What is the same as in the EU
- Lawful basis, transparency and data minimisation (Arts. 5, 6, 12-14);
- record of processing activities (Art. 30) and processor agreements (Art. 28);
- data protection impact assessments for high-risk processing (Art. 35);
- breach notification to Datatilsynet within 72 hours (Art. 33);
- a Data Protection Officer for public authorities and for core activities involving large-scale monitoring or special categories of data (Art. 37).
Because the rules are the same, documentation built on the GDPR can serve as a solid base and then be adapted to Norwegian law.
What Norway adds
| Topic | What to check |
|---|
| Employee e-mail and files | A specific regulation limits when an employer may access an employee’s mailbox and stored files, and sets procedural safeguards. |
| Control measures at work | The Working Environment Act requires control measures to be justified, proportionate and discussed with employees’ representatives. |
| National identity numbers | Use of the national identity number is restricted to cases with a real need for secure identification. |
| Camera surveillance | Cameras need a clear purpose, signage and limited retention, with extra care in workplaces. |
These are the points where documents written for another country most often fall short. I check them against the current Norwegian texts and Datatilsynet’s guidance for each client.
The AI Act in Norway
The AI Act is an EU regulation; Norway is implementing it through the EEA Agreement and national legislation. Before treating a specific AI obligation as binding in Norway, the current status of implementation must be checked. Companies that place AI systems on the EU market are already within its scope.
How we work together
Meetings and day-to-day contact are held in English. Documents are drafted in English; where a Norwegian version is required, it is prepared with a professional translator and reviewed against the English text.
Frequently asked questions
Does the GDPR apply in Norway?
Yes. Norway applies the GDPR through the EEA Agreement; it was incorporated into Norwegian law by the Personal Data Act of 2018.
Who is the supervisory authority in Norway?
Datatilsynet, the Norwegian Data Protection Authority. Breaches must be notified to it within 72 hours where required by Art. 33 GDPR.
Can a Norwegian company use GDPR documents written for another country?
As a base, yes, but they must be adapted to Norwegian rules, especially on employee monitoring, access to e-mail and the use of national identity numbers.
Do you work in English?
Yes. Meetings, correspondence and documents can be in English.
Dr Pietro Cravero, certified Data Protection Officer (IDcert; Second-level Master in Personal Data Processing, Roma Tre University). Studio Cravero Consulting, Sassari, Italy.
Working in Norway?
A free first assessment in English: we look at your documents and tell you what is missing for Norway.
Studio Cravero Consulting