Personal Data Act (personopplysningsloven), incorporating the GDPR into Norwegian law

Norway is not an EU member but is in the EEA, and the GDPR applies there in full as Norwegian law through the Personal Data Act, which incorporates Regulation (EU) 2016/679 by reference and adds national provisions on areas the GDPR leaves to member states (employment processing, age of consent — 13 in Norway, freedom of expression). The territorial test is GDPR Article 3, unchanged: established presence in Norway, or offering goods/services to or monitoring the behavior of people in Norway. Enforced by Datatilsynet, not by an EU authority — so a business with EU-only compliance still owes a separate Norwegian supervisory relationship if Norway is its main establishment.