Norway · Compliance
GDPR compliance in Norway
Achieve GDPR compliance in Norway with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Enschede office team
- Effivity software included
- Academy training included
Who asks for GDPR in Norway
Clients include
GDPR compliance in Norway at a glance
Regulation (EU) 2016/679 (GDPR) as incorporated into the EEA Agreement is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Norway ask for evidence that you meet it.
Norway applies the GDPR as an EEA state, not as an EU member. Datatilsynet states that the Regulation became applicable there on 20 July 2018 and that Norway is bound by it in the same manner as EU member states, while the Personal Data Act, personopplysningsloven, carries the Norwegian adaptations and yields to the Regulation in a conflict. The Act reaches establishments in Norway and also businesses outside the EU/EEA that offer goods or services to people in Norway or monitor their behaviour, which must appoint a representative in the EU/EEA. No general GDPR certificate exists, though Datatilsynet explains that codes of conduct and certification bodies need accreditation by Datatilsynet or Norsk akkreditering. Sterling's Enschede office builds the evidence of compliance, from records of processing to breach procedures, and aligns it with ISO/IEC 27701 where a client wants an external benchmark.
Who needs GDPR in Norway, and what happens without it
These are the organisations in Norway that most often need to show GDPR.
- Companies established in Norway that process personal dataThe Personal Data Act applies when establishments in Norway process personal data, with Datatilsynet as supervisor.
- Organisations outside the EU/EEA serving people in NorwayThe Act applies directly to businesses whose processing relates to offering goods or services to people in Norway or monitoring their behaviour.
- SaaS, cloud and outsourcing providers acting as processorsNorwegian customers need processor evidence on security, sub-processors and incident handling.
- Health and care organisations and their suppliersNormen sets information security and privacy requirements for those who commit to it by agreement.
- Organisations considering codes of conduct or certificationDatatilsynet approves codes and criteria, and bodies are accredited by Datatilsynet or Norsk akkreditering.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the GDPR readiness checkGDPR requirements in Norway
Strip away the vocabulary and the GDPR requires an organisation to comply in six areas covering how it uses personal data.
In Norway these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: GDPR explained →
How to achieve GDPR compliance in Norway
One team from the Enschede office carries the work from scoping to sign-off. Clients across Norway are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against GDPR and the Norwegian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does GDPR compliance take in Norway?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Norway these are the factors that set the timeline.
- Number of processing activities and systems to map
- Processors, sub-processors and international transfers to review
- Entities in the group and the supervisory authorities involved
- Security remediation and breach readiness
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does GDPR compliance cost in Norway?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Norway these factors move both.
- Volume of processing activities and data subjects
- Number of entities and systems in scope
- Security remediation needed
- External data protection officer arrangements
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
GDPR consultants and assessors in Norway
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers GDPR and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Norway are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive GDPR in Norway (4)
| Instrument | How it treats the standard |
|---|---|
| Regulation (EU) 2016/679 (GDPR) as incorporated into the EEA Agreement | The instrument itself Datatilsynet states it became applicable in Norway on 20 July 2018 and that Norway is bound by it in the same manner as EU member states. |
| Lov om behandling av personopplysninger (personopplysningsloven) | The instrument itself National adaptations; it applies to establishments in Norway and to some businesses outside the EEA, and the GDPR has priority over Norwegian law in a conflict. |
| Datatilsynet — codes of conduct and certification | Regulator Approves codes of conduct and certification criteria; certification and monitoring bodies are accredited by Datatilsynet or Norsk akkreditering. |
| Datatilsynet — the Norwegian Data Protection Authority | Regulator An independent body set up in 1980 that supervises authorities, companies and organisations through information, dialogue, complaints handling and inspection. |
Accreditation, audit language and remote audits in Norway
Compliance, not certification: the GDPR has no general certificate. Evidence is the controller's or processor's records of processing, notices, contracts, procedures and security measures. Certification mechanisms under Article 42 can exist, with certification bodies accredited by Datatilsynet or Norsk akkreditering, and ISO/IEC 27701 certification by an accredited body is an optional external benchmark. Edition and transition details: GDPR hub →
Audit language
Norwegian and English are both workable for audits; agree the audit language and the language of controlled documents with the certification body at application, and follow any language clause in a tender or customer contract.
Remote and on-site
Remote audit elements are at the certification body's discretion; production, office and service sites are normally visited.
GDPR in Norway: questions clients ask
Who supervises the GDPR in Norway?
Datatilsynet, the Norwegian Data Protection Authority. It describes itself as an independent body set up in 1980, financed by the state and administratively under the Ministry of Digitalisation and Public Governance. It supervises authorities, companies, organisations and individuals through guidance, dialogue, complaints handling and inspection, and it forms the first stop for questions about personal data.
How does the GDPR have legal force in Norway without EU membership?
Through the EEA Agreement. The GDPR was incorporated into it and became applicable in Norway on 20 July 2018, and the Personal Data Act supplies the Norwegian adaptations. Both the Act and the EEA Act give the Regulation priority over Norwegian law where they conflict, so a national rule must fit the Regulation's system to stand.
Does the Norwegian Personal Data Act apply to businesses outside Europe?
Sometimes. Datatilsynet explains that the Act applies directly to a business outside the EU/EEA when its processing relates to offering goods or services to people in Norway or monitoring their behaviour, and that such a business must appoint a representative in the EU/EEA. Take advice from counsel on whether your activities meet that test.
Is there a GDPR certificate available in Norway?
There is no general certificate that proves GDPR compliance. The Regulation does allow voluntary certification mechanisms, and Datatilsynet states that certification and monitoring bodies must be accredited by Datatilsynet or Norsk akkreditering. Day-to-day compliance rests on records, notices, contracts and security measures, with ISO/IEC 27701 as an optional benchmark.
More on GDPR for Norwegian organisations
Other standards Norwegian businesses ask Sterling for
Organisations in Norway often combine GDPR with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Regulation (EU) 2016/679 (GDPR) as incorporated into the EEA Agreement — datatilsynet.no (accessed 11 Oct 2026)
- Lov om behandling av personopplysninger (personopplysningsloven) — datatilsynet.no (accessed 11 Oct 2026)
- Datatilsynet — codes of conduct and certification — datatilsynet.no (accessed 11 Oct 2026)
- Datatilsynet — the Norwegian Data Protection Authority — datatilsynet.no (accessed 11 Oct 2026)
- Norsk akkreditering (Norwegian Accreditation) — akkreditert.no (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice