{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Advokatfirmaet Thommessen AS","Christopher Clausen"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","Norway"]
["Key Legislation Overview"]
["1. What is the key legislation?","The key legislation governing privacy and the processing of personal data in Norway is (i) the \nGeneral Data Protection Regulation (Regulation (EU) 2016/679 – the \"GDPR\") and (ii) the \nNorwegian Personal Data Act of 2018 (the \"Act\"). The \nAct implements the \nGDPR into Norwegian law and furthermore includes supplemental provisions regarding privacy and the processing of personal data. \nBoth the \nGDPR and the \nAct are further supplemented by regulations enacted under the \nAct, as well as sector-specific legislation, inter alia concerning the processing of personal data in the health and finance sectors.\n\n \n"]
["2. What are the key decisions applying that legislation?","Norwegian Parliament decision 22 May 2018, adopting the \nAct. "]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?","The definitions are set out in \nGDPR art. 4(1) and 9(1) respectively. \nPersonal data means any information relating to an identified or identifiable natural person (this person is referred to as the \"data subject\"). An identifiable natural person is one who can be identified (directly or indirectly) in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Accordingly, the \nGDPR and the \nAct do not apply to personal data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.\nThe\n GDPR operates with two sub-categories of personal data, i.e., \"special categories of personal data\" and personal data relating to criminal convictions and offenses. Special categories of personal data are:  \n\nData revealing racial origin, ethnic origin, political opinions, religious beliefs, philosophical beliefs, or trade union membership; the processing of genetic data or biometric data for the purpose of uniquely identifying a data subject; and health data, as well as data concerning a data subject's sex life or sexual orientation. \n"]
["2. How is the defined data protected?","The data is protected through the obligations set out in the \nGDPR and the \nAct on all who process personal data, see below. \n"]
["3. Who is subject to privacy obligations?","  The GDPR and the Act apply to \"controllers\" and \"processors\" who are engaged in activities falling within the scope of the GDPR or the Act . \n The controller is defined as the person(s) (individual and/or legal entity) that, alone or jointly with others, determines the purpose and means of the processing of personal data. \n The processor is defined as the person(s) (individual and/or legal entity) that processes the personal data on behalf of the controller. \n The controller is the party with the general responsibility to comply with privacy obligations set forth in the GDPR and the Act . The processor is subject to specific legal obligations under the GDPR and the Act , such as the security obligations under  GDPR Article 32(1).   \n The GDPR and the Act apply to: \n \n The processing of personal data in the context of the activities of an establishment of a controller or a processor in the European Economic Area (the \" EEA \") or Norway, respectively, regardless of whether or not the processing takes place in the EEA ; \n The processing of personal data of data subjects who are in the EEA or Norway, respectively, by a controller or processor not established in the EEA , where the processing activities are related to: \n The offering of goods or services to the above data subjects; or \n The monitoring of their behavior as far as their behavior takes place within the EEA or Norway.  \n "]
["4. How is “data processing” defined?","As per \nGDPR art. 4(2) processing means any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means. Examples of operations that are regarded as processing are the collection, recording, storage, adaptation or alteration of personal data. \n"]
["5. What are the principles applicable to personal data processing?"," Any processing of personal data, including the collection of personal data, must be performed in compliance with the GDPR and the Act .  \n\n Article 5 of the GDPR sets forth the main principles relating to the collection and processing of personal data and stipulates that personal data must be:  \n\n \n\t Processed lawfully, fairly, and in a transparent manner in relation to the data subject; \n\t Collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; \n\t Adequate, relevant and limited to those which are necessary in relation to the purposes for which they are processed; \n\t Kept in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and \n\t Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. \n \n\n The controller is responsible for and must be able to demonstrate its compliance with the above principles.  \n\n Furthermore, under GDPR Articles 12-14, the controller is required to inform the data subjects about the controller's processing of their personal data. \n"]
["6. How is the processing of personal data regulated?"," The collection, use, and/or disclosure of personal data requires a legal basis under GDPR Article 6. \n A controller that intends to process special categories of personal data must identify both a legal basis under GDPR Article 6 and satisfy one of the alternative conditions for processing special categories of personal data under GDPR Article 9. \n The processing of personal data relating to criminal convictions and offenses requires a legal basis under GDPR Article 6, and must be (i) carried out only under the control of an official authority, or (ii) be authorized under  EEA or EEA member state law. \n Pursuant to GDPR Article 6, processing of personal data shall be lawful if one of the following legal bases applies: \n \n Consent – the data subject has consented to the processing; \n Contract – the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract; \n Legal obligation – the processing is necessary for compliance with a legal obligation to which the controller is subject; \n Vital interests – the processing is necessary in order to protect the vital interests of the data subject or of another natural person; or \n Legitimate interest test – the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. \n \n The processing of special categories of personal data is furthermore only permitted if one of the following ten conditions under GDPR Article 9 is satisfied: \n \n Explicit consent – the data subject has given explicit consent to the processing of those personal data for one or more specified purposes unless the relevant processing activity is prohibited under EEA or EEA member state law; \n Obligations in the field of employment, social security and social protection law – the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject (i) in the field of employment, social security and social protection law in so far as it is authorized by EEA  or EEA member state law, or (ii) a collective agreement pursuant to EEA member state law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; \n Vital interests – the processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; \n Foundations, associations or other not-for-profit bodies – the processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects; \n Certain public data – the processing relates to personal data that are manifestly made public by the data subject; \n Legal claims – the processing is necessary for the establishment, exercise or defense of legal claims or whenever courts are acting in their judicial capacity; \n Substantial public interests – the processing is necessary for reasons of substantial public interest, on the basis of EEA or EEA member state law which must be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; \n Preventive or occupational medicine etc. – the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of EEA or EEA member state law or pursuant to contract with a health professional; \n Public interest in the area of public health – the processing is necessary for reasons of public interest in the area of public health, on the basis of EEA or EEA member state law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular, professional secrecy;  \n Archiving, scientific, historical research, or statistical purposes – the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with  G DPR Article 89, based on EEA or EEA member state law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. \n "]
["7. How are storage, security and retention of personal data regulated?"," Storage: Storing personal data is regarded as a processing activity. Accordingly, the storing of personal data must be conducted in compliance with the requirements under the  GDPR and the Act , including the main principles relating to the processing of personal data set forth in Article 5 of the GDPR (as further described above). \n Security: Pursuant to GDPR Article 32, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing. Examples of such security measures are: \n \n The pseudonymization and encryption of personal data; \n The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; \n The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;  and \n A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.  \n \n Retention: \n Pursuant to GDPR Article 17, personal data shall, as a rule inter alia, be deleted if: \n \n The personal data are no longer necessary in relation to the purposes for which they were collected; \n The data subject withdraws his/her consent, and the processing is based on the data subject's consent; or \n The personal data has been unlawfully processed.   \n "]
["8. What are the data subjects' rights under the data legislation?","There are, inter alia, rights of access to and correction of personal data under the \nGDPR and the \nAct. Access: Pursuant to \nGDPR Article 15, the data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning him or her is being processed. The data subject has furthermore a right to obtain access to the personal data and information relating to the processing, such as the purpose of the processing and the categories of personal data concerned. \nCertain exemptions to the data subject's right of access are set forth in Section 16 of the \nAct. Under Section 16 of the \nAct, the controller is inter alia not obligated to provide access to information (i) which is subject to a statutory duty of confidentiality, or (ii) which is only included in text drafted for internal case preparation, and which has not been disclosed to third parties.\nCorrection: Pursuant to \nGDPR Article 16, the data subject has the right to obtain from the controller the correction/rectification of inaccurate personal data concerning him or her, and to have incomplete personal data completed.\nOther rights: The data subject furthermore has the right to erasure, to restrict processing, to data portability, to object to the processing of personal data, as well as rights in relation to automated decision making and profiling, under \nGDPR Chapter 3.\n"]
["9. What are the consent requirements for data subjects?","It follows from \nGDPR art. 7 that the consent must be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. The consent shall be as easy to withdraw as it was to give it. It must also be freely given. The controller must be able to demonstrate that consent is given. \n"]
["10. How is authorization for use of data handled?","Pursuant to art. 6 and 9 of the \nGDPR, processing of personal data requires a legal basis - see above for further specification. \n"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?"," The GDPR restricts transfers of personal data to (i) countries outside the EEA (so-called \"third countries\"), and (ii) to international organizations. Such transfers may only be carried out if the transfer has a legal basis under Chapter 5 of the GDPR .   \n Pursuant to GDPR Article 45, transfers of personal data to a third country or an international organization may take place on the basis of a so-called adequacy decision. An adequacy decision entails that the EU Commission has decided that the relevant third country (or a territory or one or more specified sectors within that third country), or the international organization, ensures an adequate level of protection for individuals' rights and freedoms for their personal data.   \n In the absence of an adequacy decision, the transfer must be covered by one of the appropriate safeguards under GDPR Article 46, or by the derogations for certain specific situations under GDPR Article 49.   \n An appropriate safeguard is pursuant to GDPR Article 46: \n \n A legally binding and enforceable instrument between public authorities or bodies; \n Binding corporate rules established in accordance with GDPR Article 47;  \n Standard data protection clauses (often referred to as \"Standard Contractual Clauses\" or \"model clauses\" adopted by the EU Commission;  \n Standard data protection clauses adopted by a supervisory authority and approved by the EU Commission;  \n An approved code of conduct together with binding and enforceable commitments of the receiver outside the EEA or an international organization;  \n Certification under an approved certification mechanism together with binding and enforceable commitments of the receiver outside the EEA or an international organization;  \n Contractual clauses authorized by the supervisory authority; or   \n Administrative arrangements between public authorities or bodies include enforceable and effective data subject rights.  \n \n Furthermore, controllers and processors relying on GDPR Article 46 safeguards to transfer personal data to third countries must ensure that the safeguards are not undermined by the laws and practices of the destination country. This requirement follows from the Court of Justice of the European Union's judgment C-311/18 (often referred to as the \" Schrems II Decision \") and has been further elaborated by the European Data Protection Board's Recommendations 01/2022 . \n As mentioned above, in the absence of an adequacy decision pursuant to GDPR Article 45, and an appropriate safeguard pursuant to GDPR Article 46, personal data may be transferred to a third country or to an international organization if the transfer is covered by one of the derogations under GDPR Article 49. GDPR Article 49 stipulates that the aforementioned transfer may take place if: \n \n The data subject has explicitly consented to the transfer, after being informed of the possible risk of such transfers;  \n The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;  \n The transfer is necessary for important reasons of public interest;  \n The transfer is necessary for the establishment, exercise or defense of legal claims;  \n The transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; or  \n The transfer is made from a register that, according to EEA law or EEA member state law, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest. \n \n However, it should be noted that transfers pursuant to GDPR Article 49 should only take place on an ad hoc basis.  "]
["12. How are data \"incidents\" and \"breaches\" defined?","Pursuant to \nGDPR Article 4, a \"personal data breach\" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.\n"]
["13. Are there any notification requirements for incidents and/or data breaches?","Controllers and processors are subject to notification requirements under \nGDPR Article 33 and \nGDPR Article 34.\nPursuant to Article 33 of the \nGDPR, the controller shall notify the competent supervisory authority of any \"personal data breach\" without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.\nA processor is pursuant to \nGDPR Article 33 obligated to notify the controller without undue delay after becoming aware of a personal data breach.\nFurthermore, if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller is, as a main rule, also obligated to, without undue delay, communicate the personal data breach to the affected data subjects, cf. Article 34.\n"]
["14. Who is/are the privacy regulator(s)?","The privacy regulator in Norway is the Norwegian Data Protection Authority (the \"\nNDPA\"). The \nNDPA is an independent administrative body subordinate to the Norwegian King and the Norwegian Ministry of Local Government and Regional Development. The King and the Ministry may not issue instructions or reverse the \nNDPA's decisions in individual cases. The \nNDPA is inter alia responsible for monitoring and enforcing compliance with the \nGDPR and the \nAct.\nDecisions made by the \nNDPA may inter alia be appealed to the Norwegian Privacy Appeals Board.\n"]
["15. What are the consequences of a data breach?"," Introduction: The NDPA has several corrective powers, and may, inter alia, sanction infringements of the GDPR or the Act with administrative fines. The NDPA may also order controllers and processors to cease processing activities that do not comply with the aforementioned privacy legislation or impose conditions that must be met in order to ensure that the processing is in compliance with the GDPR or the Act . Infringements of the GDPR may also be sanctioned by other supervisory authorities in the EEA (i.e., other EEA data protection authorities than the NDPA ). \n Any person who has suffered material or non-material damage as a result of an infringement of the GDPR or the Act has the right to receive compensation for the damage suffered. \n Administrative fines: There are two sets of maximum administrative fines under the GDPR .  \n Infringements of the following provisions of the GDPR are subject to administrative fines up to EUR 20,000,000, or in the case of an undertaking, up to four percent of the total worldwide annual turnover of the preceding financial year, whichever is higher: \n \n GDPR Articles 5, 6, 7 and 9 (the principles relating to the processing of personal data); \n GDPR Articles 12 to 22 (rights of the data subject); \n GDPR Articles 44 to 49 (transfers of personal data to countries outside the EEA or to international organizations);  \n Non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to GDPR Article 58; or \n Failure to comply with the supervisory authority's investigation pursuant to GDPR Article 58. \n \n For other infringements, the maximum administrative fines are EUR 10,000,000, or in the case of an undertaking, up to two percent of the total worldwide annual turnover. \n Compensation and Liability: As mentioned above, data subjects may under GDPR Article 82 and Section 30 of the Act also claim compensation for any material or non-material damage as a result of an infringement of the GDPR or the Ac t. "]
["16. How is electronic marketing regulated?","It is prohibited under Section 15 of the \nNorwegian Marketing Control Act, in the course of trade and without the prior consent of the recipient, to direct marketing communications at physical persons using electronic methods of communication that permit individual communication. Such electronic methods of communication inter alia include emails, text messages and automated calling systems/robocalls. The consent must be freely given, specific and informed.\nHowever, marketing by means of electronic messages without the prior consent of the recipient is permitted if there exists a customer relationship and the contracting trader has obtained the electronic address of the customer in connection with a sale. The marketing may only relate to the trader’s own goods or services corresponding to those on which the customer relationship is based. The customer must be given a simple and free-of-charge opportunity to opt out of receiving such marketing communications when the electronic address is obtained, and at the time of any subsequent marketing communication. \n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?","There are several industry-specific privacy requirements, such as in the health sector, the educational sector and finance sector. \n"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?"," Pursuant to GDPR art. 37, the controller and the processor shall designate a data protection officer in any case where: \n \n the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; \n the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or \n the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10. \n \n A group of undertakings may appoint a single data protection officer, provided that a data protection officer is easily accessible from each establishment. The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority. "]
["19.\tWhat are the record-keeping and documentation obligations?","Pursuant to \nGDPR art. 5(2), the controller shall be able to demonstrate their compliance with the \nGDPR. Furthermore, the controller must demonstrate that valid consents are in place when required. Moreover, pursuant to \nGDPR art. 30, the controller and the processor shall keep a record of processing activities with the details listed in \nGDPR art. 30 included. \n"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?","As per \nGDPR art. 35, where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. The controller shall consult the data protection officer (if any). In addition, the \nNDPA has published a list of when \nDPIAs are required in Norway, available here: \nhttps://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/vurdering-av-personvernkonsekvenser/nar-ma-man-gjennomfore-en-vurdering-av-personvernkonsekvenser/  (also available in English) \n"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?","Third-party data sharing requires a legal basis pursuant to \nGDPR art. 6, as well as \nGDPR art. 9 if there are special categories of personal data involved. If the vendor is a processor, no specific legal basis is needed for the processor's processing of personal data as such, but a valid data processing agreement which meets the requirements of \nGDPR art. 28 must be entered into. \n"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?","Please see the information provided under \"\nconsequences\" above. \n"]
["23.\tWhat are the ongoing compliance and audit requirements?","There are no specific audit or compliance requirements other than the general requirements to comply with the Act and the \nGDPR. \n"]
["24. Are there any recent developments or expected reforms?","The Norwegian government has launched a consultation for input to potential reform of the \nAct and the \nGDPR (to the extent permitted under EU law): \nhttps://www.regjeringen.no/no/dokumenter/etterkontroll-av-personopplysningsloven-invitasjon-til-a-komme-med-innspill/id3047095/. The consultation period closed on 1 November 2024, and there are no proposed amendments published to date. \nFurthermore, the government has proposed to increase the consent age for social media from 13 to 16 years: \nhttps://www.regjeringen.no/contentassets/da5340ace79941afad938ab18985e042/horingsnotat-lov-om-aldersgrense-for-bruk-av-sosiale-medier.pdf \n"]