Norway

General Data Protection Regulation (GDPR) Articles 33-34, incorporated as Norwegian law through the Personal Data Act: a controller must notify Datatilsynet without undue delay, and within 72 hours where feasible, after becoming aware of a breach unless the breach is unlikely to result in a risk to natural persons, and must notify affected individuals without undue delay for a breach likely to result in a high risk.

Section 16 of the Act lifts the Article 34 notice to individuals to the extent it would reveal information of the kinds in section 16(1), letters a, b and d. Letter a covers information that matters to Norway's foreign-policy, defence or security interests and that the controller may withhold under the Freedom of Information Act. Letter b covers information that must be kept secret to prevent or investigate offences. Letter d covers information a law makes confidential.

Norway is not an EU member; General Data Protection Regulation (GDPR) reaches Norway through the EEA Agreement, incorporated by Norway's own Personal Data Act (personopplysningsloven), not as directly applicable EU law. Section 1 provides that the Regulation, Annex XI item 5e of the EEA Agreement, applies as Norwegian law with the adaptations that follow from Annex XI, Protocol 1 and the Agreement otherwise.

Chapter 3 sets the digital age of consent for information society services at 13 (Section 5) and governs national identity number (fodselsnummer) processing (Section 12). Datatilsynet is the supervisory authority, institutionally distinct from Denmark's identically named authority.

Section 12a, which the Storting added by an amendment passed on 4 December 2018, lets public authorities disclose personal data to one another where necessary to prevent, detect, forestall or sanction workplace crime, and does not extend to the special-category data of GDPR Article 9; that amending act takes effect from the time the King decides. The Storting's text of the Act dates from its passage in 2018, so amendments made since, other than Section 12a, are not carried by that source.

Transfers within the EEA, including to EU member states, are unrestricted; the restriction applies to transfers to third countries outside the EEA. General Data Protection Regulation (GDPR) Chapter V, incorporated as Norwegian law through the Act, permits such a transfer only on an adequacy decision, appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Chapter 3 contains no Norway-specific provision narrowing or broadening this beyond the incorporated GDPR text.

The Personal Data Act (§ 1) makes Regulation (EU) 2016/679, as incorporated into the EEA Agreement, law in Norway, and adds no rule of its own on automated decisions.

General Data Protection Regulation (GDPR) Article 22 gives a person in Norway the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under the Regulation's Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of a proportionate law, with suitable safeguards in place.

Its Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

General Data Protection Regulation (GDPR) Articles 12 to 21, incorporated as Norwegian law through the Personal Data Act: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller.

Section 16(1) of the Act excludes from the Article 13 to 15 rights to information and access the information described in letters a to f. Letter a covers information that matters to Norway's foreign-policy, defence or security interests and that the controller may withhold under sections 20 or 21 of the Freedom of Information Act. Letter b covers information that must be kept secret to prevent, investigate, detect or prosecute offences.

Letter c covers information it would be inadvisable for the person to learn, because of their health or their relationship with people close to them. Letter d covers information subject to a duty of confidentiality set by or under a law. Letter e covers information that exists only in text prepared for internal case preparation and not given to others, so far as refusing access is necessary to ensure sound internal decision processes.

Letter f covers information whose disclosure would conflict with obvious and fundamental private or public interests.

Section 17(1) of the Act disapplies the Article 15 right of access for processing for archiving in the public interest, scientific or historical research or statistical purposes carried out in accordance with Article 89(1) of the Regulation, so far as giving access would take a disproportionate effort or would probably make the aims of the processing impossible or seriously impair them.

Section 17(2) disapplies the Article 16 and 18 rights to rectification and restriction for the same processing, so far as they would probably make the aims impossible or seriously impair them. Section 17(3) provides that neither exclusion applies where the processing has legal effects or direct factual effects for the person.

Unlike Denmark, Norway's Datatilsynet imposes administrative fines directly rather than routing them through the criminal courts.

Chapter 7 of the Act: Section 26 lets Datatilsynet impose administrative fines under General Data Protection Regulation (GDPR) Article 83; Section 27 gives a four-week compliance deadline from a final fine decision, with court review available; Section 28 sets a five-year limitation period from when the violation ceased; Section 29 lets Datatilsynet impose a daily coercive fine for continued non-compliance; and Section 30 cross-references GDPR Article 82, letting a liable party also be ordered to pay compensation for non-economic harm.

Section 26's fining power is stated in terms of public authorities; whether the same or a separate mechanism reaches private controllers is not confirmed against Section 26's exact Norwegian text.

General Data Protection Regulation (GDPR) Article 9(1), incorporated as Norwegian law through the Personal Data Act, classifies biometric data processed for unique identification as a special category. Chapter 3 of the Act contains no biometric-specific provision and no enumeration of biometric examples, so the special category here is the incorporated GDPR one without Norwegian elaboration.

Section 204 punishes, with a fine or imprisonment of up to two years, a person who gains access to a computer system or part of it by breaching a protection measure or by another unauthorised method. The provision sits in Chapter 21 (Protection of Information and the Exchange of Information), added to the Penal Code by the Act of 19 June 2009 No. 74.

Because the offence's trigger is breaching a protection measure, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Section 24 gives the producer of a database, such as a form, catalogue, table, program or similar work resulting from a substantial investment in collecting, checking or presenting its contents, an exclusive right to control extraction from or reuse of all or a substantial part of the database's contents, and this right applies correspondingly to repeated or systematic extraction or reuse of immaterial parts of the database that is harmful to its normal use or that unreasonably sets aside the producer's legitimate interests.

The right subsists for 15 years after expiry of the year the database was produced, or, if the database is published within that period, for 15 years after expiry of the year of first publication. The Act's own list of the EU/EEA directives it implements includes Directive 96/9/EC on the legal protection of databases, but does not include a text-and-data-mining exception.

Section 1 of the DORA Act gives Regulation (EU) 2022/2554 the force of law in Norway, with the adaptations that follow from the EEA Agreement. Section 4 of the DORA Act covers breaches of the Regulation's provisions on governance, ICT risk management framework, identification of ICT functions, security policies, response and recovery, backup, crisis communication and the simplified framework.

Section 4 of the Act also covers breaches of the Regulation's provisions on general testing requirements, vulnerability assessments, ICT third-party risk management and consideration of risks identified at ICT providers. Section 2 of the Act lets the ministry extend the Act by regulation to financing undertakings, loan intermediaries, debt collection undertakings, real estate brokerage undertakings and parent companies of financial groups.

Section 4 of the DORA Act lets the Financial Supervisory Authority impose an administrative fine of up to NOK 50 million on a person or undertaking that breaches the listed provisions of the Regulation. The Act entered into force on 1 July 2025.

Section 2 of the Digital Security Act applies the Act to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors, and to providers of digital services. Section 9 of the Act defines a provider of digital services as an undertaking offering online marketplaces, online search engines or cloud services.

Section 7 of the Act requires a provider of an essential societal service to carry out a risk assessment of the network and information systems it uses to deliver the service and to put in place appropriate and proportionate technical and organisational security measures that secure a level of security adapted to the risk.

Section 10 of the Act imposes the same risk assessment and security measures on a provider of a digital service, with regard to security of systems and facilities, incident handling, continuity management, monitoring, auditing and testing, and recognised international standards. Section 2 of the Act excludes undertakings covered by the Act on electronic trust services.

The National Security Authority's guide states that the digital-service security requirement does not apply to providers of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million. Section 17 of the Act lets the supervisory authority impose an administrative fine on a provider that intentionally or negligently breaches sections 7, 8, 10, 11 or 14.

The National Security Authority's guide to the Act states that the administrative fine can reach 25 times the National Insurance basic amount or four percent of the preceding year's turnover for an undertaking, whichever is higher, and cannot in any case exceed NOK 50 million. The Act and its regulation entered into force on 1 October 2025.

Section 3-1 of the Electronic Communications Act requires a provider to offer electronic communications networks and services with adequate security for users in peace, crisis and war, to maintain adequate preparedness and to secure adequate protection of communication and data. Section 3-1 also requires the provider to prevent and minimise the effects of security incidents, to secure rapid recovery and to document an adequate level of security. Section 15-12 of the Act lets the ministry impose an administrative fine for a breach of section 3-1(1), (3) or (4).

Section 1 of the DORA Act gives Regulation (EU) 2022/2554 the force of law in Norway, with the adaptations that follow from the EEA Agreement. Section 4 of the DORA Act covers breaches of Article 17 of the Regulation on the process for managing ICT-related incidents. Section 4 of the Act also covers breaches of paragraphs 1, 3 and 4 of Article 19 of the Regulation on the reporting of major ICT-related incidents.

Section 4 of the DORA Act lets the Financial Supervisory Authority impose an administrative fine of up to NOK 50 million on a person or undertaking that breaches the listed provisions of the Regulation. The Act entered into force on 1 July 2025.

Section 8 of the Digital Security Act requires a provider of an essential societal service to notify the body designated by the King, without undue delay and regardless of confidentiality duties, of incidents that significantly affect the delivery of the service. Section 11 of the Act imposes the same duty to notify without undue delay on a provider of a digital service.

The National Security Authority states that a provider of an essential societal service must notify within 24 hours of becoming aware of the incident. The Authority states that the first notice is due within 24 hours, an update to the authorities within 72 hours and an incident report within one month of the first notice. The National Security Authority's guide states that the 24-hour, 72-hour and one-month deadlines of the regulation do not apply to a provider of a digital service.

The National Security Authority's guide states that the notification duty does not apply to providers of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million. Section 17 of the Act lets the supervisory authority impose an administrative fine on a provider that intentionally or negligently breaches sections 7, 8, 10, 11 or 14.

The National Security Authority's guide to the Act states that the administrative fine can reach 25 times the National Insurance basic amount or four percent of the preceding year's turnover for an undertaking, whichever is higher, and cannot in any case exceed NOK 50 million. The Act and its regulation entered into force on 1 October 2025.

Section 3-3 of the Electronic Communications Act requires a provider to notify the ministry immediately of security incidents that have caused a significant breach of availability in electronic communications networks or services. Section 3-3 requires the provider to notify without undue delay of security incidents that have caused a significant breach of authenticity, integrity or confidentiality.

The Norwegian Communications Authority states that it must be notified immediately and no later than half an hour after the provider becomes aware of a security incident that has caused a significant breach of availability. The Authority states that all providers of electronic communications networks and services under the Act have a duty to notify it under section 3-3 of the Act and section 2-8 of the regulation.

Section 3-2 of the Act requires a provider to notify a subscriber or user without undue delay where there is a particular risk of a security incident in public networks or services. Section 15-12 of the Act lets the ministry impose an administrative fine for a breach of section 3-3(1).

Section 29 permits quotation from a published work in accordance with proper usage and to the extent required for the purpose, with no headline-length or short-extract cap distinct from that fair-practice test. Section 36 permits a work that forms part of a current event to be reproduced in media coverage of that event on the same fair-practice, purpose-justified terms.

It also permits a published work of art, photograph or film connected to but not part of the event to be reproduced on the same terms against remuneration, except where the work was created in the course of trade for the purpose of reproduction in the media.