DTU Science Park

Denmark · owned by Danmarks Tekniske Universitet (Denmark) · dtusciencepark.dk · 13 vendors

DTU Science Park is one of Europe's leading deep tech communities, hosting over 300 companies and 5,000 employees across two locations in Hørsholm and Kongens Lyngby, Denmark. It provides office, laboratory, and workshop facilities alongside growth programs and startup acceleration services for deep tech and life science companies. Originally founded in 1962 as 'Forskningscentret' (the Research Centre), it is owned by the Technical University of Denmark (DTU) and rebranded to its current name in 2018.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-13 · revision 2

13 direct vendors, 209 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 3/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

DTU Science Park demonstrates low migration readiness, scoring 25. The primary challenge stems from its internal tech stack, which is centered around WordPress and Elementor. This setup is not indicative of a cloud-native, containerized, or microservices architecture, suggesting that a migration to modern cloud platforms would likely involve a complex and costly re-platforming effort rather than a straightforward lift-and-shift. The regulatory environment poses another significant hurdle, with a NIS2 assessment required. Any migration would need to meticulously address these compliance requirements, adding complexity and potential costs to the project. The absence of specified data residency requirements introduces uncertainty that would need to be clarified and addressed during migration planning. Furthermore, the lack of available financial stability data makes it difficult to assess the company's capacity to fund a substantial migration initiative. Regarding vendor relationships, while there is geographic diversity among vendor HQ countries, the specific vendor lock-in risk (e.g., contract complexity, ease of switching) is unknown. The contradictory data point of 'Total Vendors: 0' alongside 'Total Services: 16' and vendor geographic details creates ambiguity; assuming actual vendor relationships for the 16 services, the potential for vendor lock-in, though not explicitly quantified, remains a factor to consider. HubSpot, being a SaaS platform, would involve data migration rather than infrastructure migration, which is a different challenge. Overall, the current technological foundation and regulatory landscape indicate significant challenges for a comprehensive digital migration.

Compliance

10 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

ISO 27001 is an internationally recognized information security management standard applicable to any organization that manages information assets. DTU Science Park processes significant volumes of personal data (employee, customer, tenant, event participant data), operates shared IT infrastructure for 300+ companies, and manages sensitive business information for deep tech startups. The company's role as a hub for high-value deep tech and life science companies makes it a potential target for cyber threats, increasing the importance of formal information security management. Risk is rated Medium because: (1) the company processes sensitive personal data including health data and CPR numbers; (2) it provides shared IT/network services to hundreds of companies; (3) no ISO 27001 certification has been found, representing a potential gap; (4) Danish Datatilsynet expects appropriate technical and organizational security measures under GDPR Art. 32, which ISO 27001 would help demonstrate. The absence of certification is a gap but not necessarily non-compliance with any mandatory requirement.

Evidence: https://dtusciencepark.dk/privatlivspolitik/, https://dtusciencepark.dk/om-dtu-science-park/baeredygtighed/, https://www.iso.org/standard/27001, https://www.ds.dk/da/standarder/it/informationssikkerhed/ds-en-iso-iec-27001

Danish Data Protection Act — Partially Compliant

The Danish Data Protection Act supplements GDPR with national-specific provisions, including rules on CPR number processing (§11), employee health data (§12), and the role of Datatilsynet as supervisory authority. DTU Science Park explicitly processes CPR numbers and health data of employees, referencing the correct legal bases (Databeskyttelsesloven §11(2)(1) and §12) in its privacy policy. This demonstrates awareness of national law requirements. Risk is Medium for the same reasons as GDPR — active compliance effort is evident but no formal audit or DPO appointment has been publicly confirmed.

Evidence: https://dtusciencepark.dk/privatlivspolitik/, https://www.datatilsynet.dk/, https://www.retsinformation.dk/eli/lta/2018/502

ISAE 3000 (source) — Assessment Required

ISAE 3000 is an assurance standard used for non-financial assurance engagements, commonly applied to ESG/sustainability reporting, GDPR compliance attestations, and other non-financial subject matters. DTU Science Park has voluntarily published ESG reports (2024 and 2025) and is pursuing DGNB gold certification. If the company seeks third-party assurance on its ESG disclosures or GDPR compliance, ISAE 3000 would be the applicable framework. Risk is rated Low because ISAE 3000 is not mandatory for DTU Science Park's current operations, and the ESG reports appear to be voluntary and unaudited. However, as ESG reporting requirements evolve (CSRD may apply to larger entities), ISAE 3000 assurance may become relevant.

Evidence: https://dtusciencepark.dk/om-dtu-science-park/baeredygtighed/, https://dtusciencepark.dk/wp-content/uploads/2026/07/DTUSP-ESG-rapport-2025_FINAL.pdf, https://dtusciencepark.dk/wp-content/uploads/2025/07/DTU-Science-Park-ESG-rapport-2024.pdf, https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3000-revised-assurance-engagements-other-audits-or

Financials

Three-year financials

Financial Resilience Score: 7/10

DTU Science Park A/S demonstrates solid financial resilience underpinned by an asset-heavy, real-estate-backed balance sheet in one of Denmark's most sought-after biotech and deep-tech clusters (Hørsholm and Lyngby). Ownership by the Technical University of Denmark provides a stable, long-term, non-speculative shareholder base and a natural pipeline of spinouts and startups, while credit-strong anchor tenants such as Novonesis, FORCE Technology, DHI, ALK, and Trackman reduce tenant concentration risk and provide recurring rental income. Historically, the company has reported annual revenue in the range of DKK 150–200M with equity of several hundred million DKK, reflecting its substantial owned real-estate portfolio. The recurring revenue model based on rental income, shared services and program fees provides predictable cash flows that are less cyclical than typical innovation businesses. However, as a property owner, the company is exposed to interest-rate sensitivity and real-estate cycle risks, with higher rates since 2022 pressuring investment-property valuations and financing costs. Ongoing DGNB-gold refurbishments and new lab construction require significant capex, potentially raising leverage. The non-profit, mission-driven mandate also limits the ability to maximize rents and margins, while geographic concentration in two Copenhagen-area sites offers no diversification outside the Øresund region.

Key strengths: Asset-heavy real-estate-backed balance sheet in premier Danish biotech cluster, Ownership by Technical University of Denmark provides long-term stability, Credit-strong anchor tenants (Novonesis, FORCE Technology, DHI, ALK, Trackman), Recurring rental income model with predictable cash flows, Exposure to deep-tech and life-science sectors attracting Danish and EU funding, 300+ tenant companies with 5,000+ employees reducing concentration risk

Risk factors: Real-estate cycle and interest-rate sensitivity pressuring valuations and financing costs, Tenant sector concentration in funding-cycle-dependent biotech/deep-tech startups, High capex intensity from DGNB-gold refurbishments and new lab builds, Non-profit mandate structurally limits margin expansion, Geographic concentration in only two Copenhagen-area sites (Hørsholm and Lyngby), VC winter could hurt occupancy and rent collection at smaller-tenant end

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report