Norwegian Personal Data Act (Personopplysningsloven)
Datatilsynet is one of Europe's most active enforcement authorities—Norwegian fines follow full EU GDPR scales, with landmark actions exceeding NOK 65 million.
The Norwegian Personal Data Act (Personopplysningsloven) implements the EU GDPR in Norway through the EEA Agreement. Norway is not an EU member state but applies the GDPR in full as part of the European Economic Area, with supplementary national provisions.
Datatilsynet (the Norwegian Data Protection Authority) is one of Europe's most proactive supervisory authorities, known for landmark enforcement actions including the record Grindr fine and the Meta behavioural advertising ban that was subsequently adopted across the EU.
For Microsoft 365 environments, compliance mirrors EU GDPR requirements: Purview sensitivity labels for data classification, DLP policies for data protection, Conditional Access for access management, and Norwegian data residency considerations. StremarControl engineers and operates the Microsoft-native controls required for Norwegian GDPR mandates, translating obligations into enforceable Microsoft-native controls, structured evidence, and ongoing assurance discipline for Datatilsynet compliance reporting.
Why This Matters Now
Norway implements the EU GDPR through its Personal Data Act (Personopplysningsloven), making GDPR directly applicable as part of the EEA Agreement. Datatilsynet has been one of the most active European DPAs, issuing significant fines and enforcement decisions. For M365 environments, compliance requires the same controls as EU GDPR plus Norwegian data residency considerations, Conditional Access for access management, and Purview for data classification. Norway's sovereign wealth fund and energy sector make robust data protection compliance essential.
Framework Metadata
Scope & Applicability
Applies to all data controllers and processors established in Norway, or processing personal data of individuals in Norway. As an EEA member, Norway applies the EU GDPR in full with minor national supplementary provisions. Special provisions exist for research, journalism, and employment context. M365 tenants processing Norwegian personal data must comply with full GDPR requirements plus Norwegian supplementary rules.
Core Obligations
GDPR Compliance (via EEA)
Full compliance with EU GDPR data protection principles, lawful bases for processing, and data subject rights as implemented through the EEA Agreement.
Data Protection Officer
Appoint a DPO where core activities involve regular and systematic monitoring at scale, or large-scale processing of special category data.
Norwegian Supplementary Provisions
Comply with Norwegian-specific provisions for employment context processing, research exemptions, and national identification numbers.
Breach Notification
Notify Datatilsynet of personal data breaches within 72 hours where feasible. Notify data subjects where the breach poses a high risk.
Microsoft 365 Control Mapping
How each obligation maps to enforceable Microsoft 365 controls and the evidence they produce.
GDPR Data Protection Controls
Purview sensitivity labels for data classification. DLP policies for data protection. Conditional Access with MFA and risk-based policies.
Label usage analytics, DLP incident logs, Conditional Access evaluation reports.
Norwegian Data Residency
M365 data residency configuration for Norwegian/Nordic regions. Multi-Geo where required. DLP geo-fencing for cross-border restrictions.
Data residency configuration exports, Multi-Geo assignment reports, DLP cross-border logs.
72-Hour Breach Notification
Defender XDR incident detection with Sentinel playbooks for Datatilsynet notification. Automated breach assessment workflows.
Incident timeline reports, breach notification records, Datatilsynet submission logs.
Implementation Timeline
Related Frameworks
With fines exceeding EUR 1.2 billion for major infractions, GDPR non-compliance is a material financial risk that demands board-level ownership.
Criminal fines up to CHF 250,000 target responsible individuals personally—not the organisation—making Swiss data protection compliance a direct executive liability.
Post-Brexit divergence means UK organisations must now navigate two parallel GDPR regimes, with the ICO imposing fines up to GBP 17.5 million or 4% of global turnover.
Ready to get Norway PDL-ready?
Start with a fixed-scope sprint. We assess your Microsoft 365 controls against Norway PDL requirements, close gaps, and produce audit-ready evidence.