Preface

My journey in IT began in the mid-1990s with dBase V and FoxPro 2.6 and eventually led to my work as a cybersecurity and data lifecycle architect and to founding Alpha Data Consult. Throughout my career, I have worked extensively with data in various capacities, including managing personal, confidential, and sensitive data, often under strict regulatory requirements.

I often say that I have unwittingly touched personal data, sensed its presence within systems, and witnessed its movement across networks, not only from a technical perspective but with a deep, holistic understanding of its entire lifecycle. From creation to secure deletion, data is both inherently valuable and highly vulnerable: it can be a business’s greatest asset and its greatest exposure. Managing it effectively requires technical proficiency and a firm commitment to regulatory compliance.

In the early years, personal data was left exposed: stored in unsecured formats, shared openly by email, or kept in databases without encryption or access controls. I refer to data managed this way as ‘naked data’: personal data unprotected, unmasked, and vulnerable to misuse. Sensitive data was in plain sight, easily accessible with minimal effort.

May 2018 marked a significant turning point: the General Data Protection Regulation (GDPR) became applicable across the EU. The GDPR introduced stricter consent rules, empowering individuals with stronger data rights and making organisations accountable for how they process personal data.

At a seminar during this transition period, I vividly recall a speaker emphasising the Danish phrase Slette, slette, slette. It was a defining moment, and it still echoes in my mind. In English, this means ‘Delete, delete, delete’: if you do not need the data, delete it. It is a simple yet powerful principle that continues to guide my work, helping to minimise data risk, improve compliance, and build trust.

As the GDPR reshaped the landscape, I deepened my expertise through research, hands-on experience, and professional training, including a Certificate in Data Privacy and Technology from Harvard Online, which broadened my strategic understanding of how organisations handle personal data.

Over time, I became engaged with personal data breaches in Denmark. Year after year, statistics from the Danish Data Protection Agency (Datatilsynet) revealed that personal data breaches remained high, affecting organisations, individuals, and stakeholders across industries. I recognised the need for a comprehensive book analysing these breaches, their causes, and emerging risks.

What began as a series of LinkedIn posts grew into a more ambitious project. Initially, I planned to publish an independent report, now Part II of this book, that focused exclusively on personal data breach trends in Denmark. However, I quickly realised the need for a foundation that explored the broader context of the breach data. This required a more structured book format. With Part I now covering the essential GDPR foundation, Personal Data Breaches in Denmark (2018–2026): A Comprehensive Overview was born.

This book is written for anyone who works with personal data, whether you are new to the field or have many years of experience in data protection. It offers an accessible introduction to GDPR fundamentals, a real-world analysis of personal data breaches in Denmark, and a concluding chapter on practical measures for strengthening data security.

Leading data-driven projects has given me practical experience in cybersecurity, data privacy, and data protection within regulatory frameworks such as the GDPR, and the understanding to support professionals and organisations working to uphold data privacy and security.

Understanding how personal data breaches occur, and the risks they pose, is the first step towards prevention. I hope this book provides the practical insight that individuals and organisations need to make informed decisions.