Lyngby-Taarbæk Kommune

Denmark · owned by Independent (Denmark) · ltk.dk · 16 vendors

Lyngby-Taarbæk Kommune is a Danish municipal authority located north of Copenhagen, responsible for delivering public services to its residents. It provides a wide range of services including citizen affairs, childcare and schools, social support, healthcare, urban planning, and environmental management. The municipality is governed by an elected municipal council (Kommunalbestyrelse) and is headquartered at Lyngby Rådhus.

Resilience scores

Technology vendors

Insights

Last updated 2026-08-02 · revision 23

16 direct vendors, 225 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 3/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Lyngby-Taarbæk Kommune exhibits low migration readiness, primarily due to a highly complex regulatory and data residency environment. The most significant challenge is the stringent set of data residency and sovereignty requirements. GDPR Chapter V imposes strict rules on third-country data transfers, which LTK's privacy policy acknowledges as occurring with some processors. Danish public sector cloud guidance, NIS2, the Danish Archives Act (Arkivloven), and specific requirements for CPR numbers and health data (Sundhedsloven) collectively create a strong de facto requirement to prefer EU/EEA-based data storage and processing. These constraints severely limit vendor choice and increase the complexity and cost of any cloud migration strategy, requiring meticulous planning for data placement and legal compliance. The "Partially Compliant" or "Assessment Required" status for GDPR, Danish DPA, NIS2, and the Danish NIS2 Act means these compliance gaps must be addressed as part of, or prior to, any migration. While GCP is in use, the extent of cloud-native architecture (e.g., containerization, microservices) is not specified, suggesting potential reliance on legacy components like Umbraco CMS and GIS systems which can be complex to re-platform. The contradictory vendor data ("Total Vendors: 0" but 7 HQ countries) means specific vendor lock-in risks are unknown, but the lack of detailed information itself presents a challenge, as hidden dependencies could complicate migration efforts. Deep integrations with national platforms (MitID, borger.dk, Virk.dk) are essential but can add complexity to re-architecting services. Opportunities include the existing adoption of Google Cloud Platform, which provides a foundation and internal experience with cloud technologies, and consistent revenue growth, which offers a stable financial base to fund necessary investments in migration and compliance.

Compliance

8 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Lyngby-Taarbæk Kommune is a Danish public authority that processes extensive volumes of highly sensitive personal data across all its service areas — including health records (Center for Sundhed og Omsorg), social care data (Center for Social Indsats), children and family data (Center for Uddannelse og Pædagogik), employment and benefits data (Center for Borgerservice, Arbejdsmarked og Kultur), and HR/recruitment data. The volume and sensitivity of data processed (including special category data under GDPR Art. 9 such as health, ethnicity, religion, and trade union membership) creates a structurally elevated risk profile. The municipality explicitly acknowledges third-country data transfers to processors outside the EU/EEA, which is a known compliance risk area under Schrems II and the post-2023 SCCs framework. Danish Datatilsynet has a track record of investigating and sanctioning public authorities. While a DPO is formally appointed and a privacy policy is published, the status is 'Partially Compliant' because third-country transfer safeguards, data processor agreements, and ongoing compliance monitoring cannot be fully verified from public sources alone.

Evidence: https://www.ltk.dk/om-kommunen/privatlivspolitik, https://www.ltk.dk/om-kommunen/privatlivspolitik/saadan-behandler-vi-dine-persondata-i-center-for-sundhed-og-omsorg, https://www.ltk.dk/om-kommunen/privatlivspolitik/saadan-behandler-vi-dine-persondata-i-center-for-social-indsats, https://www.ltk.dk/om-kommunen/privatlivspolitik/saadan-behandler-vi-dine-persondata-i-center-for-borgerservice-arbejdsmarked-og-kultur, https://www.ltk.dk/om-kommunen/privatlivspolitik/saadan-behandler-vi-dine-persondata-ved-rekruttering-til-ledige-stillinger, https://www.datatilsynet.dk/hvad-siger-reglerne, https://ltk.dk

ISO 27001 (source) — Assessment Required

ISO 27001 is not a mandatory legal requirement for Danish municipalities, but it is strongly recommended by the Danish Agency for Digitisation (Digitaliseringsstyrelsen) and is the de facto standard for public sector information security in Denmark. Under NIS2 (now transposed into Danish law), municipalities classified as Essential Entities are required to implement risk-based cybersecurity measures that align closely with ISO 27001 controls. The risk level is Medium because: (1) non-certification does not constitute a legal violation per se, but absence of an ISMS increases NIS2 compliance risk; (2) the municipality processes large volumes of sensitive personal data, making robust information security critical; (3) Danish public authorities have been subject to increasing cyber threats (ransomware, phishing) as documented by CFCS annual threat assessments. No public evidence of ISO 27001 certification was found.

Evidence: https://www.digst.dk/styring/informationssikkerhed/, https://ltk.dk

NIS2 (source) — Assessment Required

NIS2 explicitly lists 'public administration' as an Essential Entity sector (Annex I), and Danish municipalities are large public authorities that unambiguously exceed the 50-employee and €10M turnover thresholds. Denmark transposed NIS2 into national law via the 'Lov om sikkerhed i net- og informationssystemer' (NIS2-loven), which entered into force on 1 November 2024. Lyngby-Taarbæk Kommune additionally operates district heating infrastructure (fjernvarme.ltk.dk) and a light rail project (letbane.ltk.dk), which may independently qualify it as an Essential Entity under the energy and transport sectors. Non-compliance with NIS2 carries significant administrative fines (up to €10M or 2% of global turnover for Essential Entities) and reputational risk. The risk level is High because: (1) the municipality is almost certainly in scope as a public administration Essential Entity; (2) cybersecurity maturity in Danish municipalities has been flagged as uneven by the Danish Centre for Cyber Security (CFCS); (3) NIS2 obligations (incident reporting within 24/72 hours, supply chain security, governance requirements) are operationally demanding for public sector entities.

Evidence: https://www.ltk.dk, https://fjernvarme.ltk.dk/, https://letbane.ltk.dk/, https://www.cfcs.dk/da/cybersikkerhed/nis2/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

Financials

Three-year financials

Financial Resilience Score: 8/10

Lyngby-Taarbæk Kommune is a financially resilient, high-income Copenhagen-region Danish municipality with a strong and growing tax revenue base of approximately DKK 5.1 billion in 2024. The municipality delivered a substantial annual surplus of DKK 226 million in 2024, more than tripling the DKK 72 million surplus of 2023, and restored liquidity to DKK 205 million at year-end (from -DKK 38 million at end-2023). Average liquidity for 2024 was DKK 445 million, well above the target minimum of DKK 200 million set in the new economic policy. The balance sheet is solid, with equity of DKK 2.69 billion supported by substantial real-estate holdings (DKK 2.48 billion) and financial assets (DKK 1.38 billion, including 100% ownership of Lyngby-Taarbæk Forsyning A/S). Long-term debt is manageable at DKK 659 million, much of it offset by matching assets. As a Danish municipality, the entity benefits from the equalisation system, statsgaranti option, and de facto Danish sovereign credit standing. Principal ongoing risks include structural cost pressures on specialised social services (children in need, adult social care), elderly-care demographic pressures with persistent overspend, property-tax valuation uncertainty causing revenue shortfalls (DKK 24.3M mindreindtægt on grundskyld in 2024), and DKK 4.82 billion in contingent guarantee obligations largely covering social housing and utility joint ventures. These risks are actively managed through action plans (handleplaner) and multi-year budget frameworks.

Key strengths: Strong and growing tax revenue base of ~DKK 5.1B in 2024 (+9.7% YoY), Substantial annual surplus of DKK 226M in 2024, up from DKK 72M in 2023, Positive equity of DKK 2.69B with substantial real-estate and financial holdings, Restored liquidity: average DKK 445M in 2024, year-end DKK 205M, High-income Copenhagen-region municipality with wealthy tax base, Danish sovereign-quality risk profile via equalisation system, Income tax base grew ~20.7% over 2021-2024 (~6.5% p.a.), Modest population growth of ~1.5% over 3 years to 58,713

Risk factors: Structural cost pressure on specialised social services (children, adult social care), Persistent overspend on elderly care (DKK 15.1M in 2023) with demographic pressures, Tenestemandspension liability of DKK 1.21B, recalculated 2025, Property-tax valuation uncertainty (DKK 24.3M shortfall on grundskyld in 2024), DKK 4.82B in contingent guarantee obligations (social housing, utilities), Net contributor to equalisation system - paid DKK 1,620.8M into landsudligning in 2024, Capital program execution delays affecting cash-flow forecasting, DKK 20.6M tax-sanction paid in 2024 (falls away from 2025)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report