NorwayIncident Notification by Providers of Essential Societal Services and Digital Services
Lov om digital sikkerhet (digitalsikkerhetsloven), §§ 8 and 11
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors, and to providers of online marketplaces, online search engines and cloud services. Reached by declaring that you operate an essential service, provide financial services, handle health records or operate a social platform.
- Notify the body the King designates, without undue delay and regardless of confidentiality duties, of incidents that significantly affect the delivery of an essential societal service (section 8) or a digital service (section 11).
- As an essential-service provider, send the first notice within 24 hours of becoming aware of the incident, an update within 72 hours, and an incident report within one month of the first notice (digitalsikkerhetsforskriften section 17, as the National Security Authority states it).
- As a digital-service provider, the 24-hour, 72-hour and one-month deadlines do not apply; notify without undue delay (section 11). A provider with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million is outside the notification duty, as the National Security Authority's guide states it.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Security Authority, which the guide says is the supervisory authority for undertakings that do not fall under a designated sector supervisory authority.
Settledness
- As of
What this law does
Section 8 of the Digital Security Act requires a provider of an essential societal service to notify the body designated by the King, without undue delay and regardless of confidentiality duties, of incidents that significantly affect the delivery of the service. Section 11 of the Act imposes the same duty to notify without undue delay on a provider of a digital service.
The National Security Authority states that a provider of an essential societal service must notify within 24 hours of becoming aware of the incident. The Authority states that the first notice is due within 24 hours, an update to the authorities within 72 hours and an incident report within one month of the first notice. The National Security Authority's guide states that the 24-hour, 72-hour and one-month deadlines of the regulation do not apply to a provider of a digital service.
The National Security Authority's guide states that the notification duty does not apply to providers of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million. Section 17 of the Act lets the supervisory authority impose an administrative fine on a provider that intentionally or negligently breaches sections 7, 8, 10, 11 or 14.
The National Security Authority's guide to the Act states that the administrative fine can reach 25 times the National Insurance basic amount or four percent of the preceding year's turnover for an undertaking, whichever is higher, and cannot in any case exceed NOK 50 million. The Act and its regulation entered into force on .
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.