One law, one regulator
Norway applies the EU’s GDPR through the Personal Data Act (personopplysningsloven), and the regulator is Datatilsynet. If your site collects names, emails, order details or analytics data, the rules apply to you, whether you run a shop in Oslo or a clinic in Tromsø.
Cookies need consent
Under the Electronic Communications Act (ekomloven), optional cookies and trackers may load only after the visitor says yes. A banner that offers “Accept” and “Reject” with equal weight, and a record of each choice, keeps you on safe ground.
Your rights and your duties
Visitors can ask to see, correct or delete their data, and you normally have one month to answer. Serious breaches must be reported to Datatilsynet within 72 hours.
- A privacy notice that says what is collected, why and for how long
- Consent before optional cookies and tracking load
- A simple way to access, correct and delete personal data
- A data processing agreement with every vendor that handles customer data
- A written record of every breach and a 72-hour reporting routine
Globalsoft TeamGlobalsoft · Erbil · Istanbul