Information for foreign entities on registration and reporting
On this page, you can find information on how foreign entities covered by the Danish NIS 2 Act must register and report incidents.
If you are a foreign entity and do not have a Danish VAT number (CVR), you cannot hold a Danish digital business ID (MitID Erhverv), which is required to access the digital reporting and registering solutions.
Other possibilities:
Registration
- Register through a designated third party, who is established in Denmark
- An approved electronic ID (eID) for business can be used instead of MitID Erhverv, but currently this is only available in very few countries.
- Foreign entities subject to the L435 Act on Security and Emergency Preparedness in the Telecommunications that do not possess a MitID Erhverv or an eID, are required to register through a designated third party.
- If you are a foreign entity under the main establishment rule and none of the above applies, you can register by downloading the registration form here (digst.dk) and send it to NIS2@digst.dk.
- If none of the above applies, you can apply to the competent authority, to be exempt from the use of MitID Erhverv. The authority will evaluate the application and if granted, provide alternative means to register and report.
Reporting
- Report through a designated third party, who is established in Denmark
- eID for business can be used instead of MitID Erhverv, but currently this is only available in very few countries.
- Foreign entities operating in the energy sector must contact the Danish Energy Agency by email (beredskab@ens.dk) or by phone (+45 33 92 67 00) for instructions on reporting
- If none of the above applies, you can apply to the competent authority, to be exempt from the use of MitID Erhverv. The authority will evaluate the application and if granted, provide alternative means to register and report.
- Foreign entities subject to the L435 Act on Security and Emergency Preparedness in the Telecommunications Sector that do not possess a MitID Erhverv or an approved electronic ID (eID), are required to report through a designated third party.
Summary of the Danish ministerial regulation on registration
Registration and notification pursuant to the Danish NIS 2 Act must be made digitally through the self-service solution, which is available via Virk.dk, unless the entity is exempt from this.
This digital communication must be provided with the public digital signature MitID Erhverv.
The competent authority may, at the request of an entity, exempt it from digital communication provided with MitID Erhverv if the entity is established outside of Denmark and cannot obtain a Danish digital signature, or if there are other significant reasons that prevent or unnecessarily complicate digital communication for the entity in question.
In the event of an exemption, the competent authority, with the involvement of the Computer Security Incident Response Team (CSIRT), shall designate another form of communication to be used for communication on matters concerning registration and/or notification.
Competent authorities
For further guidance and sector-specific inquiries, you are advised to contact the competent authority responsible for your sector. We have prepared an overview of the competent authorities for the various sectors covered by NIS 2, including their respective contact details.
Follow this link to access the overview.