Meet Personopplysningsloven and GDPR duties in Norway with less effort

The Norway Personal Data Act (personopplysningsloven, LOV-2018-06-15-38) is the Norwegian law that makes the GDPR part of Norwegian law through the EEA Agreement. It took effect on 20 July 2018 and replaced the Personal Data Act of 2000. Alongside the GDPR itself, it adds national rules on children's consent, national identity numbers, research, employment data, exemptions from data subject rights, Datatilsynet's role and infringement fines.

Yes. Norway is not an EU member, but the GDPR applies in Norway because it was incorporated into the EEA Agreement and given effect by section 1 of the Personal Data Act. In practice, organisations follow the GDPR in full and then check the Act's supplementary national provisions, such as the age of 13 for children's consent to information society services and the rules on national identity numbers.

Any controller or processor that processes personal data in the activities of an establishment in Norway must comply, in both the private and public sectors. Organisations established outside the EEA are also covered when they offer goods or services to people in Norway or monitor their behaviour there. Purely personal or household activities fall outside the law, and journalistic, academic, artistic and literary purposes have special rules.

Datatilsynet can impose infringement fines under GDPR Article 83, up to EUR 20 million or 4% of worldwide annual turnover for the most serious breaches, whichever is higher. Under section 26 of the Act, public authorities can also be fined. Datatilsynet can set daily coercive fines when its orders are not followed, and courts can award compensation for non-economic loss under section 30.

The Act sets the age of consent for information society services at 13, limits use of national identity numbers to cases with an objective need for secure identification, and adds rules on special category data in employment, research and archiving. It also contains exemptions from information and access rights, a duty of confidentiality for data protection officers, and rules on fake camera surveillance equipment.

ISO 27001 is a voluntary information security standard, while the Personal Data Act is a legal requirement. ISO 27001 does not make you compliant on its own, but its controls provide strong evidence of the appropriate technical and organisational security measures required by GDPR Article 32. Many organisations use ISO 27001 for security and add privacy specific work, such as records of processing and data subject rights, for the Act.

Start with a GDPR programme: map your processing, set a lawful basis for each activity, publish privacy notices, handle data subject requests, sign processor agreements and secure the data. Then check the Norwegian additions that apply to you, such as identity numbers, employee data and research. Keep records and evidence so you can show Datatilsynet how you comply.

The Norway Personal Data Act is mapped in OneClickComply's control library and available on request, rather than live as a standard framework today. Because it builds on the GDPR, the controls, policies and evidence you manage in OneClickComply for GDPR can be reused towards it. Contact us to enable it and to talk to our audit team about Norway-specific requirements.