Norway Data Protection & Privacy Regulation

Controller/Processor Duties

Datatilsynet is conducting a three-phase supervisory programme titled "Totalforsvarsåret 2026," covering all 357 Norwegian municipalities and examining information-security governance, multi-factor authentication and access-management controls, and backup and recovery arrangements. Within 2026, the programme moved into a documentation-request phase in which the regulator asked 104 selected municipalities to provide documentation of their security-of-processing measures. This was sourced directly from Datatilsynet's own published announcement of the programme.

The programme represents a sector-wide proactive supervisory exercise rather than a reactive enforcement action triggered by a specific incident: it tests municipal controllers' compliance with the security-of-processing obligations that apply generally under the Personal Data Act and GDPR, applied at scale across the entire municipal sector rather than targeted at a single controller. The documentation-request phase covering roughly 29 percent of all Norwegian municipalities suggests a substantial supervisory undertaking, with the remaining municipalities outside this initial documentation wave not yet confirmed as subject to equivalent scrutiny within this cycle.

Outlook

The marker to watch is whether Datatilsynet's documentation-request phase for the 104 selected municipalities progresses into a further supervisory or enforcement phase, and whether any findings from this phase are extended to the remaining municipalities outside the initial selection.

Sectoral Watch

Datatilsynet submitted a consultation response on 14 October 2026 addressing NOU 2026:8, a proposed crime-prevention information-sharing reform. The regulator's response states plainly that the proposal would make it considerably easier to share personal and confidential information than is currently possible, and warns that this could seriously affect privacy. This is a direct, pointed regulatory objection to a specific legislative proposal still working through the consultation process, rather than a settled instrument or an enacted change to information-sharing rules.

The significance of this development lies in Datatilsynet positioning itself early and explicitly against a proposal that touches the balance between crime-prevention information-sharing powers and individual privacy protections. As a proposal still at the consultation stage, NOU 2026:8 has not been enacted, and its eventual content may be shaped by Datatilsynet's intervention and by other consultation responses not captured in the evidence.

Outlook

The progress of NOU 2026:8 through further legislative stages, and whether the government responds to Datatilsynet's specific concerns about the breadth of information-sharing powers before any bill is finalised, is the key item to track in this sectoral area going forward.

Sectoral Watch

Datatilsynet submitted a consultation response on 14 October 2026 addressing NOU 2026:8, a proposed crime-prevention information-sharing reform. The regulator's response states plainly that the proposal would make it considerably easier to share personal and confidential information than is currently possible, and warns that this could seriously affect privacy. This is a direct, pointed regulatory objection to a specific legislative proposal still working through the consultation process, rather than a settled instrument or an enacted change to information-sharing rules.

The significance of this development lies in Datatilsynet positioning itself early and explicitly against a proposal that touches the balance between crime-prevention information-sharing powers and individual privacy protections. As a proposal still at the consultation stage, NOU 2026:8 has not been enacted, and its eventual content may be shaped by Datatilsynet's intervention and by other consultation responses not captured in this cycle's evidence.

Outlook

The progress of NOU 2026:8 through further legislative stages, and whether the government responds to Datatilsynet's specific concerns about the breadth of information-sharing powers before any bill is finalised, is the key item to track in this sectoral area going forward.

AdTech & Commercial Privacy

The record NOK 92 million fine against Xandr, imposed by Datatilsynet on 12 October 2026, is the defining adtech-sector development. The fine addresses the unlawful processing and sharing of Grindr users' sensitive data, specifically data revealing sexual orientation, through real-time-bidding ad auctions, conducted without a valid legal basis under the GDPR. Datatilsynet's own public framing of the decision, via Director General Line Coll's quoted statement that the breaches identified were very serious, positions the fine as the regulator's strongest enforcement signal to date against adtech practices involving sensitive personal data flowing through programmatic advertising infrastructure.

For commercial-privacy purposes, the decision is notable for targeting an intermediary in the real-time-bidding chain, Xandr, rather than the data controller that originally collected the sensitive data from users, an enforcement pattern that signals Datatilsynet's willingness to pursue participants throughout the RTB data-sharing chain rather than only the first-party collector. A three-week appeal window applies, leaving the decision's final status open for the near term.

Outlook

Whether Datatilsynet extends this enforcement pattern to other participants in the real-time-bidding ecosystem operating in or serving the Norwegian market is the key item to monitor following this decision. The outcome of any appeal within the three-week window will also determine whether this fine stands as a durable precedent for sensitive-data processing in adtech contexts.

AdTech & Commercial Privacy

The record NOK 92 million fine against Xandr, imposed by Datatilsynet on 12 October 2026, is this cycle's defining adtech-sector development. The fine addresses the unlawful processing and sharing of Grindr users' sensitive data, specifically data revealing sexual orientation, through real-time-bidding ad auctions, conducted without a valid legal basis under the GDPR. Datatilsynet's own public framing of the decision, via Director General Line Coll's quoted statement that the breaches identified were very serious, positions the fine as the regulator's strongest enforcement signal to date against adtech practices involving sensitive personal data flowing through programmatic advertising infrastructure.

For commercial-privacy purposes, the decision is notable for targeting an intermediary in the real-time-bidding chain, Xandr, rather than the data controller that originally collected the sensitive data from users, an enforcement pattern that signals Datatilsynet's willingness to pursue participants throughout the RTB data-sharing chain rather than only the first-party collector. A three-week appeal window applies, leaving the decision's final status open for the near term.

Outlook

Whether Datatilsynet extends this enforcement pattern to other participants in the real-time-bidding ecosystem operating in or serving the Norwegian market is the key item to monitor following this decision. The outcome of any appeal within the three-week window will also determine whether this fine stands as a durable precedent for sensitive-data processing in adtech contexts.

AdTech & Commercial Privacy

Datatilsynet's adtech and commercial-privacy enforcement intensified materially in 2026, with two separate actions surfacing this cycle. In June 2026, Datatilsynet found that six websites had unlawfully shared visitors' personal data with third parties, in several cases involving sensitive information, and imposed an administrative fine of approximately EUR 21,000 in connection with one of those findings. Separately, and more substantially, Datatilsynet imposed a fine of approximately EUR 1,820,000 on Elkjøp AS in 2026 for processing customer data for marketing, profiling, personalisation and analysis without a valid legal basis, with the decision citing GDPR Article 12(3). The Elkjøp fine is the largest identified for Norway this cycle and is directly evidenced via the Enforcement Tracker record.

Both actions are consistent with Datatilsynet's stated national enforcement priority around adtech and real-time-bidding-adjacent data sharing, and together they indicate the regulator is treating unlawful third-party data sharing and unlawful marketing-and-profiling processing as related but distinct enforcement categories: the six-website finding centres on unlawful third-party disclosure, while the Elkjøp fine centres on the absence of a valid legal basis for a range of internal processing purposes spanning marketing, profiling, personalisation and analysis. The scale difference between the two fines, EUR 21,000 against EUR 1.82 million, reflects the difference in scope and severity between an unlawful-disclosure finding and a broad legal-basis failure across multiple processing purposes for a large retail operation.

Outlook

Given Datatilsynet's stated priority focus on adtech and third-party data sharing, further enforcement actions in this category should be expected. Watch for whether other Norwegian retailers or commercial operators face comparable legal-basis scrutiny following the Elkjøp precedent, and for any follow-up guidance from Datatilsynet on lawful bases for marketing, profiling and personalisation processing.

Algorithmic, Biometric & Surveillance Governance

Datatilsynet's regulatory sandbox produced a conditional finding on an AI note-taking assistant tested in child welfare services across three municipalities, Kongsvinger, Stange, and Ringsaker. The sandbox concluded the tool is lawful under both the GDPR and the Child Welfare Act, subject to conditions including quick deletion of processed data, openness about the tool's use, and the maintenance of trust between child-welfare services and the families they work with. This sandbox outcome is a guidance-level finding rather than a binding regulatory instrument, but it offers a concrete, sector-specific reference point for how Datatilsynet approaches AI tools processing sensitive data in a highly sensitive public-sector context.

Separately, Norway's domestic AI Act implementation process, referred to as the KI-loven, remains at a pre-incorporation stage: the EU AI Act has not yet been brought into the EEA Agreement for Norway. The government is understood to be sending a further domestic consultation out in autumn 2026, with the stated aim of bringing a bill before the Storting in spring 2027. Nkom has been proposed as the coordinating market-surveillance authority for the eventual Norwegian AI Act regime, though this remains a proposal rather than a settled institutional arrangement. The combination of an active, outcome-oriented sandbox practice alongside a still-pending framework law illustrates a regulator exercising practical oversight ahead of its own formal legislative architecture being finalised.

Outlook

The autumn 2026 KI-loven consultation and the targeted spring 2027 Storting bill introduction are the two dates to track for Norway's AI-governance framework. Whether Nkom's proposed coordinating role is confirmed in that process, and whether further sandbox findings follow the child-welfare AI pattern, are the practical developments most likely to shape how AI governance operates in Norway ahead of formal legislative adoption.

Algorithmic, Biometric & Surveillance Governance

Datatilsynet's regulatory sandbox produced a conditional finding this cycle on an AI note-taking assistant tested in child welfare services across three municipalities, Kongsvinger, Stange, and Ringsaker. The sandbox concluded the tool is lawful under both the GDPR and the Child Welfare Act, subject to conditions including quick deletion of processed data, openness about the tool's use, and the maintenance of trust between child-welfare services and the families they work with. This sandbox outcome is a guidance-level finding rather than a binding regulatory instrument, but it offers a concrete, sector-specific reference point for how Datatilsynet approaches AI tools processing sensitive data in a highly sensitive public-sector context.

Separately, Norway's domestic AI Act implementation process, referred to as the KI-loven, remains at a pre-incorporation stage: the EU AI Act has not yet been brought into the EEA Agreement for Norway. The government is understood to be sending a further domestic consultation out in autumn 2026, with the stated aim of bringing a bill before the Storting in spring 2027. Nkom has been proposed as the coordinating market-surveillance authority for the eventual Norwegian AI Act regime, though this remains a proposal rather than a settled institutional arrangement. The combination of an active, outcome-oriented sandbox practice alongside a still-pending framework law illustrates a regulator exercising practical oversight ahead of its own formal legislative architecture being finalised.

Outlook

The autumn 2026 KI-loven consultation and the targeted spring 2027 Storting bill introduction are the two dates to track for Norway's AI-governance framework. Whether Nkom's proposed coordinating role is confirmed in that process, and whether further sandbox findings follow the child-welfare AI pattern, are the practical developments most likely to shape how AI governance operates in Norway ahead of formal legislative adoption.

Children & Vulnerable Groups

Norway's Ministry of Justice and Public Security has proposed raising the age at which children may consent to the processing of their personal data for information-society services, from 13 to 15 years. As of 24 September 2025, the checkpoint reflected in the available evidence, the proposal remained under public consultation and had not been enacted. This is understood to be a formally-tabled proposal rather than an early-stage policy idea, though its current status beyond the September 2025 consultation checkpoint was not confirmed this cycle, and the finding is accordingly held at a qualified, Probable level of confidence.

If enacted, the change would materially raise the threshold at which Norwegian children can independently consent to data processing by information-society service providers, bringing minors aged 13 and 14 within the scope of parental-consent requirements that currently apply only below age 13. This would be a consequential shift for any online service provider offering information-society services to Norwegian users, since it would expand the population of users requiring parental-consent mechanisms.

Outlook

The principal open question is the proposal's current status: whether it has advanced beyond public consultation, been amended, or been shelved, since the available evidence establishes only the position as of 24 September 2025. Watch for a Ministry announcement of the consultation's conclusion or for draft legislative text moving toward the Storting, either of which would represent the next material step in this proposal's progress.

Enforcement & Redress

Datatilsynet imposed a NOK 92 million administrative fine on the adtech intermediary Xandr on 12 October 2026, its largest penalty to date, for unlawfully processing and sharing Grindr users' sensitive data, data revealing sexual orientation, through real-time-bidding ad auctions without a valid legal basis under the GDPR. Director General Line Coll is quoted directly as saying the regulator issued such a high fine because the breaches identified were very serious, a statement that frames this as a deliberate escalation in penalty severity rather than a routine application of the existing fining scale. A three-week appeal window applies from the date of the decision, meaning the fine's final status remains open pending any challenge Xandr may bring.

The decision's significance lies in both its scale and its subject matter: sensitive-category data processed through the real-time-bidding advertising ecosystem has been a recurring area of regulatory concern across European data-protection authorities, and this fine represents Datatilsynet's most forceful enforcement statement on the topic to date in the Norwegian context. The full text of Datatilsynet's decision has not itself been retrieved; the finding rests on press coverage reporting the Director General's own quoted statement, which should be read as a limitation on granular legal reasoning rather than on the underlying fact of the fine.

Outlook

The three-week appeal window is the immediate item to track; if Xandr appeals, the eventual outcome will test the durability of Datatilsynet's reasoning on legal basis for sensitive-data processing in real-time-bidding contexts. Beyond the appeal, this decision is likely to be referenced in any future Datatilsynet guidance or enforcement action touching adtech or real-time-bidding practices involving special-category data.

Enforcement & Redress

Datatilsynet imposed a NOK 92 million administrative fine on the adtech intermediary Xandr on 12 October 2026, its largest penalty to date, for unlawfully processing and sharing Grindr users' sensitive data, data revealing sexual orientation, through real-time-bidding ad auctions without a valid legal basis under the GDPR. Director General Line Coll is quoted directly as saying the regulator issued such a high fine because the breaches identified were very serious, a statement that frames this as a deliberate escalation in penalty severity rather than a routine application of the existing fining scale. A three-week appeal window applies from the date of the decision, meaning the fine's final status remains open pending any challenge Xandr may bring.

The decision's significance lies in both its scale and its subject matter: sensitive-category data processed through the real-time-bidding advertising ecosystem has been a recurring area of regulatory concern across European data-protection authorities, and this fine represents Datatilsynet's most forceful enforcement statement on the topic to date in the Norwegian context. The full text of Datatilsynet's decision has not itself been retrieved this cycle; the finding rests on press coverage reporting the Director General's own quoted statement, which should be read as a limitation on granular legal reasoning rather than on the underlying fact of the fine.

Outlook

The three-week appeal window is the immediate item to track; if Xandr appeals, the eventual outcome will test the durability of Datatilsynet's reasoning on legal basis for sensitive-data processing in real-time-bidding contexts. Beyond the appeal, this decision is likely to be referenced in any future Datatilsynet guidance or enforcement action touching adtech or real-time-bidding practices involving special-category data.

Enforcement & Redress

Datatilsynet imposed an overtredelsesgebyr of NOK 20,000,000 on Elkjøp AS on 4 June 2026, for processing personal data in its Nordic customer-club programme — which affects more than six million members — without valid consent, under personopplysningsloven Section 26, read in conjunction with GDPR Article 83. This decision was retrieved directly from Datatilsynet's own published determination. The penalty provision allows Datatilsynet to impose an overtredelsesgebyr up to the GDPR Article 83 cap of EUR 20 million or 4% of global annual turnover, whichever is higher, and the scale of this fine against a large-scale consumer-facing processing programme indicates the regulator remains willing to use the fine ceiling against unconsented commercial data processing.

The Elkjøp decision is significant both for its scale — one of the larger Norwegian GDPR-era fines on record — and for the nature of the underlying violation, which concerns consent validity in a loyalty/customer-club context affecting a multi-country Nordic membership base of over six million people. No appeal or further procedural development following the 4 June 2026 decision was identified within this period.

Outlook

The marker to watch is whether Elkjøp appeals the overtredelsesgebyr, and whether Datatilsynet's enforcement pattern in the adtech and commercial-data-processing space, of which this decision forms part, produces further comparable actions against other large consumer-data controllers operating in Norway.

Enforcement & Redress

Datatilsynet's enforcement activity across 2025 and 2026 spans five distinct actions, reflecting what the evidence characterises as an active rather than reactive enforcement posture. The most significant is the finalisation of the Grindr LLC matter: the Borgarting Court of Appeal dismissed Grindr's appeal on 12-14 August 2025, and with no further appeal lodged, the NOK 65 million administrative fine imposed on Grindr now stands as a concluded landmark GDPR enforcement action for Norway, closing out a case that had been a defining reference point in Norwegian GDPR enforcement.

Beyond the Grindr finalisation, Datatilsynet imposed a fine of approximately EUR 1,820,000 on Elkjøp AS in 2026 for unlawful marketing, profiling, personalisation and analysis processing, the largest fine identified this cycle, and fined Timegrip AS approximately EUR 23,000 in January 2026 over an access-right violation. In June 2026, Datatilsynet also found that six websites had unlawfully shared visitors' personal data with third parties, imposing a further administrative fine of approximately EUR 21,000 in one instance. Looking forward, Datatilsynet has scheduled an inspection of NAV for autumn 2026, focused on access management, logging and control to ensure information security — a planned rather than completed action, but one that signals continued regulatory attention to a major public-sector data controller.

Taken together, these five actions, spanning a finalised landmark appeal, two adtech-related fines of markedly different scale, an access-right fine, and a scheduled sectoral inspection, support the assessment that Datatilsynet is operating an active enforcement model consistent with its stated adtech and data-sharing priorities, rather than responding only to complaints as they arise.

Outlook

Watch for the outcome of the NAV inspection scheduled for autumn 2026, which would extend Datatilsynet's active enforcement pattern into the public sector specifically. The finalisation of the Grindr matter removes one major point of ongoing legal uncertainty from Norway's enforcement landscape, and its concluded status may free regulatory and industry attention to focus on the newer adtech-related enforcement track established by the Elkjøp and six-website findings.