Denmark Company Lookup: A Flag That Travels

A Denmark company lookup runs through Det Centrale Virksomhedsregister (CVR), the central business register, held by Erhvervsstyrelsen — the Danish Business Authority — and searched at cvr.dk. This guide covers what the register holds, the flag it carries about how its data may be used, and how long each kind of personal detail stays visible. If you need the Danish population rather than one company at a time, the Denmark company directory covers the same registered businesses with industry, size and contact breakdowns attached, and the Denmark business database is the same file described as a dataset.

Denmark company lookup: the short version

• CVR contains current and historical information on all Danish businesses, and the data is publicly available. Since 1999 it has been the authoritative register for base data on all registered businesses.
• A unit can be reklamebeskyttet — marketing-protected — and the marking is published in the register. Protected grunddata may not be used by private legal entities for direct marketing.
• The duty travels. Contact data may only be passed to a third party if it is clearly marked to the recipient that the unit is protected.
• Names of owners, founders and management are published at all times, for active and ceased units alike. Addresses are published until five years after the person ceased to be active.

The duty that travels with the data

Several registers in this series restrict what may be done with the data they publish. Denmark's does something the others do not: it puts the obligation on whoever hands the data on.

The CVR-loven sets out both halves:

"Markeringen af, at en enhed er reklamebeskyttet, offentliggøres i registeret. Reklamebeskyttelse efter stk. 1 medfører, at grunddata, som juridiske enheder og produktionsenheder har registreret i Det Centrale Virksomhedsregister, ikke må benyttes af private juridiske enheder med henblik på direkte markedsføring. For juridiske enheder og produktionsenheder, der har registreret, at de ønsker reklamebeskyttelse […] må grunddata, som har karakter af kontaktoplysninger, alene videregives til tredjemand, hvis det i forbindelse med videregivelsen klart markeres over for modtageren, at enheden er beskyttet."

The marking that a unit is marketing-protected is published in the register. Marketing protection means that base data which legal units and production units have registered in CVR may not be used by private legal entities for the purpose of direct marketing. For units that have registered that they want marketing protection, base data having the character of contact information may only be passed on to a third party if, in connection with the passing on, it is clearly marked to the recipient that the unit is protected.

Erhvervsstyrelsen's own guidance states the same duty in the operational language of the people it falls on: "Hvis du giver oplysninger fra CVR videre til andre, fx til et call center eller en ekstern telefonsælger, så har du også pligt til at oplyse om virksomhederne eller produktionsenhederne er reklamebeskyttet." If you pass information from CVR on to others — for example to a call centre or an external telemarketer — you also have a duty to state whether the businesses or production units are marketing-protected.

Here is what makes it unusual, and it is worth stating precisely. Most rules of this kind bind the end user. They say: do not use this data to market to these people. Denmark's says that too — and then adds a second obligation that binds the intermediary. Anyone who redistributes Danish company contact data carries a disclosure obligation of their own, discharged at the moment of handing over, independent of what the recipient later does.

Breach of the marketing-protection rules can be punished by a fine. The rule sits in the CVR-loven, and the amount is not reproduced here.

The neighbouring register in the same single market draws the rule at a different depth. The Belgium company lookup guide covers a state whose open-data terms state that "Personal data may not be reused for direct marketing purposes" — a prohibition on the use. Denmark prohibits the use and requires the flag to be disclosed downstream. Two neighbours, the same underlying concern, two depths of the same rule — and this page does not rank them. What it does say is that a process built to satisfy one does not automatically satisfy the other, because Denmark reaches a step that Belgium's wording does not address.

Two clocks: the name and the address

Denmark's treatment of personal data in the register runs on two different timers, and both are quotable rules rather than practices.

The first has no expiry:

"Oplysning om navn for fuldt ansvarlige deltagere, stiftere, ejere og ledelsesmedlemmer offentliggøres til enhver tid i Det Centrale Virksomhedsregister, medmindre Erhvervsstyrelsen træffer anden beslutning. Dette gælder for både aktive og ophørte juridiske enheder."

Information about the name of fully liable participants, founders, owners and management members is published in CVR at all times, unless Erhvervsstyrelsen decides otherwise. This applies to both active and ceased legal units.

The second does:

"Oplysning om adresse og bopælsland for fuldt ansvarlige deltagere, stiftere, ejere og ledelsesmedlemmer offentliggøres i Det Centrale Virksomhedsregister, indtil der er forløbet 5 år, efter at personen er ophørt med at være aktiv i en juridisk enhed."

Information about the address and country of residence of those same people is published until five years have passed after the person ceased to be active in a legal unit.

So: a name that never expires, and an address that does. The person who founded a company that closed years ago is still named; their address falls away five years after they stopped being active. That asymmetry is set by statute rather than by practice, which means it is predictable — and predictability is worth something when you are trying to work out why a historical record is partially populated.

One further rule cuts across it: "For personer, der har registreret navne- og adressebeskyttelse i Det Centrale Personregister, offentliggøres adressen ikke i Det Centrale Virksomhedsregister, så længe beskyttelsen er gældende i Det Centrale Personregister." For persons who have registered name and address protection in CPR, the address is not published in CVR for as long as that protection applies in CPR.

That is a second, independent reason an address may be absent, and it has nothing to do with the five-year clock.

Two other registers in this series decide the fate of the past differently, and putting the three side by side is instructive. The Netherlands company lookup guide covers a register where shielding an address does not reach backwards — KVK warns that after shielding, the visiting address remains visible in the company's history. The Poland company lookup guide covers a register that offers deleted data as a standard free option, in the odpis pełny. Denmark lets one category of personal data expire by statute while another never does. Three registers, three fates for the past: one that keeps it, one that serves it, and one that times it out on a published clock.

What a Danish company register entry contains

A self-contained summary. Denmark's business register is Det Centrale Virksomhedsregister (CVR), held by Erhvervsstyrelsen and searched at cvr.dk. It contains current and historical information on all Danish businesses, the data is publicly available, and since 1999 it has been the authoritative register for base data on all registered businesses; associations and public authorities are registered in it as well. Per § 2 of the CVR-loven, the register's purpose is to hold base data on legal units that are traders or employers and their associated production units, to number them uniquely, and to make base data available to public authorities and institutions and to private parties. A CVR record includes, among other things, a marking of any reklamebeskyttelse, the industry and any secondary industries, any contact details and any employee count. The marking that a unit is reklamebeskyttet is published in the register. Marketing protection means that base data registered in CVR by legal units and production units may not be used by private legal entities for the purpose of direct marketing, and that base data having the character of contact information may only be passed on to a third party if it is clearly marked to the recipient that the unit is protected. Information about the name of fully liable participants, founders, owners and management members is published at all times unless Erhvervsstyrelsen decides otherwise, for both active and ceased legal units; information about their address and country of residence is published until five years have passed after the person ceased to be active in a legal unit. For persons who have registered name and address protection in Det Centrale Personregister, the address is not published in CVR for as long as that protection applies in CPR. Marketing protection covers only the base data that were in CVR after the business became marketing-protected, so a short transition may follow in which approaches continue, which Erhvervsstyrelsen states is not necessarily unlawful. Breach of the marketing-protection rules can be punished by a fine.

The transition window

One detail in Erhvervsstyrelsen's guidance is the kind a reader will not find in a summary, and leaving it out would make the rule look simpler than it is:

"Reklamebeskyttelsen omfatter kun de grunddata, der var i CVR, efter at din virksomhed er blevet reklamebeskyttet."

Marketing protection covers only the base data that were in CVR after the business became marketing-protected.

The consequence follows, and Erhvervsstyrelsen states it rather than leaving it to be discovered: a short period may follow in which approaches continue — "hvilket ikke nødvendigvis er ulovligt." Which is not necessarily unlawful.

That is an authority being honest about the seam in its own mechanism. Data extracted before the flag was set does not retroactively acquire it, so a business that has just registered protection may still hear from someone working off an earlier copy, and that contact is not automatically a breach. For anyone on the receiving end of the rule, it is also the clearest possible statement of why the currency of a copy matters here.

Where a Denmark lookup stops

One route into address protection runs through a different register entirely. A change to the CVR-loven gives address protection in CVR automatically to persons who register Navne- og adressebeskyttelse in CPR, which is applied for at the municipality via borger.dk. The protection is requested in one system and takes effect in another.

This page does not describe the CVR number format, the production-unit numbering beyond what the statute states, or how many entities the register holds. None was sourced, and DENMARK_REPORT.md names each with what would confirm it.

Where the question is a population rather than a company, a firmographic directory covers the same registered businesses with classification, size and contact data attached and queryable as a set; the Europe company directory breaks the European file down by market.

Data quality pitfalls to avoid in Denmark

Passing on Danish contact data without the flag. Base data having the character of contact information may only be passed to a third party if it is clearly marked to the recipient that the unit is protected.

Assuming the duty ends with the end user. Erhvervsstyrelsen's guidance puts the disclosure obligation on whoever gives information from CVR to others, including to a call centre or external telemarketer.

Reading an absent address as an error. It may be the five-year clock after the person ceased to be active, or CPR name and address protection flowing into CVR.

Expecting names to age out the way addresses do. Names of fully liable participants, founders, owners and management are published at all times, for active and ceased units alike, unless Erhvervsstyrelsen decides otherwise.

Treating a post-protection approach as automatically unlawful. Protection covers only the base data present after it was registered, and Erhvervsstyrelsen states that a continuing approach in the transition is not necessarily unlawful.

Working from a copy without knowing its age. Because protection is not retroactive to extracted data, the age of a Danish extract is what determines whether its flags are current.

A repeatable Denmark company lookup workflow

1. Read the reklamebeskyttelse marking on every record you take from CVR.
2. Carry that marking with the record wherever the record goes.
3. State the protection status explicitly whenever you pass Danish contact data to anyone else.
4. Date every extract, because protection applies only to data present after it was registered.
5. Treat a missing address as either the five-year clock or CPR protection, not as a gap.
6. Expect names to persist on ceased units, and do not infer that a named person is still active.

Frequently asked questions

What is reklamebeskyttelse?

Marketing protection. The marking that a unit is protected is published in the register, and protected base data may not be used by private legal entities for the purpose of direct marketing.

Do I have obligations if I only pass Danish data on?

Yes. Base data having the character of contact information may only be passed to a third party if it is clearly marked to the recipient that the unit is protected, and Erhvervsstyrelsen's guidance applies that duty to passing information to a call centre or external telemarketer.

What happens if the rules are breached?

Breach of the marketing-protection rules can be punished by a fine. The rule sits in the CVR-loven; this page does not state the amount.

How long do personal details stay in CVR?

Names of fully liable participants, founders, owners and management are published at all times, for active and ceased units alike, unless Erhvervsstyrelsen decides otherwise. Addresses and country of residence are published until five years after the person ceased to be active in a legal unit.

Why is an address missing from a Danish record?

Either the five-year period has passed, or the person has registered name and address protection in CPR, in which case the address is not published in CVR for as long as that protection applies.

Is a call right after protection is registered unlawful?

Not necessarily. Protection covers only the base data that were in CVR after the business became protected, and Erhvervsstyrelsen states that a short period of continuing approaches is not necessarily unlawful.

How do I get address protection in CVR?

A change to the CVR-loven gives it automatically to persons who register name and address protection in CPR, applied for at the municipality via borger.dk.

What does a CVR record contain?

Among other things, a marking of any reklamebeskyttelse, the industry and any secondary industries, any contact details, and any employee count.

Source Register

Every Danish sentence quoted above is the statute's or the authority's own wording, read on the date shown, with an English gloss beside it rather than in place of it. No amount appears anywhere in this page's prose — including the fine, which is stated to exist with the CVR-loven named as where the rule sits.

The readings that are InfobelPRO's rather than Erhvervsstyrelsen's: that the distinguishing feature of the Danish rule is that it binds the intermediary as well as the end user, and that this makes it reach a step other regimes' wording does not address; that a name which never expires beside an address that expires on a statutory clock makes partial historical records predictable rather than puzzling; and that because protection is not retroactive to already-extracted data, the age of a Danish extract is what determines whether its flags are current. Those are ours. The comparisons with Belgium, the Netherlands and Poland are comparisons of published rules, offered without ranking.