NO-PDA-2018
Personal Data Act
Norwegian Data Protection Authority (Datatilsynet)
Norwegian Data Protection Authority (Datatilsynet)
Norway's Personal Data Act incorporates the GDPR into Norwegian law with the adaptations required by the EEA Agreement. The Act then supplies national rules on territorial scope, freedom of expression, children's consent, employment data, research, criminal-offence data, national identity numbers, rights restrictions, supervision and sanctions.
The national overlay is particularly important for services used by children, employment and research processing, use of fødselsnummer and other unique identifiers, and publication or journalistic activity. The Act sets 13 as the digital-consent age, permits employment-related special-category processing where necessary, and requires a legitimate need for definite identification before using a national identity number.
Research and statistics involving special-category data may require prior consultation with a DPO or an equivalently independent expert unless a GDPR impact assessment has already been completed. Norwegian rules also define when rights and breach communications may be restricted.
Personal Data Act, Act No. 38 of 15 June 2018 - incorporates the GDPR and adds Norway-specific rules. The Norwegian Data Protection Authority (Datatilsynet) supervises compliance, with appeals handled by the Privacy Appeals Board.
Apply the GDPR baseline, then map the Norwegian overlays. Verify child-consent age, special-category and criminal-data authority, national identifier necessity, research consultation, expression balancing and the precise basis for any restriction of individual rights.