NorwayPersonal Data Act, Breach Notification in Norway
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
What it requires
- Notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Norway, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
These lines are LexLint's reading of the law's text. Also read by: Datatilsynet (the Norwegian Data Protection Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/avvik/hvilke-brudd-skal-meldes-til-datatilsynet/
- Guidance body
- Datatilsynet (the Norwegian Data Protection Authority)
- Open questions
- Can a controller that is not itself a body covered by the Freedom of Information Act withhold information 'etter offentleglova §§ 20 eller 21' (under sections 20 or 21 of the Freedom of Information Act) for the purposes of § 16 first paragraph, letter a, and so rely on it to skip the Article 34 notice to the data subject?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 33(5) requires the controller to document every personal data breach, whether or not it is notified, covering the facts, its effects and the remedial action taken. Those three items are outside the closed list of log contents. The notice to Datatilsynet under Article 33(1) to (4) and the notice to affected people under Article 34 are reports, not records, and section 16 of the Act only limits the Article 34 notice where it would reveal the kinds of information named in section 16(1), letters a, b and d. The Act's territorial clause, section 4, sits outside the provisions this instrument cites, so no jurisdiction hook is stated.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5), applying as Norwegian law through Personal Data Act section 1 (the controller documents every personal data breach)
- Trigger
- security_incident
What this law does
General Data Protection Regulation (GDPR) Articles 33-34, incorporated as Norwegian law through the Personal Data Act: a controller must notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a breach unless the breach is unlikely to result in a risk to natural persons, and must notify affected individuals without undue delay for a breach likely to result in a high risk.
Section 16 of the Act lifts the Article 34 notice to individuals to the extent it would reveal information of the kinds in section 16(1), letters a, b and d. Letter a covers information that matters to Norway's foreign-policy, defence or security interests and that the controller may withhold under the Freedom of Information Act. Letter b covers information that must be kept secret to prevent or investigate offences. Letter d covers information a law makes confidential.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .