# GDPR and personal data in Norway: access, correction and deletion of data

GDPR gives you strong rights over your personal data if you live in Norway. Learn how to get access, correct errors, and request deletion from private and public organizations.

Canonical: https://samfunnprep.no/en/articles/datatilsynet-gdpr-innsyn-sletting
Language: en
Publisher: SamfunnPrep
Author: Hlib Suslov
Published: 2026-07-06T09:45:07.499+00:00
Modified: 2026-10-14T06:07:57.105528+00:00
AI use policy: https://samfunnprep.no/ai-policy.txt

## Key takeaways

- GDPR protects all in the EEA GDPR applies regardless of citizenship — refugees, EEA citizens, and third-country nationals have the same privacy rights in Norway as Norwegian citizens.
- 30-day response deadline for access Organizations must respond to access and deletion requests within one month, and all processing is free; the deadline can be extended by two months for complex cases.
- Complaint to Datatilsynet is free Datatilsynet.no accepts complaints free of charge and can impose fines up to 20 million euro or 4% of annual revenue for serious privacy violations.

**Datatilsynet** is Norway's personal data protection authority, and GDPR (the Personal Data Act) gives you concrete rights: access to all personal information stored about you, correction of errors, and deletion of data that is no longer necessary. This guide shows you how to exercise these rights in 2026 — against both public and private actors.

## Legal basis: GDPR and the Personal Data Act

Norway is bound by the **EU's General Data Protection Regulation (GDPR)** through the **EEA Agreement** and has implemented it nationally through the **Personal Data Act (2018)**. The law came into force on **20 July 2018** — at the same time as GDPR became enforceable in the EU.

### Key provisions in GDPR

- **Art. 15** — right of access
- **Art. 16** — right to rectification
- **Art. 17** — right to erasure ("right to be forgotten")
- **Art. 18** — right to restrict processing
- **Art. 20** — right to data portability
- **Art. 21** — right to object
- **Art. 77** — right to lodge a complaint with the authority

### Datatilsynet's role

**Datatilsynet** (datatilsynet.no) is the Norwegian supervisory authority under **art. 51 GDPR**:

- Supervises that organizations comply with the law
- Handles complaints from individuals
- Can impose corrections, deletions, and fines (up to 4% of global revenue)
- Advises organizations and the public

## Right of access (GDPR art. 15)

### What the right of access covers

You have the right to know:

1. **Whether personal data about you is being processed** (yes/no)
2. **The purpose of the processing**
3. **The categories of personal data**
4. **Recipients or categories of recipients**
5. **The storage period** or criteria for determining it
6. **Your rights** (correction, deletion, objection, complaint)
7. **Source of the information** if not collected directly from you
8. **Automated decision-making**, including profiling
9. **Transfers to third countries** (outside EU/EEA)
10. **A copy of the personal data** being processed

### How to request access

1. **Written request** to the organization — email, letter, contact form
2. **Confirm your identity** — BankID or copy of ID
3. **Wait for response within 30 days** (can be extended to 90 days for complexity)
4. **Free first copy** — subsequent copies may incur a reasonable fee

### Template for access request

> "Under GDPR art. 15, I request access to all personal data you process about me. Please include: purpose, categories, recipients, storage period and source. Send me a copy of the information within 30 days."

## Right to rectification (GDPR art. 16)

If you discover **inaccurate or incomplete personal data**, you have the right to have it corrected.

### Examples

- Incorrect name or date of birth
- Wrong address or phone number
- Incorrect income or credit information
- Outdated information about health or family relationships

### Process

1. **Contact the organization** with documentation of the correct information
2. **Request for correction** shall be complied with without undue delay
3. **The organization must also notify** third parties who have received the incorrect data

## Right to erasure (GDPR art. 17)

### "Right to be forgotten"

You can request erasure when:

1. **The purpose is fulfilled** — the information is no longer necessary
2. **You withdraw consent**
3. **You have objected to processing** based on legitimate interest
4. **The processing is unlawful**
5. **Erasure is required by law**
6. **Child under 16** — protection of minors' data

### Exceptions to the right to erasure

- **Freedom of expression and information**
- **Legal obligation** — accounting, tax (7 years after [Accounting Act](https://samfunnprep.no/en/articles/frilanser-eller-enk))
- **Legal claim** — ongoing legal proceedings
- **Archiving, research or statistics**

## Datatilsynet's sectors and supervisory areas

### Public sector

Datatilsynet supervises:

- **NAV** — [unemployment benefits, [occupational rehabilitation benefit](https://samfunnprep.no/en/articles/aap-2026), [disability pension](https://samfunnprep.no/en/articles/uforetrygd-2026)]
- **Norwegian Tax Administration** — [source tax PAYE](https://samfunnprep.no/en/articles/kildeskatt-paye-utlendinger)
- **Immigration Directorate (UDI)** — immigration matters
- **Police** — [criminal reports](https://samfunnprep.no/en/articles/anmelde-til-politiet-norge)
- **Municipal services** — kindergarten, school, [municipal housing](https://samfunnprep.no/en/articles/kommunal-bolig-sosialt-boligtilbud)
- **Health enterprises** — patient records

### Private sector

- **Banks and insurance companies**
- **Credit bureaus** — Experian, Creditsafe, Bisnode (see [payment defaults](https://samfunnprep.no/en/articles/betalingsanmerkning-konsekvenser))
- **Telecom operators** — Telenor, Telia, Ice (see [NRK licence and subscription](https://samfunnprep.no/en/articles/nrk-lisens-og-bytte-abonnement))
- **E-commerce and social media**
- **Employers**
- **Landlords and real estate agents**

## How to complain to Datatilsynet

### Step 1: Contact the organization first

Datatilsynet normally requires that you **first try to resolve the matter directly** with the organization.

### Step 2: File a written complaint

Visit **datatilsynet.no** and fill out the complaint form, or send a letter to:

> Datatilsynet
> P.O. Box 458 Sentrum
> 0105 Oslo

Include:

- Your name and contact information
- Name of the organization
- Description of the case
- Documentation (email, letter, rejection)
- What you want Datatilsynet to do

### Step 3: Processing time

- **Simple cases:** 1–3 months
- **Complex cases:** 6–12 months
- **Decision** sent via [Digipost/eBoks](https://samfunnprep.no/en/articles/digital-postkasse-digipost-ebok)

### Step 4: Sanctions

Datatilsynet can impose:

- **Warning** — mild sanction
- **Order to correct or delete**
- **Administrative fine** — up to 20 million euro or 4% of global revenue
- **Prohibition of processing**

## Special rights

### Right to data portability (art. 20)

You can demand that your data be **provided in structured, machine-readable format** and transferred to another provider. Applies when processing is based on consent or contract.

### Right to object (art. 21)

You can object to:

- **Direct marketing** — absolute right
- **Legitimate interest processing** — evaluated on a case-by-case basis
- **Automated decision-making** that has legal or significantly affecting consequences

### Right to information (art. 13–14)

When data is collected, the organization must inform you about:

- Identity and contact information
- Purpose and legal basis
- Categories and recipients
- Storage period
- Your rights
- Complaint options

## Special considerations for immigrants

### Immigration Directorate (UDI) and residence matters

UDI processes large amounts of personal data. You can request:

- **Access to your case** — including notes, correspondence, rejections
- **Correction of errors** — particularly important for [family immigration](https://samfunnprep.no/en/articles/familieinnvandring-underholdskrav)
- **Access before appeal** — use the access right strategically

### Police registers

The police maintain several registers:

- **Criminal register** — access at politiet.no
- **DNA register**
- **Entry and exit register**

See [report to police](https://samfunnprep.no/en/articles/anmelde-til-politiet-norge).

### Norwegian Tax Administration and [PAYE](https://samfunnprep.no/en/articles/kildeskatt-paye-utlendinger)

The Tax Administration stores extensive data. Access can reveal errors in your tax card.

### Language barriers

You have the right to **information in a language you understand**. Organizations are not required to translate responses, but must provide interpretation where reasonable.

## Frequently asked questions

### Can I get access to my own notes from my doctor?

Yes — patient record via helsenorge.no. See the Patients' and Users' Rights Act.

### Do I get access to everything Facebook/Google has stored about me?

Yes — GDPR applies to all organizations processing data about EU/EEA citizens. Use "Download my data" or send a written access request.

### What if the organization refuses?

Complain to Datatilsynet. For unjustified refusal, they can impose a fine.

### Can my employer monitor me?

Only with a legal basis and after a proportionality assessment. Monitoring must be **announced in writing** before it occurs.

### How long can data be stored?

**No longer than necessary** for the purpose. Different sectors have their own rules:

- Accounting/tax: 5–7 years
- Employment relationship: current period plus reasonable time
- Credit information: see [payment defaults](https://samfunnprep.no/en/articles/betalingsanmerkning-konsekvenser) (4-year rule)

### Can I get compensation for a breach?

Yes — art. 82 GDPR provides a right to compensation for **both material and non-material damage** (e.g., distress). Compensation amounts: 5,000 – 100,000 NOK in Norwegian cases.

## Summary

GDPR and the Personal Data Act (2018) give you extensive rights against both public and private actors in Norway: **access (art. 15)**, **rectification (art. 16)**, **erasure (art. 17)**, **portability (art. 20)** and **objection (art. 21)**. Send a written request to the organization, which must respond within 30 days. If they don't comply: complain to Datatilsynet at datatilsynet.no or P.O. Box 458 Sentrum, 0105 Oslo. Datatilsynet can impose administrative fines up to 20 million euro or 4% of annual revenue. Particularly relevant for immigrants: access to UDI cases, police registers and [PAYE tax](https://samfunnprep.no/en/articles/kildeskatt-paye-utlendinger). Compensation for breach under art. 82 GDPR — 5,000–100,000 NOK in Norwegian case law. See also [payment defaults](https://samfunnprep.no/en/articles/betalingsanmerkning-konsekvenser) and [Digipost/eBoks](https://samfunnprep.no/en/articles/digital-postkasse-digipost-ebok).

## FAQ

### Does GDPR apply to immigrants?

Yes, GDPR protects all in EU/EEA regardless of citizenship.

### Deadline for response to access request?

1 month, can be extended by 2 months for complexity.

### Can I delete Facebook/Google data?

Yes, send deletion request; the right is not absolute.

### Does complaint to Datatilsynet cost money?

No, free via datatilsynet.no.

### What is a data protection officer?

Person/position responsible for ensuring compliance with privacy rules.

## Sources

- [Personopplysningsloven — Lovdata](https://lovdata.no/dokument/NL/lov/2018-06-15-38)
- [Datatilsynet — dine rettigheter](https://www.datatilsynet.no/rettigheter-og-plikter/den-registrertes-rettigheter)
- [GDPR — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

Citation: Hlib Suslov, "GDPR and personal data in Norway: access, correction and deletion of data", SamfunnPrep, 2026-07-06T09:45:07.499+00:00, https://samfunnprep.no/en/articles/datatilsynet-gdpr-innsyn-sletting