--- title: "Norway Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/norway/ source_html: /jurisdictions/norway/index.html description: "Norway data protection and privacy regulation: 10 categories, 68 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: d762b3e521447fdf684ee93eb24b044c7d1496f90cd19a8ea8f8a4849d11761f generator: "fe-fleet/md-twin@1.0" --- # Norway Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 68 claims · 41 sources in the cumulative register Download report (PDF) Expand all Norway's Datatilsynet has shown an active and escalating enforcement posture over 2025-2026, anchored by the finalisation of the country's landmark GDPR fine: the Borgarting Court of Appeal dismissed Grindr's appeal after an August 2025 hearing, leaving the NOK 65 million administrative fine in place and unappealed further. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Cross-Border & Adequacy, Sectoral Watch, Children & Vulnerable Groups, Enforcement & Redress (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=NORWAY)[Build Report](/reports/?j=NORWAY)[Compare](/compare/?j=NORWAY) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Datatilsynet Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 68 Claims 16 Tier-1 sources Traffic-light mix 7 green 3 amber (sums to 10 rendered categories; click to filter) No categories are currently flagged red. Law made at European Economic Area (Bloc) level that applies in Norway is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Norway’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,144 Full executive summary 243 ###### Latest update · 25 October 2026 #### Lead Signal Datatilsynet imposed its largest fine to date, NOK 92 million, on the adtech intermediary Xandr on 12 October 2026, for unlawfully processing and sharing Grindr users' sensitive data, specifically data revealing sexual orientation, through real-time-bidding ad auctions without a valid legal basis. Datatilsynet Director General Line Coll is quoted directly on the scale of the penalty, stating that the breaches identified were very serious enough to justify a fine of this size. A three-week appeal window applies from the decision date. This is Datatilsynet's most significant enforcement action to date and signals an active and escalating enforcement posture specifically targeting real-time-bidding practices involving special-category data. #### Other Developments Datatilsynet's regulatory sandbox reached a conditional finding on an AI note-taking assistant tested with three municipalities, Kongsvinger, Stange, and Ringsaker, in child welfare services, concluding the tool is lawful under GDPR and the Child Welfare Act provided quick deletion, openness, and maintained trust are preserved in practice. Norway's domestic AI Act implementation, the KI-loven, remains pre-incorporation : the EU AI Act has not yet been brought into the EEA Agreement for Norway, and the government is understood to be sending a further domestic consultation out in autumn 2026, with a bill targeted for the Storting in spring 2027 and Nkom proposed as the coordinating market-surveillance authority. Datatilsynet's 14 October 2026 consultation response on NOU 2026:8 states that the proposal would make it considerably easier to share personal and confidential information than is currently possible, which Datatilsynet warns could seriously affect privacy; this is a live sectoral flashpoint around crime-prevention information-sharing reform rather than a settled instrument. #### Cross-Monitor Connections The Xandr enforcement action touches the crypto and financial-integrity monitors only tangentially, if at all, and no cross-domain finding was surfaced connecting the adtech fine to those monitors. The KI-loven's pre-incorporation status and its eventual market-surveillance authority, Nkom, are worth noting for the advennt monitor's continuing attention to any algorithmic or AI-driven product features in regulated gambling offerings, though no specific gambling-sector AI finding was identified to link the two directly. #### Outlook The near-term marker is the three-week appeal window on the Xandr decision, after which the fine either stands or is contested. On the AI-governance track, the autumn 2026 KI-loven consultation and the targeted spring 2027 Storting bill are the dates to watch, alongside whether Nkom's proposed coordinating role is confirmed. On NOU 2026:8, Datatilsynet's warning about expanded information-sharing powers marks this as a live and contested proposal worth monitoring through its further legislative progress. 3 earlier updates not shown here. ###### Standing brief · as of 14 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Norway's Datatilsynet has shown an active and escalating enforcement posture over 2025-2026, anchored by the finalisation of the country's landmark GDPR fine: the Borgarting Court of Appeal dismissed Grindr's appeal after an August 2025 hearing, leaving the NOK 65 million administrative fine in place and unappealed further. This finalisation, together with a March 2025 fine of approximately EUR 338,000 against Telenor ASA for inadequate organisation of its data protection officer function and lack of internal control, and a June 2026 sweep in which Datatilsynet found six websites had unlawfully shared visitors' personal data with third parties (resulting in a fine of approximately EUR 21,000 in at least one case), together indicate that GDPR enforcement risk in Norway is comparable to or exceeding that of larger EU member states this cycle. Datatilsynet can impose administrative fines of up to EUR 20 million or four percent of global annual turnover for GDPR violations, and this cycle's enforcement record shows the regulator is prepared to use decisions across a range of magnitudes, from six-figure sums against a major national telecom operator to smaller sums against a cluster of website operators for tracking-related breaches. Datatilsynet's 2026 enforcement record now spans several distinct fact patterns within a twelve-month window: a finalised landmark fine against a global dating platform for consent and data-sharing violations, an organisational-governance fine against a major domestic telecommunications provider, and a sweep-based enforcement action against a cluster of website operators for unlawful third-party data sharing. This breadth, rather than any single decision, is what supports reading Norway's enforcement posture as structurally active rather than reliant on one high-profile case. #### Other Developments Cross-border enforcement architecture is due to tighten further: the EU has adopted Regulation (EU) 2025/2518, laying down additional procedural rules for enforcement of the GDPR in cross-border cases, applicable from April 2027 once incorporated into the EEA framework applicable to Norway. This procedural-harmonisation measure is aimed at addressing known friction points in the EU's existing one-stop-shop mechanism for cross-border GDPR enforcement, under which a lead supervisory authority coordinates enforcement across member states for controllers or processors with cross-border processing activity; once incorporated, it would apply to Datatilsynet's own cross-border cooperation obligations. Algorithmic and AI governance is advancing toward a concrete domestic instrument: the Norwegian government published a consultation package for a national AI Act (KI-loven) in June 2025, targeting entry into force in summer 2026 aligned with the EU AI Act compliance timeline, with Datatilsynet expected to be the competent authority for AI systems that process personal data. If confirmed, this would represent a significant expansion of Datatilsynet's institutional remit beyond data protection into a broader algorithmic-governance role, mirroring similar competent-authority debates playing out in EU member states. Children's data protection is also under active reform consideration: the Ministry of Justice and Public Security proposed raising the age at which children may independently consent to processing of personal data for information-society services from 13 to 15 years, with the proposal under public consultation as of 24 September 2025. #### Cross-Monitor Connections Norway's pending national AI Act (KI-loven) is directly relevant to the artificial-intelligence monitor, given its stated alignment with the EU AI Act compliance timeline and Datatilsynet's expected role as competent authority for personal-data-processing AI systems; that monitor is better placed to track the substantive AI-governance content once available. The enforcement and cross-border developments described here have no evidenced connection to the world-payments, financial-integrity, or crypto monitors' coverage of Norway this cycle. #### Outlook The clearest items to watch next cycle are whether Norway's Personal Data Act amendment raising the children's consent age from 13 to 15 has been adopted since the September 2025 consultation closed, and whether the national AI Act (KI-loven) enters into force on its targeted summer-2026 timeline. Continued Datatilsynet enforcement activity, following the pattern established by the Grindr, Telenor and website-tracking-sweep decisions, is a reasonable baseline expectation given the regulator's demonstrated willingness to act across firm sizes and violation types. The Telenor fine's organisational-governance focus -- deficiencies in DPO role structuring and internal control, rather than a specific data breach -- is also worth tracking as a template for how Datatilsynet may approach other large regulated entities' internal compliance architecture in future cycles. Read full brief · 1144 words Standing brief, as of 14 September 2026. #### Regulatory Status Norway's data-protection regime this cycle is defined by an active enforcement record and a cluster of pending reforms rather than by any change to its foundational GDPR-via-EEA architecture. Datatilsynet finalised its landmark fine against Grindr (NOK 65 million) after the Borgarting Court of Appeal dismissed the platform's appeal in August 2025, while also fining Telenor ASA approximately EUR 338,000 for DPO and internal-control deficiencies in March 2025, and finding in June 2026 that six websites had unlawfully shared visitor data with third parties. Two reform items are advancing toward possible adoption: a proposal to raise the children's data-processing consent age from 13 to 15, under public consultation as of September 2025, and a national AI Act (KI-loven) targeting entry into force in summer 2026, with Datatilsynet expected as competent authority for AI systems processing personal data. At the EU level, Regulation (EU) 2025/2518 introduces additional cross-border GDPR enforcement procedural rules applicable from April 2027, which would apply to Norway once incorporated into the EEA framework. #### Outlook The most consequential near-term developments to track are whether the children's-consent-age proposal and the national AI Act are adopted on their respective timelines, and whether Datatilsynet's enforcement programme continues its diversified 2025-2026 pattern into the next cycle. Norway's overall regulatory direction is one of tightening: active enforcement, an expanding institutional remit for the regulator via prospective AI-governance competence, and a stricter default protection threshold for minors under consideration. Read full brief · 243 words Key regulatory facts for Norway Regulatory Dimension Norway Standing Position Jurisdiction Norway (NO) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 68 sourced findings) Regulator & Framework Fully GDPR-aligned regime with an active, well-resourced supervisory authority and settled national implementing legislation. Lawful Processing & Special Data Direct GDPR application confirmed by multiple Datatilsynet enforcement decisions applying Art 6(1) analysis verbatim. Data Subject Rights Multiple enforcement actions substantiate operative access, erasure and objection rights with real remedial consequences (fines, compliance orders). Controller/Processor Duties Strong evidence of live enforcement across DPIA, DPO, ROPA, security and retention obligations. Primary Instruments Cited Datatilsynet, Datatilsynet, Datatilsynet / EDPB, Datatilsynet, Publik.no / Datatilsynet Last Confirmed / Updated 2026-10-25 (41 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Norway: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully GDPR-aligned regime with an active, well-resourced supervisory authority and settled national implementing legislation. Primary framework GDPR (EEA-incorporated) implemented via the Norwegian Personal Data Act (Act of 15 June 2018 no. 38) Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green Fully GDPR-aligned regime with an active, well-resourced supervisory authority and settled national implementing legislation. #### Sub-modules (5) #### Regulator And AuthorityGreen Datatilsynet is Norway's data protection authority and enforces the GDPR/Personal Data Act. Claims (4): - Datatilsynet is Norway's national supervisory authority responsible for upholding data protection acts and regulations, with the Personal Data Act as its main governing legislation. - Datatilsynet imposed a NOK 92 million fine on Xandr for unlawfully processing and sharing Grindr users' sensitive data without a valid legal basis. - Datatilsynet — 2026 budget NOK 92 million; administratively subordinate to the Ministry of Digitalisation and Regional Development - Datatilsynet's annual budget for 2026 is approximately NOK 92 million, administratively subordinate to the Ministry of Digitalisation and Regional Development. #### Act And InstrumentsGreen GDPR incorporated into the EEA Agreement (Annex XI) and applicable in Norway since 20 July 2018; implemented domestically via the Personal Data Act. Claims (4): - Although not an EU member, Norway is a member of the EEA; the GDPR was incorporated into the EEA Agreement and became applicable in Norway on 20 July 2018, binding Norway in the same manner as EU Member States. - The GDPR is implemented as Norwegian law through the Act of 15 June 2018 no. 38 concerning the processing of personal data (the Personal Data Act). - Personal Data Act (Norway) — GDPR applies in Norway via EEA incorporation into the Norwegian Personal Data Act; Datatilsynet is the sole national supervisory authority - Norway — Applies the GDPR following its adoption by the EEA Joint Committee through Decision 154/2018 of 6 July 2018; the Personal Data Act implementing it was enacted 15 June 2018. #### Material ScopeGreen Material scope follows GDPR Art 2/4 definitions of personal data and processing; confirmed in Datatilsynet enforcement practice (e.g. cookie IDs held to be personal data). Claims (1): - Datatilsynet has held that a cookie ID assigned to a user fulfils the criteria of Article 4(1) GDPR and constitutes personal data, bringing tracking/analysis/sharing of such data within GDPR material scope. #### Territorial ScopeGreen Section 4 of the Personal Data Act extends application to non-EEA-established controllers offering goods/services to, or monitoring the behaviour of, data subjects in Norway, mirroring GDPR Art 3(2). Claims (1): - Pursuant to Section 4 of the Personal Data Act, the Act applies to processing of personal data of data subjects in Norway by controllers not established in the EEA where the processing relates to offering goods/services to, or monitoring the behaviour of, such data subjects. #### Regulator Registration And FilingAmber No general prior-notification/registration regime exists post-GDPR; obligations are accountability-based (ROPA, DPO designation) rather than filing-based. Norway is not an EU Member State but implements the GDPR in full via the EEA Agreement. Datatilsynet is the competent supervisory authority. The Personal Data Act (Act of 15 June 2018 no. 38) is the national implementing statute, and territorial scope mirrors GDPR Art 3(2) via Section 4 of that Act. No periodic updates recorded in this cycle Sources and claims (10) - [Datatilsynet](https://www.datatilsynet.no/en/about-us/) — Datatilsynet is Norway's national supervisory authority responsible for upholding data protection acts and regulations, with the Personal Data Act as its main governing legislation. - [Datatilsynet](https://www.datatilsynet.no/en/regulations-and-tools/regulations/) — Although not an EU member, Norway is a member of the EEA; the GDPR was incorporated into the EEA Agreement and became applicable in Norway on 20 July 2018, binding Norway in the same manner as EU Member States. - [Datatilsynet / EDPB](https://www.edpb.europa.eu/system/files_en?file=decisions%2Fno_dpia_list_en_gb_20190316.pdf) — The GDPR is implemented as Norwegian law through the Act of 15 June 2018 no. 38 concerning the processing of personal data (the Personal Data Act). - [Datatilsynet](https://www.datatilsynet.no/contentassets/8311c84c085b424d8d5c55dd4c9e2a4a/advance-notification-of-an-administrative-fine--disqus-inc.pdf) — Datatilsynet has held that a cookie ID assigned to a user fulfils the criteria of Article 4(1) GDPR and constitutes personal data, bringing tracking/analysis/sharing of such data within GDPR material scope. - [Datatilsynet](https://www.datatilsynet.no/contentassets/8311c84c085b424d8d5c55dd4c9e2a4a/advance-notification-of-an-administrative-fine--disqus-inc.pdf) — Pursuant to Section 4 of the Personal Data Act, the Act applies to processing of personal data of data subjects in Norway by controllers not established in the EEA where the processing relates to offering goods/services to, or monitoring the behaviour of, such data subjects. - [Publik.no / Datatilsynet](https://publik.no/en/sources/datatilsynet) — Datatilsynet imposed a NOK 92 million fine on Xandr for unlawfully processing and sharing Grindr users' sensitive data without a valid legal basis. - [Linklaters — Data Protected Norway](https://www.linklaters.com/en/insights/data-protected/data-protected---norway) — Datatilsynet — 2026 budget NOK 92 million; administratively subordinate to the Ministry of Digitalisation and Regional Development - [Linklaters — Data Protected Norway](https://www.linklaters.com/en/insights/data-protected/data-protected---norway) — Personal Data Act (Norway) — GDPR applies in Norway via EEA incorporation into the Norwegian Personal Data Act; Datatilsynet is the sole national supervisory authority - [CMS — GDPR Enforcement Tracker, Norway](https://cms.law/en/mkd/publication/gdpr-enforcement-tracker-report/norway) — Datatilsynet's annual budget for 2026 is approximately NOK 92 million, administratively subordinate to the Ministry of Digitalisation and Regional Development. - [DataGuidance — Norway](https://www.dataguidance.com/jurisdictions/norway) — Norway — Applies the GDPR following its adoption by the EEA Joint Committee through Decision 154/2018 of 6 July 2018; the Personal Data Act implementing it was enacted 15 June 2018. ### Norway: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Direct GDPR application confirmed by multiple Datatilsynet enforcement decisions applying Art 6(1) analysis verbatim. Primary framework GDPR Arts 6-9 as incorporated into the EEA Agreement / Personal Data Act Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green Direct GDPR application confirmed by multiple Datatilsynet enforcement decisions applying Art 6(1) analysis verbatim. D2 · Lawful Processing — Full Module Record 4 sub-modules · 34 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Multiple enforcement actions substantiate operative access, erasure and objection rights with real remedial consequences (fines, compliance orders). Primary framework GDPR Arts 12-22 (EEA-incorporated) Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green Multiple enforcement actions substantiate operative access, erasure and objection rights with real remedial consequences (fines, compliance orders). #### Sub-modules (5) #### Access RightGreen SATS decision addressed the right of access under Art 15/EDPB Guidelines 01/2022, including the controller's duty to demonstrate a documented response. Claims (2): - Datatilsynet's decision in SATS ASA relied on EDPB Guidelines 01/2022 on the right of access to assess whether the controller adequately facilitated data subjects' exercise of their access rights under Article 12(2) and 15 GDPR. - Datatilsynet fined Timegrip AS approximately EUR 23,000 in January 2026 after employees at a retail chain were denied access to their own working-time records, a GDPR Article 15 access-right violation. #### Rectification And ErasureGreen Datatilsynet found SATS in breach of the storage-limitation principle (Art 5(1)(e)) for retaining personal data beyond what was necessary, engaging the right to erasure. Claims (1): - Datatilsynet found that retaining personal data of a fitness-centre member for longer than necessary, or beyond the purpose of the retention, violates the storage limitation principle in Article 5(1)(e) GDPR and engages the right of erasure. #### Restriction And ObjectionGreen In the Meta case, Datatilsynet found additional violations of Article 21 GDPR (right to object), treating the right as unconditional regardless of the legal basis relied upon. Claims (1): - Datatilsynet found additional violations of Article 21 GDPR arising from changes to Meta's processing, and noted that the right to object under GDPR is unconditional and irrespective of the legal basis relied on by the controller. #### Data PortabilityAmber No Norway-specific portability enforcement action was identified in this research pass; GDPR Art 20 applies directly. #### Deadlines And Response WindowsGreen Standard GDPR one-month response deadline (extendable to three months for complex requests) applies as directly incorporated EEA law; SATS case turned partly on documentation of timely responses. Claims (2): - Norway is bound by the GDPR's statutory response deadlines for controller responses to data subject requests in the same manner as EU Member States. - Datatilsynet found Elkjøp failed to process customer privacy/data-subject requests within legally required deadlines GDPR Arts 12-22 apply directly in Norway. Enforcement decisions (SATS, Meta) demonstrate active supervision of access, erasure, and objection rights, with the right to object to profiling for marketing treated as unconditional. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (6) - [Datatilsynet](https://www.datatilsynet.no/contentassets/f974410ee2e142c99cfc208cbae7634e/administrative-fine---sats-asa.pdf) — Datatilsynet's decision in SATS ASA relied on EDPB Guidelines 01/2022 on the right of access to assess whether the controller adequately facilitated data subjects' exercise of their access rights under Article 12(2) and 15 GDPR. - [Datatilsynet](https://www.datatilsynet.no/contentassets/f974410ee2e142c99cfc208cbae7634e/administrative-fine---sats-asa.pdf) — Datatilsynet found that retaining personal data of a fitness-centre member for longer than necessary, or beyond the purpose of the retention, violates the storage limitation principle in Article 5(1)(e) GDPR and engages the right of erasure. - [Datatilsynet](https://www.datatilsynet.no/contentassets/36ad4a92100943439df9a8a3a7015c19/urgent-and-provisional-measures--meta_redacted.pdf) — Datatilsynet found additional violations of Article 21 GDPR arising from changes to Meta's processing, and noted that the right to object under GDPR is unconditional and irrespective of the legal basis relied on by the controller. - [Datatilsynet](https://www.datatilsynet.no/en/regulations-and-tools/regulations/) — Norway is bound by the GDPR's statutory response deadlines for controller responses to data subject requests in the same manner as EU Member States. - [CMS — GDPR Enforcement Tracker, Norway](https://cms.law/en/mkd/publication/gdpr-enforcement-tracker-report/norway) — Datatilsynet found Elkjøp failed to process customer privacy/data-subject requests within legally required deadlines - [Linklaters — Data Protected Norway](https://www.linklaters.com/en/insights/data-protected/data-protected---norway) — Datatilsynet fined Timegrip AS approximately EUR 23,000 in January 2026 after employees at a retail chain were denied access to their own working-time records, a GDPR Article 15 access-right violation. ### Norway: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Strong evidence of live enforcement across DPIA, DPO, ROPA, security and retention obligations. Primary framework GDPR Arts 5, 24-39 (EEA-incorporated) Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green Strong evidence of live enforcement across DPIA, DPO, ROPA, security and retention obligations. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Datatilsynet is conducting a three-phase supervisory programme titled "Totalforsvarsåret 2026," covering all 357 Norwegian municipalities and examining information-security governance, multi-factor authentication and access-management controls, and backup and recovery arrangements. Within 2026, the programme moved into a documentation-request phase in which the regulator asked 104 selected municipalities to provide documentation of their security-of-processing measures. This was sourced directly from Datatilsynet's own published announcement of the programme. The programme represents a sector-wide proactive supervisory exercise rather than a reactive enforcement action triggered by a specific incident: it tests municipal controllers' compliance with the security-of-processing obligations that apply generally under the Personal Data Act and GDPR, applied at scale across the entire municipal sector rather than targeted at a single controller. The documentation-request phase covering roughly 29 percent of all Norwegian municipalities suggests a substantial supervisory undertaking, with the remaining municipalities outside this initial documentation wave not yet confirmed as subject to equivalent scrutiny within this cycle. #### Outlook The marker to watch is whether Datatilsynet's documentation-request phase for the 104 selected municipalities progresses into a further supervisory or enforcement phase, and whether any findings from this phase are extended to the remaining municipalities outside the initial selection. D4 · Controller & Processor — Full Module Record 7 sub-modules · 37 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ EEA incorporation of GDPR Chapter V transfer mechanisms is well documented and directly confirmed by the EU-US DPF adequacy decision text. Primary framework GDPR Arts 44-49 as extended via the EEA Agreement Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green EEA incorporation of GDPR Chapter V transfer mechanisms is well documented and directly confirmed by the EU-US DPF adequacy decision text. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 50 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ General GDPR framework confirmed but most sectoral sub-modules could not be independently evidenced in this pass; flagged for escalation. Primary framework GDPR (EEA-incorporated); sector-specific overlays not independently confirmed in this pass Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Amber General GDPR framework confirmed but most sectoral sub-modules could not be independently evidenced in this pass; flagged for escalation. Periodic update · new data 2026-10-25 #### Sectoral Watch Datatilsynet submitted a consultation response on 14 October 2026 addressing NOU 2026:8, a proposed crime-prevention information-sharing reform. The regulator's response states plainly that the proposal would make it considerably easier to share personal and confidential information than is currently possible, and warns that this could seriously affect privacy. This is a direct, pointed regulatory objection to a specific legislative proposal still working through the consultation process, rather than a settled instrument or an enacted change to information-sharing rules. The significance of this development lies in Datatilsynet positioning itself early and explicitly against a proposal that touches the balance between crime-prevention information-sharing powers and individual privacy protections. As a proposal still at the consultation stage, NOU 2026:8 has not been enacted, and its eventual content may be shaped by Datatilsynet's intervention and by other consultation responses not captured in the evidence. #### Outlook The progress of NOU 2026:8 through further legislative stages, and whether the government responds to Datatilsynet's specific concerns about the breadth of information-sharing powers before any bill is finalised, is the key item to track in this sectoral area going forward. Periodic update · new data 2026-10-18 #### Sectoral Watch Datatilsynet submitted a consultation response on 14 October 2026 addressing NOU 2026:8, a proposed crime-prevention information-sharing reform. The regulator's response states plainly that the proposal would make it considerably easier to share personal and confidential information than is currently possible, and warns that this could seriously affect privacy. This is a direct, pointed regulatory objection to a specific legislative proposal still working through the consultation process, rather than a settled instrument or an enacted change to information-sharing rules. The significance of this development lies in Datatilsynet positioning itself early and explicitly against a proposal that touches the balance between crime-prevention information-sharing powers and individual privacy protections. As a proposal still at the consultation stage, NOU 2026:8 has not been enacted, and its eventual content may be shaped by Datatilsynet's intervention and by other consultation responses not captured in this cycle's evidence. #### Outlook The progress of NOU 2026:8 through further legislative stages, and whether the government responds to Datatilsynet's specific concerns about the breadth of information-sharing powers before any bill is finalised, is the key item to track in this sectoral area going forward. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 63 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D7 AdTech & Commercial Privacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Multiple concrete, recent enforcement actions (tracking pixels, Meta behavioural-advertising ban, consent-or-pay referral) demonstrate an active adtech oversight regime. Primary framework GDPR Arts 5-7, 21 and the Marketing Control Act (markedsføringsloven) Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green Multiple concrete, recent enforcement actions (tracking pixels, Meta behavioural-advertising ban, consent-or-pay referral) demonstrate an active adtech oversight regime. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy The record NOK 92 million fine against Xandr, imposed by Datatilsynet on 12 October 2026, is the defining adtech-sector development. The fine addresses the unlawful processing and sharing of Grindr users' sensitive data, specifically data revealing sexual orientation, through real-time-bidding ad auctions, conducted without a valid legal basis under the GDPR. Datatilsynet's own public framing of the decision, via Director General Line Coll's quoted statement that the breaches identified were very serious, positions the fine as the regulator's strongest enforcement signal to date against adtech practices involving sensitive personal data flowing through programmatic advertising infrastructure. For commercial-privacy purposes, the decision is notable for targeting an intermediary in the real-time-bidding chain, Xandr, rather than the data controller that originally collected the sensitive data from users, an enforcement pattern that signals Datatilsynet's willingness to pursue participants throughout the RTB data-sharing chain rather than only the first-party collector. A three-week appeal window applies, leaving the decision's final status open for the near term. #### Outlook Whether Datatilsynet extends this enforcement pattern to other participants in the real-time-bidding ecosystem operating in or serving the Norwegian market is the key item to monitor following this decision. The outcome of any appeal within the three-week window will also determine whether this fine stands as a durable precedent for sensitive-data processing in adtech contexts. Periodic update · new data 2026-10-18 #### AdTech & Commercial Privacy The record NOK 92 million fine against Xandr, imposed by Datatilsynet on 12 October 2026, is this cycle's defining adtech-sector development. The fine addresses the unlawful processing and sharing of Grindr users' sensitive data, specifically data revealing sexual orientation, through real-time-bidding ad auctions, conducted without a valid legal basis under the GDPR. Datatilsynet's own public framing of the decision, via Director General Line Coll's quoted statement that the breaches identified were very serious, positions the fine as the regulator's strongest enforcement signal to date against adtech practices involving sensitive personal data flowing through programmatic advertising infrastructure. For commercial-privacy purposes, the decision is notable for targeting an intermediary in the real-time-bidding chain, Xandr, rather than the data controller that originally collected the sensitive data from users, an enforcement pattern that signals Datatilsynet's willingness to pursue participants throughout the RTB data-sharing chain rather than only the first-party collector. A three-week appeal window applies, leaving the decision's final status open for the near term. #### Outlook Whether Datatilsynet extends this enforcement pattern to other participants in the real-time-bidding ecosystem operating in or serving the Norwegian market is the key item to monitor following this decision. The outcome of any appeal within the three-week window will also determine whether this fine stands as a durable precedent for sensitive-data processing in adtech contexts. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy Datatilsynet's adtech and commercial-privacy enforcement intensified materially in 2026, with two separate actions surfacing this cycle. In June 2026, Datatilsynet found that six websites had unlawfully shared visitors' personal data with third parties, in several cases involving sensitive information, and imposed an administrative fine of approximately EUR 21,000 in connection with one of those findings. Separately, and more substantially, Datatilsynet imposed a fine of approximately EUR 1,820,000 on Elkjøp AS in 2026 for processing customer data for marketing, profiling, personalisation and analysis without a valid legal basis, with the decision citing GDPR Article 12(3). The Elkjøp fine is the largest identified for Norway this cycle and is directly evidenced via the Enforcement Tracker record. Both actions are consistent with Datatilsynet's stated national enforcement priority around adtech and real-time-bidding-adjacent data sharing, and together they indicate the regulator is treating unlawful third-party data sharing and unlawful marketing-and-profiling processing as related but distinct enforcement categories: the six-website finding centres on unlawful third-party disclosure, while the Elkjøp fine centres on the absence of a valid legal basis for a range of internal processing purposes spanning marketing, profiling, personalisation and analysis. The scale difference between the two fines, EUR 21,000 against EUR 1.82 million, reflects the difference in scope and severity between an unlawful-disclosure finding and a broad legal-basis failure across multiple processing purposes for a large retail operation. #### Outlook Given Datatilsynet's stated priority focus on adtech and third-party data sharing, further enforcement actions in this category should be expected. Watch for whether other Norwegian retailers or commercial operators face comparable legal-basis scrutiny following the Elkjøp precedent, and for any follow-up guidance from Datatilsynet on lawful bases for marketing, profiling and personalisation processing. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 61 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Profiling/objection rights are well-evidenced; AI Act EEA-incorporation status and Norway-specific biometric/state-surveillance carve-outs are not yet confirmed, warranting an amber rating pending further research. Primary framework GDPR Arts 9, 21, 22 (EEA-incorporated); EU AI Act EEA-incorporation status unconfirmed Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Amber Profiling/objection rights are well-evidenced; AI Act EEA-incorporation status and Norway-specific biometric/state-surveillance carve-outs are not yet confirmed, warranting an amber rating pending further research. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Datatilsynet's regulatory sandbox produced a conditional finding on an AI note-taking assistant tested in child welfare services across three municipalities, Kongsvinger, Stange, and Ringsaker. The sandbox concluded the tool is lawful under both the GDPR and the Child Welfare Act, subject to conditions including quick deletion of processed data, openness about the tool's use, and the maintenance of trust between child-welfare services and the families they work with. This sandbox outcome is a guidance-level finding rather than a binding regulatory instrument, but it offers a concrete, sector-specific reference point for how Datatilsynet approaches AI tools processing sensitive data in a highly sensitive public-sector context. Separately, Norway's domestic AI Act implementation process, referred to as the KI-loven, remains at a pre-incorporation stage: the EU AI Act has not yet been brought into the EEA Agreement for Norway. The government is understood to be sending a further domestic consultation out in autumn 2026, with the stated aim of bringing a bill before the Storting in spring 2027. Nkom has been proposed as the coordinating market-surveillance authority for the eventual Norwegian AI Act regime, though this remains a proposal rather than a settled institutional arrangement. The combination of an active, outcome-oriented sandbox practice alongside a still-pending framework law illustrates a regulator exercising practical oversight ahead of its own formal legislative architecture being finalised. #### Outlook The autumn 2026 KI-loven consultation and the targeted spring 2027 Storting bill introduction are the two dates to track for Norway's AI-governance framework. Whether Nkom's proposed coordinating role is confirmed in that process, and whether further sandbox findings follow the child-welfare AI pattern, are the practical developments most likely to shape how AI governance operates in Norway ahead of formal legislative adoption. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Datatilsynet's regulatory sandbox produced a conditional finding this cycle on an AI note-taking assistant tested in child welfare services across three municipalities, Kongsvinger, Stange, and Ringsaker. The sandbox concluded the tool is lawful under both the GDPR and the Child Welfare Act, subject to conditions including quick deletion of processed data, openness about the tool's use, and the maintenance of trust between child-welfare services and the families they work with. This sandbox outcome is a guidance-level finding rather than a binding regulatory instrument, but it offers a concrete, sector-specific reference point for how Datatilsynet approaches AI tools processing sensitive data in a highly sensitive public-sector context. Separately, Norway's domestic AI Act implementation process, referred to as the KI-loven, remains at a pre-incorporation stage: the EU AI Act has not yet been brought into the EEA Agreement for Norway. The government is understood to be sending a further domestic consultation out in autumn 2026, with the stated aim of bringing a bill before the Storting in spring 2027. Nkom has been proposed as the coordinating market-surveillance authority for the eventual Norwegian AI Act regime, though this remains a proposal rather than a settled institutional arrangement. The combination of an active, outcome-oriented sandbox practice alongside a still-pending framework law illustrates a regulator exercising practical oversight ahead of its own formal legislative architecture being finalised. #### Outlook The autumn 2026 KI-loven consultation and the targeted spring 2027 Storting bill introduction are the two dates to track for Norway's AI-governance framework. Whether Nkom's proposed coordinating role is confirmed in that process, and whether further sandbox findings follow the child-welfare AI pattern, are the practical developments most likely to shape how AI governance operates in Norway ahead of formal legislative adoption. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 65 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Active enforcement and policy attention exist, but the precise statutory age-of-consent threshold and the enactment status of proposed age-limit legislation could not be confirmed from primary sources in this pass. Primary framework GDPR Art 8 (EEA-incorporated); proposed Norwegian social-media age-limit legislation (status unconfirmed) Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Amber Active enforcement and policy attention exist, but the precise statutory age-of-consent threshold and the enactment status of proposed age-limit legislation could not be confirmed from primary sources in this pass. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups Norway's Ministry of Justice and Public Security has proposed raising the age at which children may consent to the processing of their personal data for information-society services, from 13 to 15 years. As of 24 September 2025, the checkpoint reflected in the available evidence, the proposal remained under public consultation and had not been enacted. This is understood to be a formally-tabled proposal rather than an early-stage policy idea, though its current status beyond the September 2025 consultation checkpoint was not confirmed this cycle, and the finding is accordingly held at a qualified, Probable level of confidence. If enacted, the change would materially raise the threshold at which Norwegian children can independently consent to data processing by information-society service providers, bringing minors aged 13 and 14 within the scope of parental-consent requirements that currently apply only below age 13. This would be a consequential shift for any online service provider offering information-society services to Norwegian users, since it would expand the population of users requiring parental-consent mechanisms. #### Outlook The principal open question is the proposal's current status: whether it has advanced beyond public consultation, been amended, or been shelved, since the available evidence establishes only the position as of 24 September 2025. Watch for a Ministry announcement of the consultation's conclusion or for draft legislative text moving toward the Storting, either of which would represent the next material step in this proposal's progress. D9 · Children's Privacy — Full Module Record 5 sub-modules · 76 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Norway: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Sustained, escalating enforcement activity through 2026, including a major NOK 20 million fine, evidences a well-resourced and active regulator. Primary framework GDPR Arts 58, 77-84, 83-84 (EEA-incorporated) Supervisory authority [Datatilsynet](https://www.datatilsynet.no/en/) Traffic-light rationale — Green Sustained, escalating enforcement activity through 2026, including a major NOK 20 million fine, evidences a well-resourced and active regulator. Periodic update · new data 2026-10-25 #### Enforcement & Redress Datatilsynet imposed a NOK 92 million administrative fine on the adtech intermediary Xandr on 12 October 2026, its largest penalty to date, for unlawfully processing and sharing Grindr users' sensitive data, data revealing sexual orientation, through real-time-bidding ad auctions without a valid legal basis under the GDPR. Director General Line Coll is quoted directly as saying the regulator issued such a high fine because the breaches identified were very serious, a statement that frames this as a deliberate escalation in penalty severity rather than a routine application of the existing fining scale. A three-week appeal window applies from the date of the decision, meaning the fine's final status remains open pending any challenge Xandr may bring. The decision's significance lies in both its scale and its subject matter: sensitive-category data processed through the real-time-bidding advertising ecosystem has been a recurring area of regulatory concern across European data-protection authorities, and this fine represents Datatilsynet's most forceful enforcement statement on the topic to date in the Norwegian context. The full text of Datatilsynet's decision has not itself been retrieved; the finding rests on press coverage reporting the Director General's own quoted statement, which should be read as a limitation on granular legal reasoning rather than on the underlying fact of the fine. #### Outlook The three-week appeal window is the immediate item to track; if Xandr appeals, the eventual outcome will test the durability of Datatilsynet's reasoning on legal basis for sensitive-data processing in real-time-bidding contexts. Beyond the appeal, this decision is likely to be referenced in any future Datatilsynet guidance or enforcement action touching adtech or real-time-bidding practices involving special-category data. Periodic update · new data 2026-10-18 #### Enforcement & Redress Datatilsynet imposed a NOK 92 million administrative fine on the adtech intermediary Xandr on 12 October 2026, its largest penalty to date, for unlawfully processing and sharing Grindr users' sensitive data, data revealing sexual orientation, through real-time-bidding ad auctions without a valid legal basis under the GDPR. Director General Line Coll is quoted directly as saying the regulator issued such a high fine because the breaches identified were very serious, a statement that frames this as a deliberate escalation in penalty severity rather than a routine application of the existing fining scale. A three-week appeal window applies from the date of the decision, meaning the fine's final status remains open pending any challenge Xandr may bring. The decision's significance lies in both its scale and its subject matter: sensitive-category data processed through the real-time-bidding advertising ecosystem has been a recurring area of regulatory concern across European data-protection authorities, and this fine represents Datatilsynet's most forceful enforcement statement on the topic to date in the Norwegian context. The full text of Datatilsynet's decision has not itself been retrieved this cycle; the finding rests on press coverage reporting the Director General's own quoted statement, which should be read as a limitation on granular legal reasoning rather than on the underlying fact of the fine. #### Outlook The three-week appeal window is the immediate item to track; if Xandr appeals, the eventual outcome will test the durability of Datatilsynet's reasoning on legal basis for sensitive-data processing in real-time-bidding contexts. Beyond the appeal, this decision is likely to be referenced in any future Datatilsynet guidance or enforcement action touching adtech or real-time-bidding practices involving special-category data. Periodic update · new data 2026-10-11 #### Enforcement & Redress Datatilsynet imposed an overtredelsesgebyr of NOK 20,000,000 on Elkjøp AS on 4 June 2026, for processing personal data in its Nordic customer-club programme — which affects more than six million members — without valid consent, under personopplysningsloven Section 26, read in conjunction with GDPR Article 83. This decision was retrieved directly from Datatilsynet's own published determination. The penalty provision allows Datatilsynet to impose an overtredelsesgebyr up to the GDPR Article 83 cap of EUR 20 million or 4% of global annual turnover, whichever is higher, and the scale of this fine against a large-scale consumer-facing processing programme indicates the regulator remains willing to use the fine ceiling against unconsented commercial data processing. The Elkjøp decision is significant both for its scale — one of the larger Norwegian GDPR-era fines on record — and for the nature of the underlying violation, which concerns consent validity in a loyalty/customer-club context affecting a multi-country Nordic membership base of over six million people. No appeal or further procedural development following the 4 June 2026 decision was identified within this period. #### Outlook The marker to watch is whether Elkjøp appeals the overtredelsesgebyr, and whether Datatilsynet's enforcement pattern in the adtech and commercial-data-processing space, of which this decision forms part, produces further comparable actions against other large consumer-data controllers operating in Norway. Periodic update · new data 2026-09-28 #### Enforcement & Redress Datatilsynet's enforcement activity across 2025 and 2026 spans five distinct actions, reflecting what the evidence characterises as an active rather than reactive enforcement posture. The most significant is the finalisation of the Grindr LLC matter: the Borgarting Court of Appeal dismissed Grindr's appeal on 12-14 August 2025, and with no further appeal lodged, the NOK 65 million administrative fine imposed on Grindr now stands as a concluded landmark GDPR enforcement action for Norway, closing out a case that had been a defining reference point in Norwegian GDPR enforcement. Beyond the Grindr finalisation, Datatilsynet imposed a fine of approximately EUR 1,820,000 on Elkjøp AS in 2026 for unlawful marketing, profiling, personalisation and analysis processing, the largest fine identified this cycle, and fined Timegrip AS approximately EUR 23,000 in January 2026 over an access-right violation. In June 2026, Datatilsynet also found that six websites had unlawfully shared visitors' personal data with third parties, imposing a further administrative fine of approximately EUR 21,000 in one instance. Looking forward, Datatilsynet has scheduled an inspection of NAV for autumn 2026, focused on access management, logging and control to ensure information security — a planned rather than completed action, but one that signals continued regulatory attention to a major public-sector data controller. Taken together, these five actions, spanning a finalised landmark appeal, two adtech-related fines of markedly different scale, an access-right fine, and a scheduled sectoral inspection, support the assessment that Datatilsynet is operating an active enforcement model consistent with its stated adtech and data-sharing priorities, rather than responding only to complaints as they arise. #### Outlook Watch for the outcome of the NAV inspection scheduled for autumn 2026, which would extend Datatilsynet's active enforcement pattern into the public sector specifically. The finalisation of the Grindr matter removes one major point of ongoing legal uncertainty from Norway's enforcement landscape, and its concluded status may free regulatory and industry attention to focus on the newer adtech-related enforcement track established by the Elkjøp and six-website findings. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 46 words · 16 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (20 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16-17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 19-20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties