Duty LXD-0992
Processes personal data, in Norway
Personal Data Act (personopplysningsloven)since 3 lines
Lov om behandling av personopplysninger (personopplysningsloven), LOV-2018-06-15-38, in force · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Norway, including data collected by crawling.
- Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Personal Data Act Section 5.
- Ground the processing of a Norwegian national identity number (fodselsnummer) or other unique identifier on a legitimate need for secure identification, under Personal Data Act Section 12.
Personal Data Act, Data Subject Rights in Norwaysince 1 line
Personopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 12-21; §§ 16 and 17 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Norway within one month of receipt.
Personal Data Act, Breach Notification in Norwaysince 3 lines
Personopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 33-34; § 16 · Read the law's page
- Notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Norway, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
Personal Data Act and GDPR Chapter V, Cross-Border Transfer from Norwaysince 1 line
Personopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Norway outside the European Economic Area.
Personal Data Act Chapter 7, Datatilsynet Enforcement in Norwaysince 2 lines
Personopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 82-83; §§ 26 to 30 · Read the law's page
- Expect Datatilsynet to have direct administrative-fine authority over your processing of personal data of a person in Norway, under Personal Data Act Section 26.
- Expect any person who suffered damage from an infringement, including non-economic harm, to have a right to compensation from you as controller or processor, under Personal Data Act Section 30.