Personal Data Act (personopplysningsloven)
Individual Rights

Personal Data Act (personopplysningsloven) NORWAY-2: Data Subject Rights and Automated Decision-Making

Per Norwegian PDPA + GDPR Articles 12-22: data subject rights. Requirements include (a) implement Data Subject Rights including Access + Rectification + Erasure + Restriction + Object + Data Portability per GDPR + (b) implement Right to Object specifically for direct marketing + (c) implement Automated Decision Making protections including human review + meaningful information about logic + explanation + (d) maintain mechanism for receiving + verifying + responding within statutory timelines (typically 30 days extendable) + (e) maintain records of requests + responses + decisions + (f) integrate with broader privacy programme.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 30 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Section 508 - ICT Accessibility (Revised) · 2 controls

  • 502 Interoperability with Assistive Technology
  • 707 Real-Time Text Functionality

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-09 Notification of data files to the FDPIC
  • FADP-13 Right to Data Portability (Article 28)

APPI · 1 control

  • APPI-A27 Restriction on Provision to Third Parties

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-14 Section 15 - Right to Data Portability

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-1 Data Integration and Interoperability

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.8 Records of processing activities (UAE PDPL Article 8)

GDPR · 1 control

ISO 8000 - Data Quality · 1 control

  • ISO8000-MDG-01 Master Data Quality

Latvia Personal Data Processing Law (Fizisko personu datu apstrades likums, 2018) · 1 control

  • LV-PDPL-Data-Subject-Rights-Access-Correction-Erasure-Restriction-Portability-Objection-Sec18-Sec38 Latvia PDPL Data Subject Rights + Access + Correction + Erasure + Portability + Section 18 + 38

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-4 Consumer Privacy Rights, Consent, Marketing, and Loyalty Data

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-2 Consumer Rights: Access, Correction, Deletion, Portability, Opt-Out

PDPA Singapore · 1 control

  • PDPASG-3 Access, Correction, Data Portability, and Individual Rights

PDPA Thailand · 1 control

  • PDPATH-3 Data Subject Rights, Automated Decisions, Accuracy

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-5 APP 12-13 Access and Correction of Personal Information

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

  • RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-DAT.3 Data Sharing and Transfer

South Korea PIPA · 1 control

  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37

Turkey KVKK · 1 control

  • TURKEYKVKK-1 VERBIS Registration and Lawful Basis

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-STD.4 Interoperability Safety

Vermont Data Privacy and Online Surveillance Act · 1 control

  • VERMONTAICDA-1 AI System Inventory and Risk Assessment

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 30 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Personal Data Act (personopplysningsloven) controls