Personal Data Act (personopplysningsloven) — GDPR third-country transfer rules as incorporated into Norwegian law

Norway is inside the EEA, so transfers between Norway and the EU are not restricted transfers at all — the restriction applies to moving data out of the EEA, on the same Chapter V terms as for an EU controller: adequacy, then appropriate safeguards plus a transfer impact assessment, then the narrow Art. 49 derogations. Datatilsynet is the authority that supervises this. Marked 'check' because the entry rests on the EEA incorporation mechanism rather than on a Norwegian-language reading of the Act's own provisions on transfers.