HOFOR A/S (Hovedstadsområdets Forsyningsselskab)

Denmark · owned by Københavns Kommune (Denmark) · hofor.dk · 22 vendors

HOFOR is the Greater Copenhagen utility company responsible for supplying drinking water, district heating, city gas, and district cooling, as well as managing wastewater and rainwater drainage across 8 municipalities in the Copenhagen metropolitan area. It is one of the largest utility companies in Denmark, serving both private and business customers. HOFOR was formed in 2012 through a merger of several municipal utility companies.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-13 · revision 11

22 direct vendors, 232 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 3/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

HOFOR A/S exhibits low migration readiness, primarily due to the nature of its core operations and the stringent regulatory environment. The most significant challenge is the heavy reliance on specialized Operational Technology (OT) such as SCADA/industrial control systems, large-scale heat pump technology, and wind/solar energy infrastructure. These systems are inherently difficult, costly, and risky to migrate to modern cloud-native architectures due to their proprietary nature, real-time operational requirements, and critical safety implications. The regulatory landscape further complicates migration: GDPR mandates strict data residency for personal data within the EU/EEA, and NIS2 imposes high cybersecurity and supply chain security requirements for critical infrastructure. Additionally, specific Danish national laws may require data localization for utility customer and operational data, severely limiting options for cloud migration, especially to non-EU providers. While HOFOR's strong financial stability provides the capacity to fund migration efforts, the technical and regulatory hurdles for their core business are substantial. The 'unknown' vendor lock-in risk is also a concern, as specialized OT systems often come with vendor-specific solutions and long-term contracts, potentially increasing the complexity and cost of transitioning to new platforms or providers. While some internal IT systems (like WordPress) might be more readily migratable, the core operational infrastructure presents fundamental barriers to a comprehensive cloud migration strategy.

Compliance

12 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

HOFOR has demonstrated substantial GDPR compliance infrastructure: a comprehensive, publicly published privacy policy (Persondatapolitik) with explicit GDPR article citations (Art. 6, 7, 12, 18, 20, 21), a dedicated GDPR contact email (gdpr@hofor.dk), documented legal bases for all processing activities, data processor agreements with IT suppliers, and a structured data subject rights process. The policy was last updated October 2025, indicating active maintenance. However, HOFOR explicitly acknowledges transferring personal data to the USA via Microsoft platforms, which carries ongoing risk following Schrems II and requires reliance on Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework. No public evidence of a formal Data Protection Officer (DPO) appointment was found on the website (though one may exist internally). No GDPR audit reports or Datatilsynet enforcement actions were found. Risk is Medium rather than High because the company has clearly invested in compliance infrastructure, but the US data transfer exposure and absence of publicly confirmed DPO appointment introduce residual risk. The Danish Datatilsynet is an active enforcement authority.

Evidence: https://www.hofor.dk/persondata, https://www.datatilsynet.dk/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

Danish Whistleblower Protection Act — Compliant

HOFOR has implemented a whistleblower scheme (whistleblowerordning) as required by Danish law for companies with 50+ employees. The scheme is publicly disclosed on the company website. Risk is Low as HOFOR has demonstrably implemented the required mechanism.

Evidence: https://www.hofor.dk/kontakt-os/whistleblowerordning-i-hofor/, https://www.retsinformation.dk/eli/lta/2021/1436

Danish Environmental Protection Act — Compliant

HOFOR operates wastewater infrastructure across 8 municipalities and is subject to Danish environmental protection legislation. The company holds ISO 14001 certification (environmental management), which covers wastewater operations. Risk is Medium due to the environmental sensitivity of wastewater operations and potential for regulatory sanctions for environmental violations. HOFOR's ISO 14001 certification and active environmental management program indicate a strong compliance posture.

Evidence: https://www.hofor.dk/wp-content/uploads/2025/08/Certificate-DK018913-ISO-14001-2025.pdf, https://www.hofor.dk/privat/spildevand/leveringsbestemmelser-spildevand/, https://www.retsinformation.dk/eli/lta/2019/1317

Financials

Three-year financials

Financial Resilience Score: 8/10

HOFOR A/S demonstrates strong financial resilience underpinned by its status as Denmark's largest multi-utility with a monopoly-like regulated infrastructure serving approximately 1 million customers in the wealthy Greater Copenhagen region. The company is fully owned by eight capital-region municipalities, with the City of Copenhagen as majority owner, providing implicit backing and access to low-cost funding via KommuneKredit. In May 2025, Copenhagen Municipality injected DKK 4.86 billion in fresh equity, which was used to repay obligation bonds and significantly reduced leverage (assets/equity dropped from 2.5 to 2.0). Profitability has recovered sharply from a loss position in 2021 (EBIT -DKK 598M) to strong operating profits of DKK 1,337M in 2025, with the operating margin rising from 7.5% in 2023 to 16.4% in 2025. Total equity of DKK 22.8 billion and a balance sheet total of DKK 45.8 billion reflect a robust capital base capable of funding an ambitious investment programme (DKK 3.4B in 2025, guided above DKK 4B in 2026). Key risks include a regulatory dispute with Vandsektortilsynet regarding recognition of DKK 1,502M in tariff receivables (flagged as material uncertainty via emphasis-of-matter by Deloitte), elevated CAPEX and interest-rate sensitivity on DKK 14.96B gross debt, electricity price volatility from Amagerværket and renewables, and physical/cyber threats to critical infrastructure. Nonetheless, stable regulated demand, strong municipal ownership, and rising profitability support a high resilience score.

Key strengths: Monopoly-like regulated multi-utility serving ~1 million customers in Greater Copenhagen, Municipal ownership by 8 capital-region municipalities providing implicit backing, Access to low-cost funding via KommuneKredit, DKK 4.86B equity injection from Copenhagen Municipality in May 2025, Strong equity base of DKK 22.8B and moderate leverage (Assets/Equity 2.0), EBIT more than doubled from DKK 557M (2023) to DKK 1,337M (2025), Operating margin rose from 7.5% to 16.4% over three years, Significant investment capacity (DKK 3.4B in 2025, >DKK 4B guided for 2026), ISO 9001/14001/22000/45001 certifications and UN Global Compact signatory

Risk factors: Regulatory dispute over DKK 1,502M tariff receivable (emphasis-of-matter from Deloitte), Elevated CAPEX and interest-rate sensitivity on DKK 14.96B gross debt, Electricity price volatility from Amagerværket biomass plant and renewables, Physical/cyber security threats (placed on orange preparedness in autumn 2025), Biomass and CO2 policy risk; uncertain CCS framework, DKK 33M impairment on solar park in 2025 due to lower future earnings, Talent risk from upcoming retirement wave and skilled labour shortage, Revenue guidance for 2026 lower (DKK 7.5B) due to non-recurring items

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report