Personal Data Act (personopplysningsloven)
Transfer and Processor Management

Personal Data Act (personopplysningsloven) NORWAY-6: International Transfers and Processor Agreements

Per Norwegian PDPA + GDPR Chapter V + Article 28: transfer + processor management. Requirements include (a) implement International Transfers restrictions per GDPR including adequacy + appropriate safeguards (SCCs + BCRs + certification) + derogations + (b) maintain Cross-Border Transfer Safeguards documentation + Transfer Impact Assessment (TIA) per Schrems II + (c) maintain Processor Agreements per GDPR Article 28 ensuring processors process only on documented instructions + maintain security + assist with rights + breach notification + (d) maintain inventory of cross-border flows + recipients + safeguards + (e) implement supplier + processor + sub-processor due diligence + (f) cooperate with Datatilsynet on transfer matters.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 32 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Regulation on the European Health Data Space (EHDS) · 3 controls

  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)
  • EHDSREG-4 Digital Health Authorities, Governance, MyHealth@EU
  • EHDSREG-5 Cross-Border Health Data Flows

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-24 Cross-border transfer safeguards
  • FADP-10 Cross-Border Disclosure (Articles 16-18)

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-14 Direct Marketing

Armenia Law on Protection of Personal Data (2015) · 1 control

Australian Privacy Principles (APPs) · 1 control

  • APP-8 APP 8 - Cross-border disclosure of personal information

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-12 Article 13 - Cross-border transfer

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-17 Section 24 - Appropriate Safeguards

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.22_23_24 Cross-border data transfers (UAE PDPL Articles 22-24)

GDPR · 1 control

  • GDPR-Art.45 Transfers on the basis of an adequacy decision

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-25 Supervisory Cooperation and Coordination

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-3 Personnel Security, Physical Security, and Cryptography

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs

PDPA Singapore · 1 control

  • PDPASG-6 Transfer Limitation, Cross-Border Safeguards, and Data Intermediary Oversight

PDPA Thailand · 1 control

  • PDPATH-6 Cross-Border Transfer and Processor Engagement

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-3 APP 6-9 Use/Disclosure, Direct Marketing, Cross-Border, Government Identifiers

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-4 Special Categories, Biometric Data

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-CLD.4 Cloud Data Sovereignty

South Korea ISMS-P · 1 control

  • ISMSP-PI-04 Cross-Border Transfer

South Korea PIPA · 1 control

  • PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021

Turkey KVKK · 1 control

  • TURKEYKVKK-3 Special Categories and Sensitive Data

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-3 Data Localization and Cross-Border

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 32 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Personal Data Act (personopplysningsloven) controls