Personal Data Act

The Personal Data Act aligns with the GDPR and regulates the processing of personal data in Norway, ensuring the protection of privacy.

JurisdictionNorway
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Norwegian Personal Data Act (PDA) aligns closely with the GDPR and establishes the following key requirements:

  • Lawful basis for processing: Organizations must have a valid legal ground for processing personal data, such as consent, contract fulfillment, or legitimate interests. Datatilsynet - Legal Basis for Processing

Compliance Challenges

Organizations face several challenges in complying with the PDA:

Implementation Best Practices

To implement PDA requirements effectively:

Recent Updates

Related Regulations

Industry Impact

Sources

Recent developments

  • — Government of Canada introduces Bill C-36, the Protecting Privacy and Consumer Data Act, to overhaul private‑sector data protection by recognizing privacy as a fundamental right, tightening rules around children’s personal information, automated decision‑making, and data mobility, and strengthening deletion rights and purpose limitations[7]. (source)
  • — Bill C-36 proposes significant new penalties for misuse of personal data, including administrative monetary penalties up to $10 million or 3% of global revenue and fines up to $25 million or 5% of global revenue for serious offences, signalling a tougher enforcement stance on personal data protection[7]. (source)
  • — U.S. states continue to expand personal‑data regulation in 2026: Indiana’s new privacy law applies to entities handling large volumes of consumer data or deriving substantial revenue from data sales, with impact assessment requirements, opt‑in for sensitive data, and opt‑out rights for targeted advertising and data sales[6]. (source)
  • — Connecticut’s mid‑2026 amendments sharply lower the applicability threshold from 100,000 to 35,000 consumers and ban the sale of precise geolocation data (within 1,750 feet), while requiring controllers to honor universal opt‑out mechanisms, substantially tightening controls on personal‑data use[6]. (source)
  • — Utah’s privacy framework adds a new right for consumers, effective July 1, 2026, to correct inaccuracies in their personal data, with corrections assessed in light of the nature of the data and its processing purposes, reflecting growing emphasis on data quality and individual control[6]. (source)
  • — The Electronic Frontier Foundation criticizes the proposed U.S. SECURE Data Act, arguing that while it offers standard consumer rights like access, correction, deletion, portability, consent for sensitive data, and opt‑outs for targeted ads and data sales, it is a weak privacy measure with major loopholes and poor defaults[1]. (source)
  • — EFF warns that the SECURE Data Act’s broad federal preemption would wipe out dozens of stronger state privacy laws and lacks a private right of action, giving companies 45 days to cure violations without penalty, leading civil society to view it as a step backward in personal‑data protection[1]. (source)
  • — India’s Supreme Court agrees to hear a constitutional challenge to the Digital Personal Data Protection Act, treating the matter as a priority amid rising concern about data security and government access to personal information[5]. (source)
  • — The EU Data Act, formally adopted by the European Council in late 2023, is moving toward application, aiming to give individuals and businesses stronger control and portability over data generated by connected products, with phased entry into force and future applicability to new smart devices[2]. (source)
  • — Ongoing guidance around the EU’s General Data Protection Regulation underscores that it remains one of the strictest global personal‑data regimes, applying extraterritorially to any organization processing EU residents’ data and enforcing extensive rights such as access, erasure, restriction, portability, and strong consent requirements with heavy fines for non‑compliance[3]. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates