Data Protection & Privacy

Advancing technologies and changes in government regulation mean that it is important to keep up-to-date. Digital transformation leads to growth in data that is registered, processed and shared. Today's almost limitless possibilities enable companies to collect, store and use sensitive information about individuals. Most major businesses handle personal data in a manner that implies requirements for internal policies, agreements, guidelines and web sites. Digitization also means that Norwegian companies are increasingly exchanging data with foreign companies, either as supplier or customer, in a corporate relationship, or in connection with transactions. This raises issues related to the rules on processing and transfer of personal data.

Our expert team is accomplished at advising businesses on the very latest legal developments. We advise clients on data protection compliance and preparing for the EU's General Data Protection Regulation (GDPR). We develop robust control and security routines, consent mechanisms, privacy policies and employment agreements. We consider license and notification duties as well as requirements for data protection officer. Furthermore, we provide advice on all forms of dialogue and disputes with the authorities. We have extensive experience with cross-border transfer of personal data, both within corporations or in connection with outsourcing and cloud services. We assist with data processing agreements based on EU model contracts, Privacy Shield arrangements and  binding corporate rules (BCR).

Our services include:

  • Compliance and risk assessments
  • Data processing agreements
  • Privacy policies and cookies
  • Data protection officer
  • Licenses and notifications to the authorities
  • Consent mechanisms
  • Guidelines for employees concerning use of smartphones/email/social media
  • Access to email, chain of custody and eDiscovery
  • Privacy clauses in employment agreements
  • Cloud computing, outsourcing and use of sub-processors
  • Privacy clauses in IT contracts
  • Export of personal data (EU's Model Clauses, Privacy Shield, Binding Corporate Rules (BCR))


GDPR will be incorporated into Norwegian law in 2018. Norwegian authorities are in the process of a major effort to ensure the transition from the current Personal Data Act to the new regime based on GDPR. A proposal for a new Personal Data Act has been sent for consultation. The Norwegian Data Protection Authority has issued local guidelines describing GDPR requirements. The EU's Article 29 Data Protection Working Party has adopted guidelines that will be important in interpreting the new rules (e.g. for data portability, Data Protection Officers (DPO) and Data Protection Impact Assessment (DPIA)). These documents can be read here:

Ny lov om behandling av personopplysninger på høring (

Nye personvernregler (

Article 29 Working Party (


Primary contacts

Kaare M. Risung
Jeppe Songe-Møller


Eva Jarbekk
Halvor Manshaus
Jeppe Songe-Møller
Kaare M. Risung
Anne-Marit Wang Sandvik
Inge Kristian Brodersen
Øivind K. Foss