The Danish Data Protection Authority (Datatilsynet) issued a formal reprimand to Copenhagen Municipality (Københavns Kommune) regarding its use of the school communication platform Aula. The regulator determined that the municipality failed to conduct a compliant data protection impact assessment and did not fully demonstrate that appropriate security measures were implemented to mitigate risks such as unauthorized access. The investigation followed public reports that the municipality had been utilizing the platform’s secure file-sharing module to store sensitive child welfare and health records without performing the necessary risk assessments.