The Danish Data Protection Authority (Datatilsynet) issued formal reprimands and enforcement orders to five Danish municipalities—Lolland, Esbjerg, Hillerød, Randers, and Frederikshavn—following an audit of their security practices on the school communication platform AULA. The regulator found that the municipalities failed to document adequate risk assessments and did not meet the minimum requirements for Data Protection Impact Assessments (DPIAs). As a consequence, the municipalities received formal criticism, and two were ordered to complete compliant DPIAs within three months.