Norway

Norway applies the European Union's General Data Protection Regulation through the European Economic Area Agreement, not through European Union membership. The national statute, personopplysningsloven of 15 June 2018, makes the Regulation Norwegian law and adds national detail. Its section 2 covers processing carried out in connection with the activities of a controller or processor in Norway regardless of where the processing happens, and also covers processing about people who are in Norway by controllers outside the European Economic Area where it relates to offering goods or services to them or monitoring their behaviour in Norway. The representative duty is the Regulation's Article 27 duty; Norway adds no separate registration or licence.

Sector by sector, checked on 18 August 2026. GENERAL PERSONAL DATA — conditional. The European rulebook governs, and it sets conditions for export rather than banning it. Regulation (EU) 2018/1807 also forbids localisation rules for non-personal data except on public-security grounds. ACCOUNTING AND TAX RECORDS, ALL INDUSTRIES — conditional but geographically capped. Since 27 January 2025 electronic accounting material may be kept in the European Economic Area, the United Kingdom and Switzerland without asking anyone, provided you notify your tax office and the records stay reachable electronically from Norway. Storage anywhere else needs the tax authority's approval. This replaced the older, narrower Nordic-only permission and the rule that cash register journals had to physically stay in Norway. PUBLIC SECTOR ARCHIVES — closed unless permission is given. Archive material held by a public body may not be taken out of the country except under regulations or with the National Archivist's specific consent. The National Archivist tells applicants to prefer suppliers inside the European Union or European Economic Area. BANKING, PAYMENTS, INSURANCE, SECURITIES — conditional, no localisation. Since 1 July 2025 the European digital resilience rules for finance apply in Norway through a dedicated Norwegian act. They demand contracts, registers of suppliers, exit plans and notification of contracts supporting critical functions, but they do not say where data must sit. HEALTH — conditional, no localisation. The Directorate of Health's own guidance accepts cloud processing of patient data, including outside Norway, subject to a documented transfer assessment and the health sector's information security norm. No Norwegian rule requires patient records to be hosted in Norway. TELECOMS — no localisation found. The Electronic Communications Act that started on 1 January 2025 requires providers to delete traffic data once it is no longer needed for billing or carrying the communication, and imposes strict confidentiality. It does not require networks or data to sit in Norway. GOVERNMENT CLOUD AND CLASSIFIED SYSTEMS — conditional in law, restrictive in practice. The National Security Authority states there is no explicit ban on outsourcing systems covered by the Security Act to a cloud provider, but says it can be hard to meet the Act's requirements and obtain security approval when the service is delivered from abroad. MAPPING AND AERIAL IMAGERY — conditional. Photography, filming and other sensor use from the air is restricted around sensitive installations, notification to the National Security Authority is required for some sensor types, and foreign aircraft using sensors over Norway must notify. GAMBLING, EDUCATION, E-COMMERCE, DEFENCE PROCUREMENT — no data localisation rule found, checked 18 August 2026, medium confidence. Norwegian gambling law works by keeping the market closed to all but two licensed operators rather than by regulating where data sits.

The model is an allowlist and the list is populated. Approved destinations as verified on 18 August 2026: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial bodies, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States but only for organisations self-certified under the European Union to United States Data Privacy Framework, plus the European Patent Organisation. No decision has been withdrawn or suspended. The 2021 standard contractual clauses remain the operative set and are unamended; the promised extra clauses for importers already directly caught by the Regulation are still not adopted. Binding corporate rules remain available. The narrow one-off exceptions are not a basis for routine or bulk transfers, and a transfer impact assessment is still expected. On 31 July 2026 the European Data Protection Board formally asked the European Commission to examine whether changes in the United States affect the validity of the Data Privacy Framework; the framework has not been suspended or revoked, but it should not be your only mechanism. A separate point that catches people: an order from a foreign authority is not by itself a lawful reason to hand data over. For non-personal accounting records the model is different — the European Economic Area, the United Kingdom and Switzerland are free, and anything beyond that needs the tax authority's approval.

The authority is Datatilsynet. Its decisions can be appealed to Personvernnemnda, an independent appeals board that is also active — it overturned a 20 million kroner fine against the labour and welfare administration in 2024, which is useful evidence that appeal is a real remedy rather than a formality. Other regulators enforce in their own lanes and are all operational: Finanstilsynet supervises the finance sector including the digital resilience rules, Nasjonal sikkerhetsmyndighet handles the security act, critical-service incident reporting and airborne sensor control, Nasjonal kommunikasjonsmyndighet supervises telecoms, Arkivverket controls public archives, and Skatteetaten controls accounting records. Rated active rather than aggressive: the fine count is steady and mid-sized rather than headline-grabbing, and the Elkjøp decision itself notes the fine was set low relative to group revenue. Note for automated link checkers: datatilsynet.no serves a broken robots file, so its pages record as robots-blocked rather than unreachable.

The general accounting retention period dropped from ten years to five with effect from 1 January 2015 under bokføringsloven section 13. The exceptions that stayed at ten years include project accounting in the building and construction trades, documentation for capital assets under value added tax rules where input tax is 100,000 kroner or more, customer and supplier specifications for banks and financial undertakings, and foreign undertakings on the Norwegian continental shelf. Petroleum extraction and pipeline transport keep fifteen years. Records must remain readable and reachable from Norway for the whole period, which is why moving them to a foreign cloud is a notification event rather than a free choice. On the deletion side, the European rulebook's storage limitation principle applies unchanged, and the Electronic Communications Act requires providers to delete traffic data when it is no longer needed for billing or for carrying the communication unless the user consents to longer storage. Norway has no general telecoms data retention mandate in force.

Clock one, cybersecurity: the Digital Security Act started on 1 October 2025 and implements the older European network security directive, not the newer one. Its notification form and guidance state that the provider must notify within 24 hours of becoming aware of the incident, with a status report within 72 hours of that notification and a final report within one month. Clock two, privacy: the European rulebook's 72-hour deadline to Datatilsynet, plus notification to the people affected where the risk to them is high. Clock three, finance: the Norwegian digital resilience act applies the European reporting scheme, so an initial notification goes to Finanstilsynet within four hours of classifying an incident as major and at the latest 24 hours after becoming aware of it, an intermediate report within 72 hours of that notification, and a final report within one month of the last intermediate report. A single incident at a bank can therefore trigger all three. A fourth clock exists for organisations covered by the Security Act, which must notify the National Security Authority of security-threatening activity.

One: personopplysningsloven section 5 sets the age for a child's own consent to online services at 13. Two: section 12 says the national identity number and other unique identifiers may only be processed where there is an objective need for secure identification and the method is necessary to achieve it, so using it as a customer reference is unlawful. Three: employer access to an employee's mailbox and other stored material is governed by a separate 2018 regulation, which sets out when access is allowed, requires the employee to be told and given the chance to be present, and requires deletion at the end of employment; this sits on top of, not instead of, the privacy rules. Four: electronic accounting material may sit in the European Economic Area, the United Kingdom or Switzerland, but you must notify your tax office and keep the records reachable from Norway; anything outside that group needs approval. Five: photography, filming and other sensor use from the air is restricted around military and sensitive sites, other sensor types outside restricted areas must be notified to the National Security Authority, and foreign aircraft using sensors over Norway must notify. Six, for public bodies: taking archive material out of Norway needs the National Archivist's consent, which quietly makes some offshore hosting arrangements unlawful for the public sector even where privacy law would allow them.

Not yet in force in Norway, verified 18 August 2026. The Data Act is still under assessment by the European Economic Area states and has not been incorporated; its January 2027 ban on cloud switching charges therefore does not bind Norwegian providers today, and incorporation needs Parliament's consent. NIS2 has not been incorporated either — Norway's Digital Security Act, in force since 1 October 2025, implements the older 2016 directive, so Norway is running one generation behind the European Union on cybersecurity duties. The Artificial Intelligence Act is to be taken in through the European Economic Area Agreement and adapted to Norwegian law, with no confirmed date; the transparency duties that started in the European Union on 2 August 2026 do not yet apply here. Recently landed: the Digital Operational Resilience Act for finance started on 1 July 2025 and its Norwegian regulation was amended on 26 January 2026; the data sharing and data governance act was sanctioned on 19 June 2026, bringing in the European data governance regulation, the open data directive and high-value datasets. Dormant switches worth watching: the tax authority can refuse or condition approval for accounting records held outside Europe; the National Archivist can refuse consent to move public archives; the National Security Authority's approval regime can effectively close off foreign hosting for security-relevant systems; and a 2021 amendment on storing internet protocol addresses for police use was adopted by Parliament but we could not confirm that it is in force under the 2024 Electronic Communications Act. On the European side, the pressure on the European Union to United States Data Privacy Framework is the single most time-sensitive item: the appeal in the Latombe case is pending before the Court of Justice, and on 31 July 2026 the European Data Protection Board asked the Commission to examine the decision's validity.