Norway. Comprehensive data protection. Act
POLAct relating to the processing of personal data (Personopplysningsloven) LOV-2018-06-15-38
In force
§1Summary
- Synopsis
Incorporates the GDPR into Norwegian law as an EEA state and adds national rules on derogations such as age of consent, national ID numbers, employee monitoring and research. Datatilsynet enforces it, with appeals to the Privacy Appeals Board (Personvernnemnda).
- Key themes
- Unique features
Age of digital consent 13; Datatilsynet is notably active on adtech and transfers (e.g. the 2023 Meta behavioural advertising ban, later extended EU-wide by the EDPB).
- SaaS relevance
SaaS providers established in Norway or targeting Norwegian users are subject to the full GDPR via the EEA Agreement.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority 72h; individuals without undue delay if high risk
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (EEA)
- Maximum penalty
- €20m or 4% global turnover (NOK equivalent)
§3Dates
- Key dates
- Adopted
- In force
- GDPR incorporated into the EEA Agreement and made applicable in Norway 2018-07-20
§4Text and authority
- Text
- Authoritative text lovdata.no
- Authority
- Datatilsynet (Norwegian Data Protection Authority)
§5Where it applies
- Domestic law of
- Norway
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EEA state – GDPR applies; no adequacy decision needed.