Frequently Asked Questions

GDPR eller General Data Protection Regulation oppretter et harmonisert sett med regler som gjelder for all behandling av personopplysninger av virksomheter (offentlig eller privat, uavhengig av størrelse) etablert i Det europeiske økonomiske samarbeidsområdet (EØS) eller rettet mot enkeltpersoner i EU. Hovedformålet med GDPR er å sikre at personopplysninger har samme høye beskyttelsesstandard overalt i EØS, økt rettssikkerhet for både enkeltpersoner og virksomheter som behandler personopplysninger, og tilbyr en høy grad av beskyttelse for enkeltpersoner.

Forordningen trådte i kraft 24. mai 2016 og gjelder fra 25. mai 2018.

The GDPR puts in place clear procedures in case of a data breach. If a data breach poses a risk, companies and organisations holding your data have to inform the relevant data protection authority within 72 hours or without undue further delay. If the leak poses a high risk to you, then you must also be informed personally.

For more information on data breaches, please consult the EDPB Data Protection Guide for small business.

EDPB publiserer jevnlig pressemeldinger, nyhetsartikler, blogginnlegg og annet innhold på EDPBs nettside og sosiale medier. (Twitter: @EU_EDPB; Linkedin: European Data Protection Board) for å holde personvernmiljøet og allmennheten oppdatert med sitt arbeid.

EDPBs nettside har også to RSS-feeder, som du kan abonnere på for automatiske oppdateringer på EDPB- nyheter og EDPBs nyeste publikasjoner.

We are constantly working on the translation of our documents into the official EU languages.
All static content, as well as press releases and documents officially adopted by the Board, such as Guidelines, will be made available in these languages.

This process takes time and various steps need to be completed in order to provide translations of the best quality.

Please note that documents undergoing public consultation are usually not translated. It is only after the public consultation has been concluded and a final version of the document has been adopted by the Board that these documents will be translated.

Every organisation, regardless of the their size or sector, established in the European Economic Area (EEA) or offering products or services to individuals in the EEA, processing personal data whether or not by automated means needs to comply with the GDPR. The GDPR applies to the automated processing of personal data and to processing operations carried out manually from the moment the paper files are organised in a systematic manner, e.g. ordered alphabetically in a filing cabinet.

Examples of processing operations include collecting, recording, organising, using, modifying, storing, disclosing, altering and erasing individuals’ personal data.

Nevertheless, the application of the GDPR is modulated according to the nature, context, purposes and risks of the processing operations carried out. For SMEs whose core business is not the processing of personal data, the obligations can be less strict than for a large company.

Under the GDPR, certification is conducted by national certification bodies or by the competent national data protection authorities (Art. 42(5) GDPR).

For further information, we recommend contacting the relevant national DPA for your organisation. You can find a overview of all EEA DPAs here.

You can find further information regarding certification in the EDPB guidelines on the topic: Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation - version adopted after public consultation

The EDPB endorsed WP29 documents are available here.

As regards the other existing WP29 documents, they may remain relevant and helpful insofar as the EDPB has not adopted new documents on the topic and/or they are compatible with the GDPR. This amounts to a case-by-case assessment.

Unfortunately, the EDPB cannot consider late contributions as part of the public consultation.

Certification bodies are accredited by the national data protection authorities (DPA) or by the national accreditation body (named in accordance with Regulation 17065/2012). For further information regarding certification bodies, we recommend contacting the national DPA in your country. You can find an overview of all EEA DPAs here.

You can find further information regarding accreditation of certification bodies here: Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

No. The EDPB does not handle complaints or conduct investigations. If you believe your data protection rights have been violated you can contact the organisation holding your data, contact your national data protection authority (DPA), or go to a national court.

DPAs can conduct investigations and impose sanctions where necessary. Find the contact details for all EEA DPAs