Section 12 a. Disclosure of personal data between public authorities Public authorities may disclose personal data to each other when it is necessary in order to prevent, uncover, forestall or sanction work-related crime. The first sentence does not apply to personal data as mentioned in Article 9 of the General Data Protection Regulation. Section 16. Restrictions to the rights of the data subject The rights of access, information, rectification and restriction of processing pursuant to the provisions of the Personal Data Act and the Personal Data Regulations may be restricted if ... (b) it is necessary to keep secret for the purposes of prevention, investigation, detection and prosecution of criminal offences.

According to the Electronic Communication Act (based on the EU E-Privacy Directive) Section 2-9, third subsection, the police in Norway can request user information directly from telecom providers, without court order. This does not apply to non-telecom internet services, for example website hosting.

Section 196 of the Norwegian Penal Code establishes a general **duty to avert criminal acts**. It states that a penalty of a fine or imprisonment for up to one year shall be applied to any person who fails to report or otherwise seek to avert a criminal act or its consequences when this is still possible and it appears certain or most likely that the act has been or will be committed. The provision lists specified serious offences and clarifies that the duty to avert applies **regardless of any duty of confidentiality** for those offences.

Under Section 2-9 of the Act, telecommunications providers must safeguard the secrecy of the content of telecommunications. The duty of confidentiality, however, does not prevent such information from being given to the prosecuting authority or the police, or to another authority pursuant to the law.

The police and the prosecuting authority may disclose data if they are allowed to do so under the provisions on the duty of confidentiality in chapter 6, and the conditions governing disclosure laid down in section 8, second paragraph, and section 20 have been met for such data as are mentioned there. … Moreover, data may be disclosed or otherwise made available to foreign authorities or international organisations when this is prescribed by statute or convention or an agreement that is binding on Norway, or by an agreement between Norwegian and other Nordic authorities.

However, unless the statutory obligation of professional secrecy prevents disclosure, image recordings may be disclosed to the police in connection with the investigation of criminal acts or accidents. Personal data which are collected by means of image recordings made in places which are frequented by the public may only be disclosed to the controller if the subject of the recording consents thereto or if there is statutory provision for such disclosure.

The GDPR was incorporated into the EEA agreement and became applicable in Norway on 20 July 2018. Norway is thus bound by the GDPR in the same manner as EU Member States. Sector-specific data protection legislation, including: Act relating to the processing of data by the police and the prosecuting authority (the Police Databases Act). The Personal Data Act implements the General Data Protection Regulation (GDPR) into Norwegian law and also contains national rules with Norwegian adaptations.

The website explains that "everyone in Norway has a duty to avert criminal acts" and that this duty covers serious crimes such as murder, rape, domestic violence and sexual abuse of children. It notes: "If it is not safe for you to intervene, you still have a duty to notify the police" and emphasises: "Remember that the duty to avert a criminal act always takes precedence over a duty of confidentiality!" The duty is said to stem from Section 196 of the Penal Code and applies "to everyone, both those who work with people and have a duty of confidentiality, and private individuals"; it can be fulfilled by notifying the police or other authorities or otherwise seeking to prevent the act.

Pursuant to § 2–8 a retained data may be disclosed to “the police or prosecuting authority” in a criminal investigation. As indicated in § 2–8 a, the investigation must concern “serious crime”, and the relevant offences are further specified in § 2–8 b. … Providing access to IP-addresses etc., is deemed to interfere with the right to private communication. To be lawful, such interference must be “necessary” to the investigation of a serious crime, as per § 2–8 b. A concrete assessment of the necessity of the data for the purpose of the investigation must be made, and it is implied that the assessment also involves proportionality.

The research project on mandatory reporting of intimate partner violence states that service providers "may have a duty of mandatory reporting when receiving information with potential to prevent serious criminal acts." The threshold is that "it appears certain or most likely to the service provider that such an act will be committed." It explains that in Norway, "reporting to the authorities as a means of preventing a wide range of harm is regulated in section 196 of the penal code, applying to all citizens, including (but not restricted to) (health) professionals." Mandatory reporting under section 196 "is not restricted by any professional law of confidentiality, as it applies to all adult citizens," and the duty to report may be executed "by notifying the police or by averting the criminal act or its consequences ‘by other means’."

The guide on mandatory reporting of criminal offences in Norway states: "There is no general obligation to report criminal offences." It clarifies that entities subject to the Anti-Money Laundering Act have "a duty to investigate and report suspicious transactions with regards to money laundering and terror financing." It further notes: "Lastly, one also has an obligation to avert certain crimes in accordance with the Penal Code, which could involve reporting to the relevant authorities." The guide adds: "There are no general legal consequences for failure to report a criminal offence," distinguishing the specific duties (e.g. AML, pollution, workplace accidents, duty to avert serious crimes) from any general obligation.

Public authorities may disclose personal data that is subject to confidentiality when it is necessary to prevent, cover, forestall or sanction work-related crime. The Ministry may issue regulations with further rules concerning which public authorities may exchange personal data pursuant to this provision.

The Norwegian Financial Supervisory Authority explains that under the Anti-Money Laundering legislation, "banks and other obliged entities must check information about potential customers when establishing customer relationships" and follow them up on an ongoing basis. It states that "Suspicious transactions made by customers must be reported to Økokrim (the Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime)." It further notes that an entity that fails to meet its obligations under the Anti-Money Laundering Act "can be penalised with a fine," including for "failure to report suspicious transactions to Økokrim."

Civil authorities and private operators processing personal data are subject to the rules set out in the Personal Data Act of 2000. Most importantly, the Act prescribes that all processing of personal data must have a legal basis, i.e. have the consent of the data subject, be prescribed by law, or be necessary for certain specified purposes. The processing must furthermore be limited to a particular purpose, and the data must not be used for other incompatible purposes.

The GDPR does not apply to law enforcement activities which are instead subject to the Law Enforcement Directive. The Personal Data Act provides exemptions from the right of access and information, including where ‘the information must be kept secret for the purpose of the prevention, investigation, detection and prosecution of criminal offenses’. Pursuant to the Personal Data Act, the processing of special categories of personal data and data relating to criminal convictions and offences is permitted when the processing is necessary to perform obligations or exercise rights in the field of employment.

The Norway chapter of the Corporate Investigations Laws and Regulations report states: "With respect to investigation of potential economic or other crime, there are in general no formal procedures that require companies to self-report under Norwegian law, and consequently no required steps for making a disclosure." It adds that enforcement authorities, including ØKOKRIM, "encourage companies to disclose any suspicions of corporate crimes and to cooperate with the authorities on any subsequent investigation." It clarifies: "Entities covered by the Anti-Money Laundering legislation must conduct further examinations" when possible money laundering or terrorist financing is indicated, and if suspicions remain, "the obliged entity shall report" to ØKOKRIM.

The Personal Data Act provides exemptions from the right of access and information provided that: (i) the information is of importance to Norway's national security interests or the defence of the country; (ii) the information must be kept secret for the purpose of the prevention, investigation, detection and prosecution of criminal offenses; (iii) it is considered inadvisable for the data subject to gain knowledge of the information out of consideration for the health of the person concerned or for the relationship to persons close to the person concerned; (iv) the information is subject to a statutory obligation of professional secrecy; (v) the information is solely found in texts drawn up for internal preparatory purposes and which have not been disclosed to other persons; and (vi) disclosure of the information would conflict with obvious and fundamental private and public interests.

According to the PDA, the processing of information about criminal offences is subject to the regulations as GDPR article 9(2)(a), (c) and (f) as well as the PDA sections 6, 7 and 9, i.e. the same provisions as the processing of special categories of personal data. The PDA also contains provisions allowing exemptions from data subjects’ rights, for example where the information must be kept secret in order to prevent, investigate, disclose and prosecute criminal acts or where disclosure would conflict with obvious and fundamental private and public interests.

Processing of personal data is only lawful if there is a legal basis for the processing in accordance with GDPR article 6. Such legal basis may be consent from the data subject, that the processing is necessary for the performance of a contract, or for compliance with a legal obligation. The legal basis may also be that the processing is necessary for the purposes of legitimate interests pursued by the controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Processing of sensitive personal data, such as health data, must in addition have a legal basis for the processing in GDPR article 9 no. 2.

The HR Internal Investigations 2026 – Norway guide notes: "Under Norwegian law, an employer who receives a notice of concern or handles a case involving a notice of concern is not obliged to inform the public authorities." It further states: "There are no statutory procedures imposing a duty on the employer to report a notice of concern to the police, but where there is suspicion of criminal offences the employer should consider referring the matter to the police as soon as possible." It reiterates that "There is no general duty for employers to report criminal offences to the police, but the employer should consider doing so where a notice of concern relates to possible criminal conduct."

The Norwegian government white paper refers to various reporting obligations for entities handling financial transactions. It notes that "Banks and others who handle transactions are also subject to a reporting obligation under the Norwegian Money Laundering Act" and that such entities "will be able to prevent involvement in economic crime through good control procedures." It further explains that in certain administrative contexts, "the administrator must notify the prosecuting authority" as early as possible when criminal offences are presumed to exist.

Section 16 of the Personal Data Act restricts information, access, and breach notification rights where disclosure could compromise national security, crime prevention, secrecy obligations, health, or private interests. These restrictions allow controllers to limit what is disclosed to data subjects in cases where secrecy is necessary for the prevention, investigation, detection, and prosecution of criminal offences.

Section 12a introduces a provision allowing public authorities to disclose personal data to each other to combat work-related crime. This specific provision addresses collaboration among public authorities for a particular purpose. Public authorities may share personal data with other authorities when it is necessary to prevent, uncover, forestall or sanction work-related crime, subject to limitations for special categories of data as defined by the GDPR.

According to section 222d CPA, the district court may make an order permitting the police to carry out communication surveillance pursuant to section 216a when there is just cause to suspect that someone will perform an act contrary to certain provisions of the Penal Code. According to section 17d PA, the district court may issue an order permitting the Norwegian Police Security Service (the “PST”) to mandate the disclosure of communications metadata as set out in section 216b CPA and information from computer systems as set out in section 216o, as well as carrying out other investigatory control measures, if there is reason to suspect that an offence under certain sections of the Penal Code will be committed.

On July 6, 2018, the GDPR became applicable to the non-EU EEA countries of Iceland, Liechtenstein, and Norway through a Joint Committee Decision. Norway incorporated the GDPR through the ‘Act of 15 June 2018 no. 38 relating to the processing of personal data,’ commonly known as the Personal Data Act. The law became effective in Norway on July 20, 2018.

In Norway, the Personal Data Act implements and supplements the GDPR. Private operators processing personal data must ensure that any disclosure to law enforcement has a legal basis under the GDPR (such as legitimate interests or legal obligation) and complies with purpose limitation and necessity requirements. Disclosure for crime prevention or investigation generally requires either a specific legal provision or that the processing is necessary for purposes in the public interest.

Article 6 lists the instances in which it’s legal to process personal data. Don’t even think about touching somebody’s personal data — don’t collect it, don’t store it, don’t sell it to advertisers — unless you can justify it with one of the following: The data subject gave you specific, unambiguous consent to process the data… You need to process it to comply with a legal obligation of yours (e.g. you receive an order from the court in your jurisdiction)… You have a legitimate interest to process someone’s personal data. This is the most flexible lawful basis, though the ‘fundamental rights and freedoms of the data subject’ always override your interests, especially if it’s a child’s data.

The proposed scheme will allow the police and PST to collect IP data, not only during investigation of criminal acts, but also to prevent serious offences, that is, before anything illegal has happened. … Service providers (internet providers) will be obliged to hand over this information.

Norwegian GDPR enforcement is primarily focused on security failures, unlawful processing or disclosure of personal data and weak governance/internal controls, with a particularly strong emphasis on the public sector. Norwegian enforcement in 2024–2025 suggests a focus on insufficient technical and organisational security measures, processing or disclosure without a valid legal basis and weak privacy governance/internal controls.