GDPR and Privacy in Norway — 2026-06-25 report · BusinessNorway.ai

Introduction

The General Data Protection Regulation (GDPR) is the European Union’s flagship law regulating personal data processing. Norway is not a member of the EU but participates in the European Economic Area (EEA), which extends the EU’s single market – and its data protection regime – to Norway, Iceland and Liechtenstein. Consequently, Norway transposed the GDPR through its Personal Data Act and adopted it via an EEA joint committee decision on 6 July 2018. The Personal Data Act, including the GDPR, entered into force in Norway on 20 July 2018.

Privacy features centrally in Norway’s National Digitalisation Strategy 2024–2030. The strategy states that digitalisation is not an end in itself but a tool for solving societal challenges. A precondition for trust in digital services is effective privacy protection; therefore, the Government vows to safeguard privacy in all digitalisation efforts and requires that “all relevant IT solutions in the public sector shall have built‑in privacy protection”. The strategy links privacy to democratic values such as freedom of expression and emphasises that citizens must be confident that their personal data are appropriately handled. It also acknowledges that privacy assessments have often lagged behind technological development and calls for comprehensive privacy protection policies and an independent data ethics council.

With Norway’s public sector being among the most digitised in the world, it is critical for organisations – public and private, domestic and foreign – to understand the interplay between the GDPR, national legislation, and the country’s privacy‑by‑design agenda. This guide provides an in‑depth analysis of the legal framework, policy priorities, practical compliance requirements and edge cases.

The EU’s GDPR applies directly to EU member states. For Norway, the GDPR was incorporated into national law through the Personal Data Act 2018, which implements the GDPR by reference to its incorporation into the EEA Agreement. The Act repealed the previous Personal Data Act and supplements the GDPR with limited national provisions. Norway’s transposition means that the main GDPR principles – lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability – apply in full.

1.2 Scope of application and territorial reach

The Personal Data Act applies to:

Controllers or processors established in Norway, regardless of where processing occurs.
Processing of personal data on data subjects located in Norway by a controller or processor not located in the EEA, if the processing relates to offering goods or services to those data subjects or to monitoring their behaviour in Norway. This means non‑Norwegian companies targeting Norwegian customers through a website or app are subject to the GDPR.
Processing by a controller not established in Norway but in a location subject to Norwegian law under international law.

The Act clarifies that the GDPR does not apply to law enforcement activities (which are instead governed by the Law Enforcement Directive) and does not apply to areas outside the scope of EU law, such as national security. It also states that personal data processing by an individual for strictly personal or family activities or by individuals in accordance with laws relating to the administration of justice falls outside the GDPR’s scope. For journalistic, academic, artistic or literary purposes, the GDPR applies only insofar as necessary to safeguard freedom of expression, and some provisions can be disapplied.

1.3 National supervisory authority

Norway has a single data protection authority, the Datatilsynet (Norwegian Data Protection Authority). It is an independent administrative body under the Ministry of Government Administration and Reform and continues to act as the supervisory authority under the GDPR. Because Norway is not an EU member state, Datatilsynet participates in the European Data Protection Board but does not have voting rights.

Datatilsynet enforces the Personal Data Act, provides guidance, conducts audits, and can issue orders and fines. Under national law, the DPA may impose fines on public authorities and may also impose coercive daily fines for non‑compliance. Non‑pecuniary damages can be awarded to individuals affected by breaches. There are no additional data protection authorities in Norway.

2. Privacy in Norway’s digital strategies

2.1 Privacy as a prerequisite for trust

Norway’s National Digitalisation Strategy emphasises privacy as a human right that is “a prerequisite for other key democratic values such as freedom of information and freedom of expression”. It acknowledges that digitalisation often occurs at the expense of privacy because assessments are not sufficiently comprehensive across sectors. To succeed with digitalisation, citizens must trust that data are handled appropriately; thus effective privacy protection is a prerequisite for successful digitalisation.

The strategy commits to safeguarding privacy in all digitalisation efforts and sets a goal to increase citizens’ confidence in the public sector’s privacy efforts by 20 percent by 2030. It mandates that all relevant IT solutions in the public sector shall have built‑in privacy protection, reflecting the GDPR’s “privacy by design and by default” principle. It further stresses the importance of ensuring citizens’ privacy in their interactions with Tech Giants, signalling Norway’s concerns over international data transfers and platform power.

2.2 Data ethics council and holistic privacy policies

Recognising that privacy assessments are not comprehensive, the strategy proposes establishing an independent advisory body – a data ethics council – similar to Denmark’s Data Ethics Council. This body would evaluate ethical dilemmas and ensure that privacy considerations are integrated into public debate and policy formulation. The council is intended to inform decisions where privacy interests must be balanced against other societal values.

A holistic approach is emphasised: privacy must not be evaluated on a case‑by‑case basis but from a societal perspective. Policies should address the fair balance of power between users and digital service providers, since individuals often lack influence over how their data are processed. The strategy highlights issues such as data‑driven business models that rely on behavioural advertising, which make it difficult for users to understand how much data is collected and used. Such models can lead to market dominance by large corporations and erode privacy standards. Additionally, privacy challenges in the labour market (employee monitoring) and in children’s use of social media are noted.

2.3 Public sector responsibility and regulatory coherence

The strategy recognises that extensive data sharing within the public sector requires authorities to take particular responsibility for privacy. It calls for clear legislation, good guidance and effective enforcement to create and maintain trust. The Government will work towards a more uniform regulatory framework and comprehensive privacy assessments. Data‑driven business models that challenge core privacy rights are deemed problematic; the Government states that citizens should not have to choose between digital services and effective privacy protection. Citizens must receive comprehensible information enabling informed privacy choices.

2.4 Other strategic initiatives

The digital strategy also emphasises securing future‑oriented digital competence (aiming to reduce unmet ICT skills) and harnessing AI and data‑driven innovation. These elements indirectly support privacy because competent public servants and developers are better equipped to implement privacy‑preserving technologies and risk assessments. The strategy also emphasises inclusion and digital identities, ensuring that everyone can participate in digital society while being protected from disinformation and harmful content.

3.1 Lawful bases and sensitive data

The GDPR requires a lawful basis for processing personal data: consent, contract, legal obligation, vital interests, public task or legitimate interests. Norway has not introduced specific rules on processing personal data in compliance with a legal obligation or public interest. However, the Data Protection Authority may authorise processing of sensitive personal data when necessary for substantial public interest, and the Ministry has power to enact provisions specifying such instances. No such regulations have yet been enacted.

Under the GDPR, special categories of data (e.g., health, genetic data) require additional protection. The Personal Data Act clarifies that national identity numbers and other unique identifiers, such as fingerprints, may only be processed when there is an objective need for secure identification and the method is necessary for that purpose. It also provides that employers may process special categories of personal data and criminal data when necessary to perform obligations or exercise rights in the field of employment.

3.2 Data subjects’ rights and national restrictions

Data subjects have rights to information, access, rectification, erasure, restriction of processing, portability and objection. Norway has introduced restrictions on the right to information when disclosure would harm national security, foreign policy interests, defence, criminal investigations, or fundamental private or public interests. Information may also be withheld if disclosure could be detrimental to the data subject’s health or relationships or if a statutory duty of confidentiality applies. Similar restrictions apply to the duty to inform data subjects of a data breach. Furthermore, the right to information can be restricted for archiving purposes in the public interest, scientific or historical research, or statistical purposes if providing information requires disproportionate effort.

The Personal Data Act sets out that the GDPR does not apply when personal data are processed by an individual for strictly personal or family activities or for court proceedings. The Act allows exemptions to the right of access when necessary to protect national security or defence, prevent criminal offences, or protect the rights of others.

3.3 International data transfers

Norwegian law makes no specific rules on the transfer of personal data from public registers. However, public archives cannot be stored outside of Norway. Data transfers are not subject to restrictions beyond the GDPR. Consequently, data may be transferred out of Norway subject to the standard GDPR mechanisms: adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, or derogations for specific situations. Organisations must still conduct transfer impact assessments to address European Court of Justice (Schrems II) requirements and ensure adequate safeguards.

3.4 Data protection officers and impact assessments

The GDPR requires certain controllers and processors to appoint a data protection officer (DPO), particularly public authorities and organisations performing large‑scale monitoring or processing of sensitive data. Norway has not implemented additional circumstances requiring appointment beyond the GDPR. DPOs must be registered with Datatilsynet. The Act empowers the government to adopt a regulation on the obligation to appoint a DPO, but none has been issued.

Organisations must carry out data protection impact assessments (DPIAs) for high‑risk processing. While the national law does not impose additional criteria, Datatilsynet publishes a list of processing operations that always require a DPIA (e.g., systematic monitoring of employees). Failure to conduct a DPIA when required could lead to enforcement action.

3.5 Record‑keeping and prior consultation

There is no obligation under Norwegian law to notify the regulator of processing activities; however, controllers and processors must maintain a record of processing. Datatilsynet may request access to these records for supervision. Prior consultation with the DPA is required if a DPIA indicates that processing would result in high risk and the controller cannot mitigate that risk. Norwegian law has no additional prior consultation requirements.

4. National derogations and special rules

Norwegian law contains several national provisions that modify or complement the GDPR. Understanding these is essential for compliance.

4.1 Restriction of data subject rights

As noted above, Norway restricts the right to information and breach notification where disclosure could harm national security, foreign policy, defence or criminal investigations, where information concerns strictly internal case preparation, or where disclosure would contravene fundamental private or public interests. The Ministry may also adopt regulations further restricting data subject rights, but none have been enacted.

The Personal Data Act also allows restrictions to the right of access where data are processed for archiving in the public interest, scientific or historical research, or statistical purposes and providing access would require disproportionate effort or impede the purpose.

4.2 National identity numbers and unique identifiers

Norway’s use of national identity numbers (fødselsnummer) is pervasive across public and private sectors. The Personal Data Act stipulates that processing national identity numbers and other unique identifiers may only occur when there is an objective need for secure identification and the method is necessary to achieve such identification. This restriction seeks to minimise the risk of identity theft and misuse. The government may adopt regulations on the use of identity numbers; organisations should monitor developments and ensure they only collect identity numbers when strictly necessary.

4.3 Employer access to employee communications and surveillance

The Working Environment Act and associated regulations govern employers’ access to employees’ email accounts and electronic equipment. Access is permitted only when necessary to safeguard the business or other legitimate interests, or where there is justified suspicion of a material breach of duties. Employers must notify the employee and allow the employee to be present during the review. Video surveillance of employees is allowed only when objectively justified and not an undue strain. Surveillance of offices occupied by a limited group is permitted only to prevent hazardous situations or safeguard safety. These rules illustrate Norway’s emphasis on employee privacy and set boundaries for workplace monitoring.

4.4 Processing criminal data

The Personal Data Act provides that processing data relating to criminal convictions and offences is generally subject to the same rules as processing special categories of personal data. Such processing may occur when carried out under official authority or authorised by EU or national law with appropriate safeguards.

4.5 Government authority to authorise sensitive processing

The Personal Data Act contains a clause allowing Datatilsynet to exempt controllers from the prohibition on processing sensitive personal data when processing is necessary for important public interests. The authority must set conditions to safeguard data subjects’ rights and interests. The government may adopt regulations for such processing, but again, none have yet been enacted.

4.6 Derogations for freedom of expression

To balance privacy against freedom of expression and information, Norway provides a journalistic exemption. When personal data are processed solely for journalistic purposes or for academic, artistic or literary expressions, only certain GDPR provisions apply (articles 24, 26, 28–29, 32 and 40–43). This means that other obligations, such as data subject rights and legal bases, may be curtailed for media and artistic work. However, such processing must still respect ethics and can be subject to national rules.

4.7 Exceptions for public archives

Although international data transfers are not restricted beyond the GDPR, public archives cannot be stored outside Norway. This reflects a sovereign interest in preserving state records within national borders. Organisations working with archival services must ensure storage is domestic or in approved jurisdictions.

The GDPR allows member states to lower the age at which children can provide consent for information society services (between 13 and 16). Norway set this age at 13, aligning with the EU minimum. A proposal exists to raise the age to 15, but it is not yet in force. Organisations offering digital services to children must design consent mechanisms accordingly.

5. Privacy by design and by default

5.1 National emphasis on built‑in privacy

The GDPR’s Article 25 requires controllers to implement data protection by design and by default. Norway’s digitalisation strategy amplifies this principle by mandating that all relevant public sector IT solutions have built‑in privacy protection. The strategy notes that trust in government services has declined over time and sets a goal to increase confidence by 20 per cent. Privacy by design ensures that digital services embed data‑minimisation, pseudonymisation, encryption, and access controls from the outset.

5.2 Datatilsynet’s guidelines on data protection by design

Datatilsynet has developed guidelines on data protection by design and by default. While we cannot access the full text within this research, a summary states that the Authority cooperated with security professionals and software developers to create the guidelines. These guidelines help organisations translate Article 25 into practice by:

Conducting privacy risk assessments early in the development lifecycle, identifying threats to confidentiality, integrity and availability and designing mitigation measures.
Applying data minimisation, collecting only data necessary for the specified purpose.
Implementing pseudonymisation or anonymisation where possible, especially for analytics and research.
Ensuring access control and authentication mechanisms limit personal data access to authorised personnel.
Encrypting data at rest and in transit and using secure coding practices.
Designing user interfaces that clearly communicate data practices and allow individuals to exercise their rights.
Establishing default settings that are privacy‑friendly; for example, disabling optional data sharing unless the user opts in.
Maintaining documentation and audit trails to demonstrate compliance.

Adopting these principles is essential for public bodies fulfilling the digitalisation strategy’s requirements, but they are equally relevant for private sector companies operating in Norway.

6. Enforcement and penalties

6.1 Administrative fines and coercive measures

Datatilsynet may impose administrative fines for GDPR violations. Unlike in some EEA countries, the Authority may fine public authorities. In addition, if a controller or processor fails to comply with a DPA order, the Authority can impose a coercive fine for each day of non‑compliance. Such coercive fines are intended to motivate compliance rather than punish.

The Personal Data Act provides that fines of up to the greater of 2 per cent of annual global turnover or €10 million may be imposed for contraventions of certain GDPR provisions on sensitive data and criminal data processing. This aligns with the GDPR’s tiered penalty structure (the maximum general penalty is 4 per cent of global turnover or €20 million). The Act also allows individuals to claim non‑pecuniary damages for privacy violations.

6.2 Judicial remedies and due process

Individuals may complain to Datatilsynet about data protection violations. Decisions by the Authority can be appealed to the Norwegian Privacy Appeals Board (Personvernnemnda). Judicial review is available before the courts. Controllers and processors have the right to be heard and to present evidence in enforcement proceedings. Norway’s Constitution and administrative law require that sanctions be proportionate and that legal certainty be ensured.

7. Sector‑specific considerations and edge cases

7.1 Public sector and open data

Norway is a leader in open data. Public registers such as the Brønnøysund Register and the Land Register make large datasets publicly accessible. Organisations reusing open data must comply with the GDPR and the Open Data Regulations. Data should be anonymised or aggregated when possible. When publishing personal data is necessary (e.g., company director names), legal bases and transparency obligations apply.

7.2 Health and research

Health data are sensitive and subject to strict confidentiality. Norway’s Health Research Act and regulations require ethics committee approval for health research projects and specify when consent is required. The National E‑Health Programme emphasises secure patient portals and digital prescriptions. Research use of health data often relies on legal bases other than consent, such as tasks carried out in the public interest. Researchers must conduct DPIAs and may need approval from the ethics committee and the DPA.

7.3 Children and young people

The digital strategy notes that children are particularly vulnerable to privacy risks and emphasises safe digital upbringing. Social media platforms are rarely age‑appropriate, and children may not understand how their data are used. The strategy calls for strengthened protection against harmful content and stricter control of digital footprints. Companies targeting minors must design interfaces that are age‑appropriate, obtain valid parental consent where required, and provide clear information.

7.4 Employers

Employers in Norway must navigate a complex web of privacy laws. The Working Environment Act restricts employer access to employee emails and devices to cases where it is necessary to safeguard the business or there is justified suspicion. Employees must be notified and given the right to be present during reviews. Video surveillance is allowed only when objectively justified and not an undue strain on employees; surveillance of office areas used by few people requires specific safety reasons. Employers must also comply with rules on monitoring employees’ electronic communications and ensure that any monitoring is proportionate and documented in a DPIA.

7.5 Marketing and behavioural advertising

Behavioural advertising is ubiquitous but raises privacy concerns due to extensive profiling. The digitalisation strategy criticises data‑driven business models that rely on users disclosing personal data without understanding how it is used. Companies must ensure they have a valid legal basis for profiling (often consent or legitimate interest) and provide clear information. Consent must be freely given, informed and specific; pre‑ticked boxes or bundled consent is invalid. Norway follows the ePrivacy Directive for cookies and requires opt‑in consent for non‑essential cookies.

7.6 Artificial intelligence and big data

Norway intends to be a leader in ethical and safe AI. AI systems often involve processing large datasets, raising questions about fairness, transparency and bias. Controllers must ensure that automated decision‑making complies with Article 22 GDPR and that individuals understand the logic behind decisions. DPIAs are usually required for AI projects. Public authorities developing AI services must embed privacy by design and ensure that algorithms do not perpetuate discrimination.

7.7 Cross‑border operations and cloud services

Many organisations use cloud providers based outside Norway. While Norway imposes no additional restrictions on international transfers beyond the GDPR, public archives must remain in Norway. Public entities should verify that cloud providers can guarantee data localisation if required. For other transfers, Standard Contractual Clauses, Binding Corporate Rules or adequacy decisions (e.g., EU–US Data Privacy Framework) are necessary. Transfer Impact Assessments should address foreign surveillance risks.

7.8 Law enforcement and national security

The GDPR does not apply to law enforcement or national security activities. Norway’s Law Enforcement Directive (implementing Directive (EU) 2016/680) and National Security Act govern processing for policing and intelligence. Data collected by security services may be subject to stricter secrecy and oversight by the Norwegian Parliamentary Intelligence Oversight Committee (EOS‑utvalget).

8. Practical compliance guidance

For organisations operating in Norway, complying with GDPR and Norwegian privacy law requires a systematic approach. Below is a non‑exhaustive checklist of actionable next steps.

Map data flows and establish records of processing: Identify all personal data processing activities, classify data types (e.g., sensitive data), document purposes, legal bases, recipients and retention periods. Ensure that processing activities involving Norwegian data subjects or operations established in Norway are covered. Maintain these records and update them regularly.
Assess legal bases and special category data: Verify that each processing activity has a valid legal basis under Article 6 GDPR. If processing special categories of data (health, race, political opinions), confirm that an Article 9 condition applies. For unique identifiers like national identity numbers, ensure that processing is objectively necessary for secure identification.
Implement privacy by design and default: Embed privacy considerations into system architecture. Follow Datatilsynet’s guidelines by conducting privacy risk assessments during project initiation, using data minimisation, pseudonymisation and encryption, and ensuring default settings are privacy‑friendly. Public sector projects must explicitly show how built‑in privacy protection is achieved.
Conduct Data Protection Impact Assessments: For high‑risk processing (e.g., large‑scale monitoring, sensitive data, AI), perform DPIAs and consult Datatilsynet if risks cannot be mitigated. Use the Authority’s published list of operations requiring DPIAs.
Appoint a data protection officer when required: Identify if your organisation falls under mandatory DPO requirements (public bodies, large‑scale monitoring, large‑scale processing of special categories). Register the DPO with Datatilsynet and ensure independence and expertise.
Review contracts and vendor management: Ensure data processing agreements with processors include GDPR Article 28 clauses. Verify that cloud and IT providers meet Norwegian localisation requirements (e.g., for public archives) and that data transfers outside the EEA have appropriate safeguards.
Update privacy notices and consent mechanisms: Provide clear, concise and comprehensive privacy notices in Norwegian and English. Ensure consent mechanisms meet GDPR standards (freely given, specific, informed, unambiguous). For children’s services, adapt language appropriately and obtain parental consent for users under 13.
Establish procedures for data subject requests and breach notification: Develop internal processes to respond to access, rectification, erasure, restriction and portability requests. Train staff to recognise and handle these requests within statutory timeframes. Set up breach response plans and define criteria for notifying Datatilsynet and affected individuals, taking into account national restrictions on breach notifications.
Train employees and build a privacy culture: Educate employees about GDPR principles, company policies, acceptable use of employee monitoring tools, and the importance of privacy. Provide specialised training for development teams on privacy by design and for customer service teams on data subject rights.
Monitor regulatory developments: Stay informed about evolving guidance from Datatilsynet, the European Data Protection Board and the EU Court of Justice. Monitor potential changes to the age of consent (proposed increase to 15), new regulations on national identity number processing, and sector‑specific rules (e.g., health, education). Engage with industry associations and consider participating in policy consultations or the future data ethics council.
Document compliance and accountability: Maintain documentation demonstrating compliance: records of processing, DPIAs, consent logs, training materials, vendor assessments, breach logs and risk assessments. This documentation will be essential in audits or investigations.
Prepare for enforcement: Understand that Datatilsynet can fine public sector bodies and impose coercive daily penalties. Appoint legal counsel experienced in Norwegian privacy law to advise on investigations and represent the organisation. Maintain insurance coverage for cyber incidents and GDPR fines.

9. Looking ahead: the future of privacy in Norway

Norway’s digital ambitions are expansive: the Government aims to make Norway the world’s most digitalised country by 2030 and to lead the Nordic region in digital innovation. Achieving this requires balancing innovation with robust privacy protection. The digitalisation strategy signals a shift towards viewing privacy as a strategic asset rather than a compliance burden. Concepts such as privacy‑friendly AI, data ethics councils, children’s digital rights, security by design, and inclusive digital skills will shape the next decade.

At the same time, Norway must navigate global developments: evolving EU data transfer frameworks (e.g., the EU–US Data Privacy Framework), emerging regulations on artificial intelligence (AI Act) and digital services, and transnational law enforcement co‑operation. The Data Protection Authority is actively involved in European debates but cannot vote in the European Data Protection Board, which may limit its influence. National policymakers will therefore need to adapt EU-level rules to Norway’s context while safeguarding sovereignty (e.g., domestic archival storage). Organisations should anticipate new guidance and possibly additional legislation on matters like data ethics, identity number usage, and children’s data.

Conclusion

Norway’s approach to privacy is multifaceted. The GDPR, implemented through the Personal Data Act, provides the legal backbone, while Norway’s digitalisation strategy and related policies elevate privacy to a prerequisite for public trust and digital success. Norway emphasises privacy by design and by default, requiring built‑in privacy in public sector IT solutions and encouraging similar practices in the private sector. National provisions add layers: restrictions on data subject rights for national security and criminal investigations, strict rules on the use of national identity numbers, limitations on employer monitoring, and the ability of the DPA to authorise sensitive processing for public interest.

For organisations operating in Norway, compliance is not merely a box‑ticking exercise. It requires understanding Norway’s cultural emphasis on trust, transparency, fairness, and digital inclusion. By aligning with GDPR requirements, national rules, and the Government’s privacy‑centric digital vision, organisations can build resilient data practices, foster citizen confidence, and participate in Norway’s digital transformation. Those that embed privacy into their products and services from the outset will be better placed to succeed in Norway’s data‑driven economy.

References

National Digitalisation Strategy 2024–2030 (The Digital Norway of the Future) – emphasises that privacy is a human right and a prerequisite for democracy; calls for built‑in privacy in all public sector IT solutions; notes that privacy assessments are often incomplete and highlights the need for a data ethics council; articulates the need for comprehensive privacy policies and fair balance of power.
White & Case – GDPR Guide to National Implementation: Norway – explains that the Personal Data Act implements the GDPR and entered into force on 20 July 2018; notes that data transfers are not subject to restrictions beyond the GDPR but public archives must be stored in Norway; lists restrictions on data subject rights for national security and criminal investigations; describes the DPA’s power to fine public authorities and impose coercive daily fines; sets out the journalistic exemption balancing privacy and freedom of expression.
Linklaters – Data Protected Norway – clarifies that the Personal Data Act applies to controllers established in Norway and extraterritorial processing targeting Norwegian data subjects; confirms that the GDPR does not apply to personal or household activities or processing for journalistic, academic or artistic expression; states that processing national identity numbers and other unique identifiers requires an objective need for secure identification; explains restrictions on employer email access and video surveillance; and highlights the DPA’s authority to allow sensitive processing for important public interests.
Cybersecurity Intelligence – Norwegian Data Protection Authority – notes that Datatilsynet developed guidelines on data protection by design and by default, co‑created with security professionals and software developers to help organisations implement Article 25 GDPR.

Export metadata: recovered source URLs

The original report text above is preserved from the conversation; only leaked internal citation tokens were removed for publication. The following URLs were recovered from the research session and are appended as export metadata.

Government of Norway, The Digital Norway of the Future: https://www.regjeringen.no/en/documents/the-digital-norway-of-the-future/id3054645/
Government of Norway, National Digitalisation Strategy 2024–2030 PDF: https://www.regjeringen.no/contentassets/c499c3b6c93740bd989c43d886f65924/en-gb/pdfs/digitaliseringsstrategi_eng.pdf
Lovdata, Personal Data Act: https://lovdata.no/dokument/NL/lov/2018-06-15-38
Datatilsynet: https://www.datatilsynet.no/en/
White & Case, GDPR Guide to National Implementation: Norway: https://www.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-norway
Linklaters, Data Protected: Norway: https://www.linklaters.com/en/insights/data-protected/data-protected---norway
EDPB: https://www.edpb.europa.eu/