datatilsynet

Datatilsynet, the Norwegian Data Protection Authority, is an independent government agency responsible for supervising privacy and data protection laws in Norway. Its core mission is to safeguard individuals’ privacy rights and promote responsible data processing by public authorities, businesses, and other organizations.

Datatilsynet administers the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven). It handles complaints from individuals, conducts investigations and audits, and can issue warnings, corrective orders, and administrative fines. The agency may require organizations to remediate processing activities, implement appropriate safeguards, and improve data breach notification practices. It also oversees privacy practices in the public sector and supports privacy impact assessments and data protection by design.

Beyond enforcement, Datatilsynet provides guidance, training, and information to both the public and organizations. It publishes guidelines, codes of conduct, and explanatory material on topics such as consent, data subject rights (access, correction, erasure, restriction, objection, data portability), data retention, and data transfers.

Datatilsynet participates in international cooperation on data protection. It collaborates with other European data protection authorities through the European Data Protection Board and handles cross-border cases involving Norwegian residents. It assesses transfers of personal data to third countries and ensures that appropriate safeguards are in place under GDPR.

The agency operates independently of political influence and is funded by the Norwegian state. It is led by a director and is based in Oslo, serving as Norway’s national supervisor for privacy in the modern data landscape.