🇳🇴Personal Data Act
Norway's implementing and supplementary data protection statute
The Personal Data Act makes the GDPR, as incorporated into the EEA Agreement, Norwegian law. It applies to automated processing and to structured non-automated processing, subject to statutory exclusions, and extends to Norwegian establishments and qualifying offers or monitoring directed at people in Norway.
National rules that require separate controls
Children: Section 5 sets 13 as the age at which a child may consent to a directly offered information-society service under GDPR Article 8.
Employment and public interest: Sections 6 and 7 permit specified special-category processing for employment obligations and rights or, with authority permission or regulation, substantial public-interest reasons.
Research, archives and statistics: Sections 8-10 provide national grounds and safeguards. For special-category research or statistical processing without consent, the public interest must clearly outweigh the disadvantage to the person and safeguards under Article 89(1) are required. Prior consultation with the DPO or a qualifying independent expert is required unless a GDPR DPIA has been conducted.
Criminal data and identifiers: Section 11 extends specified special-category routes to Article 10 data and reserves comprehensive conviction registers to public-authority supervision. Section 12 permits national identity numbers and unique identifiers only where definite identification is legitimately needed and the method is necessary.
Expression, rights and enforcement
Section 3 balances privacy with freedom of expression and information using factors such as public interest, editorial safeguards, consequences for expression and harm to the person. Sections 16 and 17 permit specified restrictions of transparency, access, breach communication and certain research or archive rights only within their stated conditions. Datatilsynet supervises the Act, and the Privacy Appeals Board hears administrative appeals.
A research team plans to use health data without consent. It must establish the Norwegian statutory route, show that the public interest clearly outweighs disadvantages, apply Article 89 safeguards, and complete the required independent consultation unless a GDPR DPIA already covers the processing.
Sections 1-4 - GDPR incorporation, scope, expression and territorial reach.
Sections 5-12 - children, employment, public interest, research, criminal data and identifiers.
Sections 16-17 - national restrictions on rights and research or archive derogations.
Sections 20-30 - supervision, appeals, fines and coercive penalties.