Norway
Full entry AI-checked Checked 5 November 2026
Read this together with European Union, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Personal Data Act (personopplysningsloven) | LOV-2018-06-15-38 | In force | 20 July 2018 |
| Electronic Communications Act (ekomloven) | LOV-2024-12-13-76 | In force | 1 January 2025 |
| Marketing Control Act (markedsføringsloven) | LOV-2009-01-09-2 | In force | 1 June 2009 |
| Act on artificial intelligence (KI-loven) | Draft act to implement the EU AI Act, Regulation (EU) 2024/1689, sent for consultation in 2025 | Draft, not law | — |
- Personal Data Act (personopplysningsloven): Makes the GDPR, as incorporated into the EEA Agreement, part of Norwegian law and adds national rules. The link is the text the Storting adopted on 22 May 2018.
- Electronic Communications Act (ekomloven): Replaced the 2003 Act. Section 3-15 sets the cookie rules. The link is the text the Storting adopted on 5 November 2024.
- Marketing Control Act (markedsføringsloven): Section 15 covers e-mail, SMS and similar marketing, and section 12 telemarketing. The link is the Consumer Authority’s guidance, which quotes section 15.
- Act on artificial intelligence (KI-loven): Not law yet. The EU AI Act isn’t yet part of the EEA Agreement, so it doesn’t apply in Norway yet. Nkom coordinates the work on the Norwegian act.
Regulators
Section titled “Regulators”- Datatilsynet (Norwegian Data Protection Authority)
- Nasjonal kommunikasjonsmyndighet (Nkom), which supervises the cookie rule with Datatilsynet
- Forbrukertilsynet (Norwegian Consumer Authority), for marketing rules
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The GDPR applies as Norwegian law through the Personal Data Act. It covers processing in the context of a controller or processor established in Norway, and by organisations outside the EEA that offer goods or services to people in Norway or monitor their behaviour there. Those need a representative in the EEA. The government can apply the Act to Svalbard and Jan Mayen by regulation. Journalism and academic, artistic or literary expression are largely exempt.
Sources: stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak… · datatilsynet.no/regelverk-og-verktoy/lover-og-regler/om-personopplysn…
Lawful bases
Section titled “Lawful bases”The six GDPR lawful bases apply. National rules add grounds for special category data in employment, and for archiving, research and statistics, where the controller must first consult its data protection officer unless it has done a DPIA. Datatilsynet can permit special category processing in an important public interest. National identity numbers may only be used where secure identification is genuinely needed.
Sources: stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak… · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Consent age for online services
Section titled “Consent age for online services”When an information society service offered directly to a child relies on consent, children can consent for themselves from 13. Below that, a parent must consent. Norway’s EEA notification of September 2025 says the 13 doesn’t apply to providers established in another EEA state, and proposes raising the age to 15 for all providers serving children in Norway. That change is pending. For other processing, Datatilsynet’s view is that a parent usually consents until 18, unless the child is mature enough to understand the processing in question.
Sources: stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak… · datatilsynet.no/personvern-pa-ulike-omrader/skole-barn-unge/samtykkje… · technical-regulation-information-system.ec.europa.eu/da/notification/…
Children
Section titled “Children”The GDPR’s protections for children apply. Datatilsynet’s guidance notes other ages in Norwegian law, such as 15 for joining associations and 16 for seeking health care alone. A social media age limit is planned but isn’t law yet. The draft bill, notified under the EEA procedure for technical rules in May 2026, would let children use social media from the year they turn 16, with platforms checking ages.
Sources: datatilsynet.no/personvern-pa-ulike-omrader/skole-barn-unge/samtykkje… · technical-regulation-information-system.ec.europa.eu/da/notification/…
Leads, not sources: cms.law/no/nor/publikasjon/norge-innfoerer-aldersgrense-for-sosiale-m…
Cookies and similar technologies
Section titled “Cookies and similar technologies”Since 1 January 2025, storing or reading information on a user’s device needs consent that meets the GDPR standard (Electronic Communications Act section 3-15). The only exceptions are technical transmission and what’s strictly necessary for a service the user explicitly asked for. Refusing must be as easy as accepting. Nkom and Datatilsynet share supervision.
Sources: nkom.no/internett/informasjonskapsler-cookies · nkom.no/informasjonskapsler · stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak…
Electronic marketing
Section titled “Electronic marketing”E-mail, SMS and similar marketing to individuals needs prior consent (Marketing Control Act section 15), including at personal work addresses. Existing customers can get marketing for the seller’s own similar products if they were offered a free, easy opt-out when their address was collected and in every message. Generic company addresses aren’t covered. Telemarketing to consumers in the Reservation Register is banned unless they’re customers or donors, or asked to be called.
Sources: forbrukertilsynet.no/lov-og-rett/veiledninger-og-retningslinjer/forbr… · forbrukertilsynet.no/vi-jobber-med/telefonsalg-uonsket-reklame
Breach notification
Section titled “Breach notification”The GDPR rule applies. Report a personal data breach to Datatilsynet without undue delay and within 72 hours of becoming aware of it, unless it’s unlikely to risk people’s rights. Tell the people affected without undue delay when the risk to them is high. Since 1 October 2025, the Digital Security Act also requires online marketplaces, search engines and cloud services based in Norway to report incidents that significantly affect their service without undue delay, or risk a fine. Those based outside the EEA need a representative in Norway, or in another EEA state where they offer services.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/avvik · stortinget.no/globalassets/pdf/lovvedtak/2023-2024/vedtak-202324-015.pdf · finanstilsynet.no/nyhetsarkiv/nyheter/2025/informasjon-om-digitalsikk…
Leads, not sources: schjodt.com/news/norways-digital-security-act-now-in-effect
Registration and fees
Section titled “Registration and fees”There’s no general registration or fee. An organisation that appoints a data protection officer, whether it must or chooses to, has to register the officer’s contact details with Datatilsynet through an Altinn form.
Sources: datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/personv… · stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak…
Data protection officer
Section titled “Data protection officer”The GDPR rule applies. Appoint a data protection officer if you’re a public body, or your core activities involve large-scale regular and systematic monitoring, or large-scale special category or criminal offence data. Norwegian law adds a duty of confidentiality for the officer and lets the government extend the duty to appoint one by regulation.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak… · datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/personv…
International transfers
Section titled “International transfers”The GDPR rules apply to transfers outside the EEA. Use an adequacy decision, an appropriate safeguard such as standard contractual clauses or binding corporate rules, or one of the listed derogations, such as explicit consent. The Personal Data Act lets the government add transfer rules by regulation.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak…
Impact assessments
Section titled “Impact assessments”The GDPR rule applies. Datatilsynet’s national list names processing that always needs a DPIA, such as systematic monitoring of employees, or biometric, genetic or location data combined with another risk factor such as large scale. Consult Datatilsynet before starting if a high risk remains.
Sources: datatilsynet.no/globalassets/global/dokumenter-pdfer-skjema-ol/regelv… · datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/vurderi… · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Automated decisions and AI
Section titled “Automated decisions and AI”The GDPR rule on decisions based solely on automated processing applies. The EU AI Act isn’t yet part of the EEA Agreement, so it doesn’t apply in Norway yet, and the timing is unclear. A draft Norwegian AI act to implement it was sent for consultation in 2025 but isn’t law yet. Nkom coordinates the work.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · stortinget.no/no/Hva-skjer-pa-Stortinget/EU-EOS-informasjon/EU-EOS-ny… · nkom.no/ki
Leads, not sources: digi.no/artikler/nye-eu-regler-for-ki-norge-og-eos-henger-enna-langt-… · altinget.no/artikkel/ny-forsinkelse-for-ki-loven
Penalties
Section titled “Penalties”Datatilsynet can fine up to EUR 20 million or 4% of worldwide annual turnover under the GDPR. Norwegian law applies the EUR 10 million or 2% tier to breaches of GDPR Articles 10 and 24 too. Datatilsynet can fine public bodies, and set a daily coercive fine until an order is met. Appeals go to the Privacy Appeals Board (Personvernnemnda). Forbrukertilsynet can impose infringement fines for breaking the marketing rules.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · stortinget.no/no/Saker-og-publikasjoner/Vedtak/Beslutninger/Lovvedtak… · forbrukertilsynet.no/lov-og-rett/veiledninger-og-retningslinjer/forbr…
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/no.yaml.