Regulatory compliance in cloud Business Central

For a Danish company, compliance in Business Central is first and foremost about two things: the Danish bookkeeping law (bogføringsloven) and GDPR. ISO 27001, SOC reports and industry requirements come after that and are mostly about what Microsoft can document for you.

Here is what Business Central online covers as standard, and what you need to set up or be able to document yourselves.

Understanding your compliance landscape

Start by establishing which rules actually apply to you. Most Danish SMEs deal with the same few.

Common regulatory frameworks

• Bookkeeping law (bogføringsloven) — digital vouchers, five-year retention, a registered bookkeeping system and e-invoicing via NemHandel (the Danish public e-invoicing network)
• GDPR — personal data on customers, contacts and employees: access, rectification, erasure and data portability
• VAT law (momsloven) — correct VAT set-up, VAT settlement and, where relevant, partial right of deduction
• ISO 27001 and SOC 1/2 — relevant when customers or your auditor ask how operations are secured
• SOX — only if you are a subsidiary of a listed US company

Industry-specific rules

• Food, beverages and tobacco: excise duties, stock accounting and traceability with lot or serial numbers
• Pharmaceuticals and medical devices: GxP requirements for validation and traceability
• Retail and e-commerce: the Danish consumer contracts act (forbrugeraftaleloven), receipts and payment cards (PCI DSS — typically handled by the payment provider, not in BC)
• Public-sector customers: a requirement for OIOUBL (the Danish e-invoicing format) or Peppol invoicing via NemHandel

Excise duties are a good example of where the standard set-up rarely goes far enough. Danish duty rules per product group, duty warehouses and reporting typically need both configuration and an extension. It is an area we work with every day.

Organisations that address compliance proactively while planning their cloud migration see 65% fewer compliance-related problems after the migration and complete audits in half the time.

Microsoft's compliance framework

Shared responsibility model

Microsoft's responsibility: data centres, network, servers, database, backup and the Business Central platform itself. And for Danish customers: the registration as a digital bookkeeping system and the daily export of postings and vouchers for five-year retention.

Your responsibility: who has access to what (users, permission sets, MFA in Entra ID), correct set-up of VAT and the chart of accounts, classification of personal data, and making sure your customisations do not break the requirements.

The last point is often overlooked. Microsoft's registration with the Danish Business Authority (Erhvervsstyrelsen) covers the standard solution. If you have extensions that, for example, make it possible to delete or change posted entries, it is your and your partner's responsibility to document that the system still complies with the law. We take that into account when we build extensions.

Microsoft's compliance offering

You can point your auditor or customers to this:

• Registration with the Danish Business Authority as a standard digital bookkeeping system (registration number fob467715)
• ISO/IEC 27001 and 27018 certification
• SOC 1, SOC 2 and SOC 3 reports via the Microsoft Service Trust Portal
• GDPR obligations in Microsoft's data processing agreement (DPA)
• Data stored in Microsoft's European data centres for Danish environments

Configuring Business Central for compliance

Most of the bookkeeping law is switched on automatically in the Danish version: digital vouchers are mandatory on purchase and sales documents, posted entries cannot be deleted or changed, and production companies registered in NemHandel cannot be deleted. But some things you need to set up yourselves.

• Change log on critical tables and fields — chart of accounts, bank accounts, payment terms, user set-up
• Field monitoring with an email alert when someone changes a vendor's bank account. This catches invoice fraud
• Permission sets by role, so the same person cannot both create a vendor and approve payments to it
• Approval workflows on purchase invoices and payment journals
• Retention policies, so logs do not grow uncontrolled

GDPR compliance

Business Central has the tools for the rights GDPR gives data subjects:

• Right of access — the Data Privacy page can export all data about a contact, customer or employee
• Right to rectification — master data is corrected directly on the card
• Right to erasure — master data can be anonymised, but posted entries must be kept for five years under the bookkeeping law. The bookkeeping law wins
• Right to restriction — mark the contact or customer as Privacy Blocked, so no new transactions can be created
• Right to data portability — export to Excel and on to CSV or XML
• Data classification — mark fields as personal or sensitive, so you know where data sits. Remember your own extensions: fields must have DataClassification set