deals only with data protection law. It says plainly that it does not cover the EU AI Act or other legislation such as the medical devices rules.

Who it applies to

The guide is addressed to Danish public authorities, from state agencies to municipalities and regions, that develop or use AI on personal data about citizens. It applies the GDPR and the Danish Data Protection Act (databeskyttelsesloven). Private companies are not its audience, but suppliers building or selling AI to Danish authorities will meet its expectations in procurement, and its reading of the GDPR is Datatilsynet’s own.

What it requires

The guide follows the lifecycle of an AI solution, from scoping and design to development and training, operation and monitoring.

Purpose. Datatilsynet treats developing an AI solution as a purpose in its own right, separate from using it. Training a model usually relies on historical data collected for another purpose, such as casework, so the authority must consider whether that reuse is lawful. Using the solution’s output in an administrative decision carries stricter requirements than development.

Proportionality and minimisation. The authority must assess whether the processing is suitable, necessary and proportionate, and weigh the benefits of the solution against its effect on citizens. It should develop, train and run the solution with as little personal data as possible, using anonymised data as far as it can and considering synthetic data or federated learning at the design stage. Where it does not, it must explain why.

Legal basis. The authority must know and document its legal basis before processing begins, and cannot switch basis later. The guide covers the main options for each phase, including tasks in the public interest or the exercise of official authority, research and statistics under section 10 of the Data Protection Act, legal obligations and, in limited cases, consent. The more intrusive the processing, the clearer the legal basis must be.

Profiling and automated decisions. The GDPR’s ban in Article 22 covers decisions based solely on automated processing, including profiling, that have legal or similarly significant effects. Profiling itself is not banned. For a public authority, the ban can as a rule only be set aside where the law provides that the authority may make such decisions, and consent will not usually be available. Where a system is meant to be decision support, a person must assess the information independently and be able to override the system, otherwise automation bias can turn it into an automated decision in practice.

Transparency. Citizens must be told about the processing in both the development and operational phases.

Monitoring. Once in use, a solution must be monitored so its output stays accurate, which follows from the principle of accuracy and data protection by design. Static models need periodic retraining as input data drifts, and models that learn continuously need closer monitoring.

Impact assessment. Datatilsynet considers that AI projects will almost always need a data protection impact assessment. AI is new technology, which is on its list of processing that always requires one, and AI projects often involve special categories of data, vulnerable people or large-scale processing. The assessment should start at planning and be kept current, and must at least describe the processing and its purposes, assess the risks to citizens’ rights and set out the measures to address them.

Key dates

• October 2023. Guide published, together with a mapping of AI use in the public sector.
• 2 August 2025. Datatilsynet becomes a market surveillance authority for parts of the EU AI Act’s prohibited practices under Act No. 467.

In February 2026 the government consulted on a draft law to give public authorities a general legal basis for developing and using AI systems on personal data. It was not adopted before the March 2026 election, so the guide’s position on legal basis still applies.

How it relates to other frameworks

The guide is Datatilsynet’s application of the GDPR to public sector AI, and its treatment of automated decisions follows GDPR Article 22. The EU AI Act applies alongside it. A Danish authority deploying a high-risk AI system will need a fundamental rights impact assessment under the AI Act as well as a DPIA under the GDPR, and the two can share much of their content. The Danish AI Act supplementary law sets out Datatilsynet’s separate role in supervising the AI Act.

Datatilsynet and the Agency for Digital Government also run a regulatory sandbox for AI, which gives companies and public authorities free guidance on the GDPR and on risk classification under the AI Act. For the ethical questions the guide leaves out, the EU’s ALTAI checklist is a practical companion.

A note on this page

This is Aicura’s reading of Datatilsynet’s guidance. It is not legal advice and it is not the guide itself. Read the primary source published by Datatilsynet, and take advice on how data protection law applies to your authority.