NorwayPersonal Data Act and GDPR Chapter V, Cross-Border Transfer from Norway
Personopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 44-49
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Norway outside the European Economic Area.
These lines are LexLint's reading of the law's text. Also read by: Datatilsynet (the Norwegian Data Protection Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/overforing-av-personopplysninger-ut-av-eos/
- Guidance body
- Datatilsynet (the Norwegian Data Protection Authority)
- Open questions
- Does a European Commission adequacy decision under Article 45 of the Regulation apply in Norway as soon as the Commission adopts it, or only once the EEA Joint Committee has incorporated it, given that § 1 makes the Regulation apply 'med de tilpasningene som følger av vedlegg XI, protokoll 1 og avtalen for øvrig' (with the adaptations that follow from Annex XI, Protocol 1 and the Agreement otherwise)?
What it makes you log
Who may demand the log
Regulator
Logging duty
For a transfer to a third country that relies on the compelling legitimate interests derogation in the second subparagraph of Article 49(1), the controller or processor documents its assessment and the suitable safeguards in its Article 30 records. The duty to inform Datatilsynet of such a transfer in Article 49(1) is a notice, not a record. Binding corporate rules must also provide for data protection audits under Article 47(2)(j). The Act's territorial clause, section 4, sits outside the provisions this instrument cites, so no jurisdiction hook is stated.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 49(6), applying as Norwegian law through Personal Data Act section 1 (the assessment and safeguards behind a derogation transfer are documented in the Article 30 records)
- Trigger
- personal_data_processing
Why the legislator wanted it
The recital's first sentence gives the other purpose: the controller or processor keeps the records "in order to demonstrate compliance with this Regulation".
- As of
- Quote
- Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.
- Source link
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
- regulator_supervision
What this law does
Transfers within the EEA, including to EU member states, are unrestricted; the restriction applies to transfers to third countries outside the EEA. General Data Protection Regulation (GDPR) Chapter V, incorporated as Norwegian law through the Act, permits such a transfer only on an adequacy decision, appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Chapter 3 contains no Norway-specific provision narrowing or broadening this beyond the incorporated GDPR text.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .