Privacy policy of the Danish Medicines Agency

We process personal data for a multitude of reasons as outlined below.

In relation to visits to our website

• To disseminate newsletters, we process your email address. The use of your email address is based on your consent, see Article 6(1)(a) of the General Data Protection Regulation (the GDPR in the following).
• To adapt our communication in newsletters and on social media, we process cookies and your consents related to newsletters in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.
• To respond to any inquiries from you, we process your name, telephone number, email address and any other personal data included in your inquiry when the need to process your personal data is in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.
• To improve our website and how we communicate with you and other members of the public, we analyse website user behaviour and send out questionnaires in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.
• To ensure responsible processing of personal data, we have implemented security solutions on our website whereby we log user behaviour in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.

In relation to job applications

• For recruitment purposes, we process your CV, application, certificates and any references you permit us to contact when the processing is in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR and section 12 of the Danish Data Protection Act. If the personal data contain special categories of personal data, we process the personal data in connection with the establishment of any legal claims, see Article 9(2)(f) of the GDPR and section 12 of the Danish Data Protection Act. Any processing of data on criminal offences will happen as part of the exercise of official authority, see section 8(1) of the Danish Data Protection Act.

In relation to the exercise of official authority – authorisation and control

• For authorisation and control activities related to pharmaceutical companies and medicinal products, we process the name, contact details, title and place of work of you as an employee of comprised companies and other authorities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.
• For participating in clinical trials to be approved by us, we process your name and contact details, including your title and place of work, and we process the contact details of employees of companies and other authorities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR. If the processing involves health data about you, we process your personal data if necessary for reasons of substantial public interest, see Article 9(2)(g) of the GDPR.
• For decisions about medicinal products to be granted reimbursement, we process the name, contact details, title and place of work of employees of companies and other authorities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.
• For the appointment of proprietary pharmacists, we process the name, contact details, CV, certificates and place of work of applicants as well as the contact details and place of work of companies and other authorities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.  

In relation to the exercise of official authority – monitoring and supervision 

• For the monitoring of side effects of medicinal products to which your name is linked, we process your name and contact details in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR. If the processing involves health data about you, we process personal data if necessary for reasons of substantial public interest, see Article 9(2)(g) of the GDPR.
• For the supervision of medical devices and serious incidents with medical devices, we process the name, contact details, title and place of work of employees of companies and other authorities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR. If the processing involves health data about you, we process your personal data if necessary for reasons of substantial public interest, see Article 9(2)(g) of the GDPR.
• For the supervision of proprietary pharmacists and retail distributors, we process the name, contact details, title and place of work of employees of companies and other authorities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.  

In relation to visits to our facilities

• To identify you, we process your name and email address to identify you as a visitor and to inform you of the rules that apply in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.
• To safeguard our employees and other visitors, we have implemented CCTV monitoring in which we process video recordings of you in our facilities in the public interest and in the exercise of our official authority, see Article 6(1)(e) of the GDPR.

We disclose your personal data to the public authorities that we are obligated to inform.

Furthermore, we disclose your personal data to the extent required by the rules on public access to documents. Any such disclosure will take place on a case-by-case basis pursuant to the applicable legislation.

Finally, we disclose your personal data to collaboration partners if you have consented thereto, such as through cookies.

We use data processors to carry out tasks on our behalf. We have entered into data processor agreements with our data processors and supervise their compliance with the data processor agreements under the applicable rules.

Our data processors use the data only to perform specific tasks that have been agreed upon with us and not for any purposes of their own. Once the data processor has completed the task, the data are erased and/or returned to us.

We store your personal data for as long as needed to fulfil the purpose of processing described above, unless the legislation in force requires us to store your personal data for a longer period or if it is necessary for us to store the data to manage or defend against a claim or a dispute.

Should it become necessary of us to transfer information to non-EU/EEA countries, any such transfer will comply with Chapter V of the GDPR, the purpose of which is to ensure a level of protection corresponding to that applicable in the EU and EEA. Any transfers to third countries will be carried out based on the European Commission’s standard contractual clauses, see Article 46 of the GDPR, or on the basis of the European Commission’s adequacy assessment, see Article 45 of the GDPR.

You may request a copy of the applicable agreements governing the transfer of personal data at any time by contacting us.

When we process your personal data, you have the right to request us to: 

1. give you information about, or access to, your personal data. Exceptions apply, which means you might not receive all the personal data that we are processing about you.
2. stop using your personal data by way of objection. However, this does not apply if we have legitimate reasons to continue using your personal data. If our processing of personal data is based on the public interest or the exercise of our official authority, see Article 6(1)(e) of the GDPR – see above – you are entitled at any time to object to such processing for reasons relating to your particular situation.
3. erase your personal data in certain circumstances.
4. provide you with a copy of your personal data in a structured, commonly used and machine-readable format where the processing is carried out by automated means and is based on your consent or the completion of a contract. If it is technically feasible, you may request that your personal data be transmitted directly to another company, authority or person acting as data controller.
5. rectify any personal data you believe to be inaccurate. You also have the right to have personal data that you consider to be incomplete completed.
6. restrict the processing of your personal data in certain circumstances.
7. withdraw your consent. However, the withdrawal of consent will not affect our right to the processing of personal data that were collected before the withdrawal. Nor will it affect our right to continue parts of the processing that are based on legitimate reasons other than your consent.

You have the right to complain about our processing of your personal data to the Danish Data Protection Agency. Contact details of the Danish Data Protection Agency are available on their website www.datatilsynet.dk/kontakt.

If you have any questions or wish to exercise your rights, please contact us at databeskyttelse@dkma.dk.

We will respond to your inquiry as soon as possible, and no later than within 30 days.

You may also contact the joint Data Protection Officer (DPO) of the Danish Ministry of the Interior and Health by sending an email to Send an email. You can read more about how to contact the DPO here.