What UK tech suppliers need to know about Norway’s GDPR rules

Norway is outside the EU, but the GDPR applies in full through the EEA Agreement and has been implemented in Norwegian law through the Personal Data Act since July 2018. Datatilsynet enforces the rules, and UK suppliers are expected to provide an EEA-grade compliance package, including a data processing agreement, technical and organisational measures, a current subprocessor list, assistance obligations and audit rights.

Personal data can currently move between the UK and Norway without extra safeguards after the European Commission renewed the UK adequacy decisions on 19 December 2025, with effect until 27 December 2031. Suppliers still need contingency planning because the arrangement includes a sunset clause and monitoring, while onward transfers to US and other third-country subprocessors require valid mechanisms, standard contractual clauses where needed, and documented transfer impact assessments.

UK rules are also diverging after the Data (Use and Access) Act 2025, including broader permissions for automated decision-making from 5 February 2026. Features that are lawful under the UK regime may still need a separate EEA assessment under Article 22 for Norwegian data subjects. The EU AI Act is not yet binding in Norway as at July 2026, but it is expected during 2026 and already reaches UK vendors that place AI systems on the EU market or whose outputs are used in the EU.

Norwegian enterprise customers commonly ask for hosting transparency, tighter breach commitments, deletion verification, and a clear answer on whether customer data, prompts or outputs are used to train models. Weak or incomplete documentation can slow procurement before commercial terms become the main issue.