← Global Privacy Laws Research Library
LOV-2018-06-15-38
Act relating to the processing of personal data (The Personal Data Act)
Personal Data Act 2018: Norway
Prepared by Shubhank Suman · Last reviewed
Current and in force
- Legal character
- National GDPR implementation/supplementation statute
- Region
- Europe
- Entry into force
- 20 July 2018
What it covers
The Norwegian Personal Data Act is fundamentally a GDPR-plus-national-law instrument.
Section 1 incorporates the EU GDPR into Norwegian law with the adaptations arising from the EEA Agreement. Therefore, most Norwegian privacy questions cannot be answered by reading the Norwegian Act alone: the GDPR and the Personal Data Act operate together. (Lovdata)
The Norwegian Act contains national provisions concerning:
- scope
- children's consent
- employment processing
- criminal-conviction data
- national identity numbers
- research
- exemptions from data-subject rights
- DPO provisions
- supervision
- sanctions
- video-surveillance-related provisions.
(Lovdata)
Why it matters
It is the principal instrument for understanding how GDPR operates inside Norway.
Norway is in the EEA rather than the EU, so its legal relationship with GDPR is mediated through the EEA Agreement. Section 1 makes GDPR applicable as Norwegian law, while national provisions supplement it where permitted. (Lovdata)
Refer to it when
- Applying GDPR to a Norwegian organisation
- determining Norwegian national derogations
- employment-data processing
- children's consent
- criminal-conviction data
- research/statistics
- national identity numbers
- exemptions from data-subject rights
- Norwegian enforcement
- DPO obligations.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
High / indirect.
Norway has no AI-specific rules inside this statute.
However, AI systems using personal information are subject to the GDPR framework incorporated through Section 1. Relevant GDPR provisions therefore include:
- Article 5
- Article 6
- Article 9
- Article 22
- Article 25
- Article 32
- Article 35.
Cybersecurity
High.
The principal security obligations come through GDPR, particularly Article 32, with Norwegian supervisory/enforcement structures provided by the national framework.
Applicability
The Act and GDPR cover processing by Norwegian establishments and certain non-EEA controllers/processors targeting or monitoring individuals in Norway. (Lovdata)
Current validity
CURRENT AND IN FORCE.
Lovdata identifies entry into force as 20 July 2018 and provides the consolidated Act. The English translation itself is expressly described as unofficial; the Norwegian text is legally authoritative. (Lovdata)
Read first
Section 1 → Sections 2–4 → Sections 5–13 → Chapter 4 → Chapter 5 → GDPR Articles 5–6, 9, 22, 25, 32 and 35.
Provisions / sections covered
Section 1: Incorporation of GDPR
The most important starting point. GDPR applies as Norwegian law with EEA adaptations. (Lovdata)
Sections 2–4: Scope
Section 2 establishes the relationship between the Act and GDPR.
Section 4 applies GDPR/Act to:
- establishments in Norway regardless of where processing occurs
- certain non-EEA organisations offering goods/services to people in Norway
- monitoring behaviour taking place in Norway. (Lovdata)
Section 5: Children's consent
Norway sets the age at 13 for consent in relation to information-society services under GDPR Article 8. (Lovdata)
Section 6: Employment
Permits certain processing of special-category data where necessary to exercise employment-related rights/obligations.
Sections 7–11: Special categories/research/criminal data
These provide national rules concerning special-category data, research/statistical processing and criminal-conviction/offence data.
Section 12: National identity numbers
Provides national rules on their use.
Section 13: Transfers
Provides authority for regulations concerning transfers of personal data to third countries/international organisations.
Chapter 4: Exemptions
Important when analysing Norwegian national exemptions from data-subject rights.
Chapter 5: DPO
Provides national DPO provisions.
Chapters 6–7: Supervision and sanctions
Important for enforcement.
Subject-matter tags
- Consent
- Sensitive data
- Children's data
- Data subject rights
- Erasure and deletion
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Employment data
- Enforcement and penalties
- Surveillance
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.