The Danish Health Data Authority strengthens digital sovereignty

Læge og sygeplejerske tjekker medicinske resultater på computer

The Danish health data authority

A concrete step toward digital sovereignty by modernizing Sundhedsvæsenets Elektroniske Brugerstyring (SEB)

Challenge

Sundhedsvæsenets Elektroniske Brugerstyring (SEB) is a business-critical access management solution that provides access to healthcare data across more than 100 systems. Over time, the platform had become complex and closely tied to specific technologies and vendors. An evolving threat landscape made it necessary to strengthen control and reduce vulnerability.

Solution

The Danish Health Data Authority (Sundhedsdatastyrelsen) and Darize chose a phased, risk-minimizing approach. The first step is to modernize and standardize SEB, followed by migrating the solution to Statens IT, the Danish government’s shared IT service provider. At the same time, capabilities are being anchored within the organization through close collaboration and hands-on knowledge transfer.

Impact

The Danish Health Data Authority is steadily gaining greater control over a business-critical solution. The simplified architecture strengthens resilience and reduces dependencies, while decision-making authority and technical ownership are brought closer to the organization. The project represents a concrete step toward greater digital sovereignty.

Challenge

From global dependency to local control

Today, SEB operates as a public cloud-based solution. However, as the threat landscape has evolved, there has been a growing awareness of the vulnerabilities that can come with relying on global cloud providers.

As Christian Sjunnesson Dybro, Head of Services and User Management at the Danish Health Data Authority, explains:

“There have been cases where major cloud providers have restricted access to systems. That creates a new threat scenario. If someone can cut off a critical component of SEB, they can effectively bring down the entire solution.”

In practice, these considerations revolved around what is now commonly referred to as digital sovereignty.

“We didn’t explicitly call it digital sovereignty, but we discussed how we could make ourselves more resilient in the event that someone on the other side of the Atlantic had similar ideas about Danish healthcare IT,” says Christian Sjunnesson Dybro.

At the same time, SEB had grown increasingly complex over the years and had become closely tied to specific technologies and vendors, making it more difficult to change direction and set priorities on its own terms.

Against this backdrop, the Danish Health Data Authority decided to move SEB from the cloud to the infrastructure operated by Statens IT, the Danish government’s shared IT service provider, thereby placing the solution under Danish jurisdiction while strengthening both organizational and technical ownership.

Solution

Controlled modernization and transition

“SEB had several legacy components and accumulated technical debt that we wanted to address as part of the move. So this is not just a transition, it is also a modernization,” says Christian Sjunnesson Dybro, who continues:

“Moving an operation and making fundamental architectural changes at the same time is both complex and high-risk. That’s why we chose a step-by-step approach and standardized the solution first while it was still running in the cloud.”

The modernization involves reviewing the architecture, reducing dependencies, and moving business logic into a standalone component to provide greater flexibility going forward. The goal is not to move away from the cloud, but to carry forward the automation and deployment principles developed in the cloud into the new operating model.

With a simplified foundation in place, the migration itself can be carried out in a controlled manner with minimal impact on day-to-day operations. Darize supports the planning and coordination with Statens IT, the Danish government’s shared IT service provider, through ongoing risk assessments and milestone management.

Once the transition is fully completed, responsibilities will be clearly defined: Statens IT will manage the underlying infrastructure and operations, while the Danish Health Data Authority remain responsible for the application and the technical oversight.

Competencies and collaboration as a strategic approach

A key part of the project is embedding knowledge and capabilities within the organization. Darize works on-site and as an integrated part of the Danish Health Data Authority’s project organization, not as a traditional external vendor, but as part of a shared team.

The day-to-day collaboration continuously transfers both knowledge and decision-making authority into the organization. As Christian Sjunnesson Dybro explains:

“The ongoing side-by-side knowledge transfer means our internal capabilities are strengthened immediately. We can always ask: I’m working on this right now, does this approach make sense? It’s a return on investment from day one.”

This close working model has also reduced the risk of the classic vendor scenario, where a solution is simply handed over, and the customer is left to determine whether it meets expectations afterward. Instead, the collaboration is characterized by shared ownership and responsibility: “We’ve created a sense of shared purpose around what we’re building, so everyone feels equally responsible. We’re more focused on how we are strong together,” says Christian Sjunnesson Dybro.

For the Danish Health Data Authority, this way of working is therefore not only a matter of efficiency. It also supports the long-term goal of building greater organizational independence.

Trusted partner

“I have great respect for a vendor that is willing to challenge the status quo and point out smarter ways of solving problems. That’s the essence of the collaboration we have with Darize.”

Christian Sjunnesson Dybro

Head of Services and User Management, The Danish Health Data Authority (Sundhedsdatastyrelsen)

Impact

Greater resilience and autonomy

The modernization and migration of SEB are giving the Danish Health Data Authority greater control over a business-critical solution.

The simplified architecture reduces complexity, making the solution easier to maintain and develop further. Fewer dependencies and a clearer division of responsibilities reduce risk and strengthen the resilience of a solution that 150,000 users rely on every month.

At the same time, decision-making authority is brought closer to the organization, enabling priorities, future development, and technical decisions to increasingly be made on its own terms.

For the Danish Health Data Authority, however, digital autonomy is not about standing alone. It is about having the freedom to choose the right partners: “The ultimate goal is to be as independent as possible. Not because we do not want to work with our vendors, but because we should not be dependent on them. A core part of digital sovereignty is having the ability to adapt and evolve over time,” says Christian Sjunnesson Dybro.

This also places new demands on vendor relationships. As clients take on greater ownership, the role of the vendor increasingly becomes one of challenging assumptions and bringing new perspectives to the table: “I have great respect for a partner that is willing to challenge the status quo and suggest smarter ways of doing things. That’s the essence of our collaboration with Darize,” concludes Christian Sjunnesson Dybro.

About the Danish Health Data Authority

The Danish Health Data Authority is an agency under the Ministry of the Interior and Health. It is responsible for delivering integrated health data and digital solutions across the healthcare sector. Its mission is to improve coherence, quality, and decision-making in Danish healthcare for the benefit of patients, healthcare professionals, and research and administrative purposes.