GDPR and websites: what Norwegian businesses need to know

GDPR and Norway's Personal Data Act require every company website to state clearly what data it collects and why. This applies above all to contact forms and analytics tools. Norway applies GDPR as an EEA member, and the supervisory authority is Datatilsynet.

The basics are a privacy policy (who the controller is, what data, why, for how long, who it is shared with and what rights users have), consent for non-essential cookies and limiting data to the minimum needed to handle the enquiry. In Norway cookies are additionally regulated by the Electronic Communications Act (ekomloven).

In practice the problem is often technical disorder: forms with no processing information, no retention period, analytics scripts loading before consent and outdated legal text. Add processing agreements with vendors (hosting, email, CRM, analytics, chatbot) and an assessment of transfers outside the EEA.

If you use an AI chatbot, remember the additional transparency duty under the EU AI Act (Art. 50, from 2 August 2026): users must know they are talking to AI. Do not collect sensitive data through the bot and do not keep chats longer than necessary.

Compliance need not be complicated if you plan the site structure and lead process from the start. You will find the scope of our support at nettivo.no/tjenester. This article is general information, not legal advice. To get your GDPR compliance in order, contact Nettivo at nettivo.no/kontakt and we will prepare a practical checklist for your site.