Norway

Norway applies the European Union's General Data Protection Regulation through the European Economic Area Agreement, not through European Union membership. The national statute is personopplysningsloven of 15 June 2018. It makes the Regulation Norwegian law and adds national detail. Its section 2 covers organisations in Norway that decide how data is used, or that handle data for someone else. It covers their activities wherever the data is actually used. Section 2 also covers data about people who are in Norway, held by organisations outside the European Economic Area. That applies where the data relates to offering them goods or services, or to tracking their behaviour in Norway. The duty to appoint a representative is the Regulation's Article 27 duty. Norway adds no separate registration or licence.

Sector by sector, checked on 18 August 2026. GENERAL PERSONAL DATA. Conditional. The European rulebook applies. It sets conditions for sending data out rather than banning it. Regulation (EU) 2018/1807 also bans rules that force non-personal data to stay in one country, except on public-security grounds. ACCOUNTING AND TAX RECORDS, ALL INDUSTRIES. Conditional, but limited by geography. Since 27 January 2025 you may keep electronic accounting material in the European Economic Area, the United Kingdom and Switzerland without asking anyone. You must notify your tax office, and the records must stay reachable electronically from Norway. Storage anywhere else needs the tax authority's approval. This replaced the older, narrower Nordic-only permission. It also replaced the rule that cash register journals had to physically stay in Norway. PUBLIC SECTOR ARCHIVES. Closed unless permission is given. Archive material held by a public body may not be taken out of the country. The exceptions are where regulations allow it, or where the National Archivist gives specific consent. The National Archivist tells applicants to prefer suppliers inside the European Union or European Economic Area. BANKING, PAYMENTS, INSURANCE, SECURITIES. Conditional. No rule says where data must sit. Since 1 July 2025 the European digital resilience rules for finance apply in Norway through a dedicated Norwegian act. They demand contracts, registers of suppliers, exit plans, and notification of contracts supporting critical functions. They do not say where data must sit. HEALTH. Conditional. No rule says where data must sit. The Directorate of Health's own guidance accepts using cloud services for patient data, including outside Norway. You need a written transfer assessment and you must follow the health sector's information security norm. No Norwegian rule requires patient records to be hosted in Norway. TELECOMS. We found no rule about where data must sit. The Electronic Communications Act started on 1 January 2025. It requires providers to delete traffic data once it is no longer needed for billing or for carrying the communication, and it imposes strict confidentiality. It does not require networks or data to sit in Norway. GOVERNMENT CLOUD AND CLASSIFIED SYSTEMS. Conditional in law, restrictive in real life. The National Security Authority states there is no explicit ban on outsourcing systems covered by the Security Act to a cloud provider. But it says it can be hard to meet the Act's requirements and get security approval when the service is delivered from abroad. MAPPING AND AERIAL IMAGERY. Conditional. Photography, filming and other sensor use from the air is restricted around sensitive installations. Some sensor types must be notified to the National Security Authority. Foreign aircraft using sensors over Norway must notify. GAMBLING, EDUCATION, E-COMMERCE, DEFENCE PROCUREMENT. We found no rule about where data must sit, checked 18 August 2026, medium confidence. Norwegian gambling law works by keeping the market closed to all but two licensed operators, rather than by regulating where data sits.

The model is a list of approved countries, and the list is populated. Approved destinations as verified on 18 August 2026: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial bodies, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, and the European Patent Organisation. The United States counts only for organisations self-certified under the European Union to United States Data Privacy Framework. No decision has been withdrawn or suspended. The 2021 standard contractual clauses are still the set to use and have not been amended. Europe promised extra clauses for receivers already covered directly by the Regulation. Those are still not adopted. Binding corporate rules are still available. The narrow one-off exceptions are not a basis for routine or bulk transfers, and you are still expected to write a transfer risk assessment. On 31 July 2026 the European Data Protection Board formally asked the European Commission to examine whether changes in the United States affect the EU-US Data Privacy Framework. It has not been suspended or revoked, but it should not be your only route. One point catches people out. An order from a foreign authority is not by itself a lawful reason to hand data over. For non-personal accounting records the model is different. The European Economic Area, the United Kingdom and Switzerland are free. Anything beyond that needs the tax authority's approval.

The authority is Datatilsynet. Its decisions can be appealed to Personvernnemnda, an independent appeals board. That board is also active. It overturned a 20 million kroner fine against the labour and welfare administration in 2024. So appealing is a real remedy, not a formality. Other regulators enforce in their own areas, and all are working. Finanstilsynet supervises the finance sector, including the digital resilience rules. Nasjonal sikkerhetsmyndighet handles the security act, incident reporting for critical services, and airborne sensor control. Nasjonal kommunikasjonsmyndighet supervises telecoms. Arkivverket controls public archives. Skatteetaten controls accounting records. We rate the privacy regulator active rather than aggressive. The fine count is steady and mid-sized rather than attention-grabbing, and the Elkjøp decision itself notes the fine was set low against group revenue. Note for automated link checkers: datatilsynet.no serves a broken robots file, so its pages record as robots-blocked rather than unreachable.

The general accounting retention period dropped from ten years to five with effect from 1 January 2015, under bokføringsloven section 13. Some categories stayed at ten years. Those are project accounting in the building and construction trades. Also records for capital assets under value added tax rules, where input tax is 100,000 kroner or more. Also customer and supplier specifications for banks and financial undertakings. And also foreign undertakings on the Norwegian continental shelf. Petroleum extraction and pipeline transport keep fifteen years. Records must stay readable and reachable from Norway for the whole period. That is why moving them to a foreign cloud means telling the tax office rather than making a free choice. On the deletion side, the European rule that you keep data no longer than you need it applies unchanged. The Electronic Communications Act requires providers to delete traffic data when it is no longer needed for billing or for carrying the communication. The exception is where the user agrees to longer storage. Norway has no general duty on telecoms companies to keep data.

Clock one, cybersecurity. The Digital Security Act started on 1 October 2025. It puts the older European network security directive into Norwegian law, not the newer one. Its notification form and guidance say the provider must notify within 24 hours of becoming aware of the incident. A status report follows within 72 hours of that notification, and a final report within one month. Clock two, privacy. The European rulebook gives you 72 hours to tell Datatilsynet. You must also tell the people affected where the risk to them is high. Clock three, finance. The Norwegian digital resilience act applies the European reporting scheme. So a first notification goes to Finanstilsynet within four hours of classifying an incident as major. It must never be later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of that notification. A final report follows within one month of the last intermediate report. A single incident at a bank can therefore trigger all three. A fourth clock exists for organisations covered by the Security Act. They must tell the National Security Authority about activity that threatens security.

One: personopplysningsloven section 5 sets the age for a child's own consent to online services at 13. Two: section 12 covers the national identity number and other unique identifiers. You may only use them where there is an objective need for secure identification, and where the method is necessary to achieve it. So using it as a customer reference is unlawful. Three: employer access to an employee's mailbox and other stored material is governed by a separate 2018 regulation. It sets out when access is allowed. It requires the employee to be told and given the chance to be present. It requires deletion at the end of employment. It sits on top of the privacy rules, not instead of them. Four: electronic accounting material may sit in the European Economic Area, the United Kingdom or Switzerland. You must notify your tax office and keep the records reachable from Norway. Anything outside that group needs approval. Five: photography, filming and other sensor use from the air is restricted around military and sensitive sites. Other sensor types outside restricted areas must be notified to the National Security Authority. Foreign aircraft using sensors over Norway must notify. Six, for public bodies: taking archive material out of Norway needs the National Archivist's consent. That quietly makes some offshore hosting arrangements unlawful for the public sector, even where privacy law would allow them.

Not yet in force in Norway, verified 18 August 2026. The Data Act is still being assessed by the European Economic Area states and has not been brought in. Its January 2027 ban on cloud switching charges therefore does not bind Norwegian providers today, and bringing it in needs Parliament's consent. NIS2 has not been brought in either. Norway's Digital Security Act, in force since 1 October 2025, puts the older 2016 directive into Norwegian law. So Norway is one generation behind the European Union on cybersecurity duties. The Artificial Intelligence Act is to be taken in through the European Economic Area Agreement and adapted to Norwegian law. There is no confirmed date. The transparency duties that started in the European Union on 2 August 2026 do not yet apply here. Recently landed: the Digital Operational Resilience Act for finance started on 1 July 2025, and its Norwegian regulation was amended on 26 January 2026. The data sharing and data governance act was sanctioned on 19 June 2026. It brings in the European data governance regulation, the open data directive and high-value datasets. Some powers can be used without warning, and are worth watching. The tax authority can refuse approval for accounting records held outside Europe, or attach conditions to it. The National Archivist can refuse consent to move public archives. The National Security Authority's approval process can close off foreign hosting for security-relevant systems. And a 2021 amendment on storing internet protocol addresses for police use was adopted by Parliament. We could not confirm it is in force under the 2024 Electronic Communications Act. On the European side, the pressure on the European Union to United States Data Privacy Framework is the most time-sensitive item. The appeal in the Latombe case is pending before the Court of Justice. On 31 July 2026 the European Data Protection Board asked the Commission to examine whether the decision is still valid.