Data protection & privacy law in Norway (2026)

Legal framework

Personal Data Act 2018 (personopplysningsloven), which incorporates the EU GDPR into Norwegian law via the EEA Agreement; supervised by Datatilsynet (the Norwegian Data Protection Authority).

GDPR & data protection in Norway

In Norway, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Norwegian Data Protection Authority (Datatilsynet).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Norwegian Data Protection Authority (Datatilsynet)

Applies to

any organisation processing the personal data of people in Norway, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Norway supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Norway

1. 01Comprehensive GDPR-based law

   The Personal Data Act (personopplysningsloven) makes the GDPR Norwegian law and supplements it with national rules under the GDPR's 'opening clauses'. It took effect on 20 July 2018, the date the GDPR became applicable in Norway via the EEA Agreement.

   datatilsynet.no gdprhub.eu

2. 02Supervisory authority

   Datatilsynet (the Norwegian Data Protection Authority), headquartered in Oslo and originally established in 1980, is the independent supervisor; it acts free of government instruction in individual cases.

   datatilsynet.no gdprhub.eu

3. 03Enforcement powers and fines

   Datatilsynet exercises the full Article 58 GDPR investigative and corrective powers, including audits, processing bans, reprimands and administrative fines of up to EUR 20 million or 4% of global annual turnover.

   gdprhub.eu cms.law

4. 04Appeals structure

   Decisions of Datatilsynet can be appealed to the Privacy Appeals Board (Personvernnemnda), a seven-member collegial body; its rulings are final administratively but can be challenged in court.

   gdprhub.eu datatilsynet.no

5. 05Active enforcement record

   Datatilsynet is among Europe's more active enforcers; in 2025 the Court of Appeal upheld its large fine against Grindr, and it issued a NOK 4 million fine against Telenor (March 2025) over DPO/organisational obligations.

   datatilsynet.no datatilsynet.no

6. 06Data-subject rights and obligations

   Standard GDPR rights (access, rectification, erasure, portability, objection) and controller/processor duties (lawful basis, transparency, security, breach notification, DPIAs, DPOs) apply, with some sector adaptations in national law.

   gdprhub.eu datatilsynet.no

GDPR in Norway: FAQ

Timeline of decisions

1. 21 Oct 2025Decision · official
   Borgarting Court of Appeal upholds NOK 65M Grindr fine

   Norway's second-highest court confirmed Datatilsynet's record fine against Grindr LLC for sharing users' location, device IDs, and app-use data (inferring sexual orientation and HIV status) with ad-tech partners without valid GDPR consent. The ruling cements the principle that sharing identifiers tied to a sensitive-category app constitutes disclosure of special-category data under GDPR Art. 9.

   Datatilsynet

2. 10 Mar 2025Enforcement · official
   Datatilsynet fines Telenor ASA NOK 4M for DPO independence failures

   Norway's DPA issued a NOK 4 million fine against the country's largest telecom for failing to ensure the Data Protection Officer's independence and a direct reporting line to top management, violating GDPR Arts. 37-39 and 24. The case was handled via the GDPR cooperation mechanism together with the Swedish and Danish DPAs.

   Datatilsynet

3. 1 Mar 2024Enforcement · official
   Datatilsynet imposes NOK 20M infringement penalty and corrective orders on NAV

   The Norwegian Labour and Welfare Administration was fined NOK 20 million and issued multiple binding remediation orders for systemic IT security failures and inadequate data protection governance affecting millions of welfare recipients. The decision signalled Datatilsynet's willingness to use escalating sanctions against public bodies that fail to remediate.

   Datatilsynet

4. 10 Nov 2023Decision · official
   EDPB binding decision makes Meta behavioral advertising ban permanent across entire EEA

   Following Norway's Art. 66(2) referral, the European Data Protection Board issued an urgent binding decision instructing the Irish DPA to permanently ban Meta from relying on contract or legitimate interest as legal bases for behavioral advertising across all EEA states. This was the first successful use of the GDPR's cross-border emergency escalation mechanism, triggered and led by Norway.

   European Data Protection Board

5. 27 Sept 2023Decision · official
   Privacy Appeals Board confirms record NOK 65M Grindr fine on appeal

   The Norwegian Personal Data Processing Appeals Board (Personvernnemnda) upheld Datatilsynet's 2021 fine in full, rejecting Grindr's arguments on legal basis and proportionality. The confirmed fine remained the largest GDPR penalty issued by any Nordic supervisory authority.

   Datatilsynet

6. 14 Jul 2023Enforcement · official
   Datatilsynet invokes GDPR Art. 66 emergency powers to ban Meta behavioral advertising in Norway

   Norway's DPA imposed a three-month temporary ban on Meta Ireland processing Norwegian users' data for behavioral advertising under contract or legitimate interest legal bases, the first Nordic use of the GDPR's emergency unilateral powers. Norway then referred the matter to the EDPB in September 2023, leading to the EEA-wide permanent ban.

   Datatilsynet

7. 15 Dec 2021Enforcement · official
   Datatilsynet issues record NOK 65M (approx. €6.5M) GDPR fine against Grindr LLC

   Norway's DPA fined Grindr for sharing users' precise location, device identifiers, and app-use data with advertising partners without valid consent from July 2018 to April 2020; the disclosure was deemed to reveal sexual orientation under GDPR Art. 9. At the time, it was the largest fine per capita issued by any European DPA.

   Datatilsynet

8. 12 Dec 2021Enforcement · official
   Datatilsynet Fines Grindr NOK 65 Million for Unlawful Data Sharing

   Norway's Data Protection Authority imposed its largest-ever GDPR fine (NOK 65 million, ~€5.4 million) on US-based Grindr LLC for sharing users' precise location and sexual orientation with advertising partners without valid legal basis, violating Articles 6(1) and 9(1) GDPR, setting a major precedent for online-platform data practices.

   Datatilsynet

9. 20 Jul 2018Law · official
   GDPR Incorporated into Norwegian Law, Personal Data Act Enters Force

   The Norwegian Personal Data Act of 15 June 2018 entered into force on 20 July 2018, incorporating the GDPR by reference through the EEA Agreement and granting Datatilsynet full enforcement powers including fines up to €20 million or 4% of global turnover, the bedrock of online data-processing regulation in Norway.

   Datatilsynet

10. 20 Jul 2018Law · official
    GDPR incorporated into EEA Agreement; Norwegian Personal Data Act 2018 enters into force

    The GDPR was formally incorporated into the EEA Agreement (Annex XI) and Norway's supplementing Personal Data Act 2018 (LOV-2018-06-15-38) took effect simultaneously, binding Norway to GDPR obligations identical to EU Member States. The Act sets the consent age for children at 13 and adds national rules on employment data, research, and national ID numbers.

    Lovdata – Norwegian Official Legislation Portal

11. 1 May 2014Law · official
    Right to privacy enshrined in Norwegian Constitution §102

    A Storting constitutional amendment added §102, explicitly guaranteeing every person the right to respect for private and family life, home, and communications. This elevated data privacy to a fundamental constitutional right, providing a domestic constitutional foundation that reinforces and co-exists with the GDPR framework adopted four years later.

    Lovdata – Norwegian Constitution

12. 14 Apr 2000Law · official
    Personal Data Act 2000 enacted, replacing 1978 Act and implementing EU Directive 95/46/EC

    Norway enacted a comprehensive new Personal Data Act (Lov-2000-04-14-31) transposing the EU's first harmonised data protection directive, replacing the 1978 Personal Data Registers Act. The Act introduced formal data subject rights, controller obligations, and expanded Datatilsynet's investigative and sanctioning powers.

    Lovdata – Norwegian Official Legislation Portal

13. 9 Jun 1978Law · official
    Personal Data Registers Act enacted; Datatilsynet established as independent DPA

    Norway enacted Lov-1978-06-09-48 (Personregisterloven), one of the world's first national data protection statutes, and established Datatilsynet (the Data Inspectorate) as an independent supervisory authority commencing operations in 1980. This placed Norway at the global vanguard of privacy regulation and created the institutional architecture that underpins today's GDPR enforcement.

    Datatilsynet

Sources

1. 1.datatilsynet.no/en/
2. 2.datatilsynet.no/en/regulations-and-tools/regulations/
3. 3.datatilsynet.no/en/news/news-2025/
4. 4.datatilsynet.no/en/news/news-2025/the-court-of-appeal-upholds-the-fine-against-grindr
5. 5.gdprhub.eu/Data_Protection_in_Norway
6. 6.gdprhub.eu/Datatilsynet_(Norway)
7. 7.gdprhub.eu/index.php?title=Personvernnemnda_(Norway)
8. 8.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se