Personal Data Act (personopplysningsloven) — GDPR breach notification as incorporated into Norwegian law

Norway applies GDPR Arts. 33-34 as national law through the Personal Data Act, so the substantive test and the 72-hour deadline are identical to the EU's. What differs is who you notify: the Norwegian supervisory authority is Datatilsynet, and a business whose main establishment is in Norway deals with Datatilsynet rather than an EU authority. Marked 'check' because this entry rests on the incorporation mechanism rather than on a Norwegian-language reading of the Act's own breach provisions — confirm the national procedural detail (reporting channel, any sector-specific overlays) with Datatilsynet directly.