What sources does Taxxa search?

Taxxa searches a continuously updated collection of more than one million pages from tax authorities, government publications, legislation and case law across the European jurisdictions it covers. Every response cites the underlying material, so a professional can inspect the rule, its jurisdiction and whether it is current before relying on the result.

Can Taxxa work with a team’s own documents?

Yes. Research can combine the public knowledge base with a team’s own PDF, DOCX, CSV and TXT files in one workspace. That makes it possible to compare a client document with the relevant guidance, trace a conclusion to its source and prepare a draft without losing the evidence that supports it.

Who is Taxxa built for?

Accountants, auditors, tax advisors, payroll specialists, bookkeepers and advisory teams working across European jurisdictions. Shared workspaces keep research available to colleagues, and citations make review easier.

Where is customer data stored, and is it used to train models?

Customer data stays in the European Union and is never used to train language models.

Does Taxxa replace professional judgement?

No. Taxxa is a research and drafting workspace. It helps professionals reach an informed starting point faster; the professional still reviews the evidence and makes the final decision. It does not file returns, post bookkeeping entries or give legal advice.

DenmarkDatatilsynet

DPA criticises car dealer over breach of 48,000 records

A ransomware attack exposed data of over 48,000 people, including 25,000–30,000 whose data should have been deleted years earlier from a disused server drive.

By Taxxa AI OyPublished 9 November 2026

IT, Cybersecurity & Data

Industry: Across industries

The Danish data protection authority DatatilsynetDatatilsynet has issued alvorlig kritik (serious criticism)Datatilsynet of car dealer Jan NygaardDatatilsynet after a ransomware attack compromised personal dataDatatilsynet of more than 48,000 peopleDatatilsynet, most of them customers. The case turned on data that should not have been there at all: personal data of between 25,000 and 30,000 customers was still sitting on a server driveDatatilsynet that had not been intended for storing personal data for yearsDatatilsynet.

The attacker entered through the dealer's terminal serverDatatilsynet in late December 2024, escalated privileges, and left an encryption and ransom note discovered after the company found its systems inaccessible on 5 January 2025. The dealer reported the breach to Datatilsynet on 6 January 2025. Stolen data included names, addresses, telephone numbers and email addresses, and for smaller groups personnummer (CPR numbers), driving licence details including photos in a few cases, annual tax statements, financial information and, for employees, salary slips in some cases. All affected individuals were notified by 9 April 2025.

The compromised data sat on a server drive used between 2009 and 2022. After the business moved to SharePoint, storage on that drive should have ended, the server should have been decommissioned and the data deleted in 2018Datatilsynet. The dealer told Datatilsynet that a 2018 staff instruction had said personal data should no longer be stored on the drive, but employees kept saving data there out of habit, and nobody in the business owned responsibility for the data on the drive. Datatilsynet did not accept that account as decisiveDatatilsynet: it found that the written instructions still permitted storage on a "fællesdrev" (shared drive)Datatilsynet, so staff could reasonably read the compromised server drive as an allowed locationDatatilsynet.

The dealer had an organisational measure (storage rules) and a technical measure (automatic deletion in SharePoint, where the data should have lived). But from 2018 until the breach it never ran a procedure for the regular testing, assessment and evaluation of whether those measures workedDatatilsynet, as databeskyttelsesforordningens Article 32(1)(d) envisages. It therefore never discovered that data was still accumulating on the old driveDatatilsynet and that the measures were not having their intended effectDatatilsynet.

Datatilsynet's conclusion is that the dealer breached the storage-limitation principle in Article 5(1)(e) of the GDPRDatatilsynet and the security-of-processing duty in Article 32(1)Datatilsynet. The decision stresses a point that reaches beyond this dealer: records of processing under Article 30 and ongoing checks of security measures are not formal requirements but the precondition for meeting the basic principles in practiceDatatilsynet. Breaches discovered only when an attack succeeds affect far more people than they would have if the controller had kept its own deletion deadlines. Decommissioning a server that should hold no personal data is itself one of the most effective safeguards, the decision notes.

Legal basis is Regulation (EU) 2016/679Datatilsynet, Article 5(1)(e) (storage limitation) and Article 32(1) (security of processing), with Article 30 (records of processing) and Article 32(1)(d) (regular testing and evaluation) supporting the reasoning.

Audit disused drives and servers for leftover personal data, decommission storage you no longer need, and check regularly that deletion deadlines and security measures work in practice.

Sources