Datamottaker

Datamottaker (data recipient) is a term used in privacy and data protection to describe a person or organization that receives personal data from a data controller. A datamottaker can be a processor (databehandler) acting on behalf of the controller, or another data controller that receives data for its own purposes, including public authorities when legally permitted or required to receive data.

The role of a datamottaker is defined by data protection principles and agreements. The data controller remains responsible for ensuring that sharing data with the recipient is lawful, necessary, and has a defined purpose. When data is shared, there should typically be a data processing agreement or other contract that specifies purposes, retention periods, security measures, and how data subjects’ rights are protected.

Legal requirements for datamottakere include implementing appropriate technical and organizational safeguards, ensuring transparency to data subjects, and facilitating exercise of rights such as access or erasure. Cross-border transfers of personal data to datamottakere in other jurisdictions require adequate safeguards, such as standard contractual clauses or an adequacy decision, and ongoing monitoring of compliance.

Examples of datamottakere include cloud service providers that store and process data, business partners involved in a project, analytics or marketing vendors, and public authorities receiving data under statutory obligations. The concept is commonly referenced in privacy notices, data sharing agreements, and risk assessments as part of ensuring responsible data handling.

Datatilsynet and other authorities describe datamottaker as a key element in documenting who receives data, why it is shared, and how recipients are obliged to protect personal data.