In short: Norway complies with the EU’s GDPR through the Personal Data Act.. Det means same basic principles and rights as in EU – plus some Norwegian peculiarities in working life, camera surveillance and usage of det National id-number (national id number)

What is particularly Norwegian about GDPR?

• Employer insight into email and files: There are strict conditions for when an employer can open an employee’s email box or private files – the rules are both described by the Data Protection Agency and set out in a separate regulation. For example, access may be legal when there is a reasonable suspicion of gross breaches of duties.
• Control and monitoring of employees: Datatilsynet has a practical guide for control measures on the job, and since 2024 there are clarified prohibition from monitoring employees’ use of electronic devices beyond narrow exceptions.
• Camera surveillance: Requirement of clear purpose, clear information (signage) and deletion when the purpose is achieved. Covert surveillance is not allowed.
• National identity number (11 digits): Rules for when and how national identity numbers can be processed – use must be necessary and factual and there are concrete “do/do not” examples from the authorities.

International transfers (outside the EEA)

Norway uses the the same mechanisms as in the EU typically Standard Contractual Clauses (SCCs) – together with a Transfer Impact Assessment Transfer Impact Assessment to assess legislation and access risks in the recipient country.

Authorities and “one-stop-shop”

Data Protection Authority is the national authority. By cross-border processing kan Datatilsynet fungere som lead supervisory authority coordinating the case across the EEA, e.g. in Mowi-case, where Norway was the lead.

What does this mean for your organization?

• Use the EU’s baseline for principles, rules, rights and safety and check out the Norwegian special rules in working life, CCTV and national identity numbers when doing business in Norway.
• Before buying systems (SaaS, camera, HR/CRM): clarify processing basis, signage/information, retention periods and data processing agreements according to Norwegian requirements.

Train the entire organization with a GDPR Course

Check out our GDPR online course (Danish/English, approx. 30 min., 7 modules). It provides a common, documentable level and can be adapted to your policies