Frameworks / Personal Data Act (personopplysningsloven) / NORWAY-8 Personal Data Act (personopplysningsloven)
Breach and Enforcement
Personal Data Act (personopplysningsloven) NORWAY-8: Breach Notification, Complaints, Compliance, Enforcement Per Norwegian PDPA + GDPR Articles 33-34 + 77-84: breach notification + enforcement. Requirements include (a) implement Notification of Personal Data Breaches to Datatilsynet within 72 hours of becoming aware unless unlikely to result in risk + notify affected data subjects where high risk per GDPR Article 34 + (b) operate Security Incident Response Procedures including detection + triage + containment + recovery + lessons learned + (c) operate Complaints Handling and Resolution mechanism enabling complaints to controller + Datatilsynet + (d) maintain Compliance Monitoring and Auditing + Regulatory Reporting and Cooperation + (e) maintain Enforcement and Penalties awareness including administrative fines (up to higher of EUR 20m or 4% global annual turnover) + corrective powers + (f) maintain breach log + incident response + tabletop exercises.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 221 controls across 80 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A33 Request for Disclosure of Retained Personal Data APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.9 Processing of special categories of personal data BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-21 Sections 61-69 - Data Privacy Officer ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation ISMSP-SYS-05 Incident Response API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 27400-5.4 Data and privacy risks 27400-6.5 Security monitoring and incident response 27400-7.3 Data minimization and purpose limitation 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NIST800-IR-2 IR-2 Incident Response Training NIST800-IR-5 IR-5 Incident Monitoring NIST800-IR-7 IR-7 Incident Response Assistance NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP NGOB-2 Customer Consent Management and Lifecycle NGOB-5 Fraud Monitoring, Incident Notification, and Reporting to CBN OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery OSFIB13-7 Incident Reporting to OSFI and Regulatory Coordination OSFIB13-8 Metrics, Monitoring, Continuous Improvement, Maturity OREGONCPA-3 Consent, Sensitive Data, Children and Teen Protections OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs PDPASG-2 Notification, Consent, Purpose Limitation, and Lawful Basis PDPASG-5 Protection, Accuracy, and Security of Personal Data PDPASG-8 Data Breach Notification, Incident Response, and Enforcement PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25 CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) CA-10 Selects and Develops Control Activities CA-12 Deploys Through Policies and Procedures FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 27557-3 Terms and definitions 27557-4.3 Individual impact consideration 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team OMANCS-4 Data Protection, Cryptography, and Privacy Alignment OMANCS-6 Security Monitoring, Detection, Incident Response, and OmanCERT Notification OPENBANK-7 Logging, Monitoring, Regulatory Reporting, SLA, Availability OPENBANK-8 Incident Detection, Response, Customer Notification, Post-Incident Review, BCM PDPATH-5 Security Measures and Data Protection PDPATH-8 Data Breach Notification, Complaints, Compliance, Enforcement AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data D.1 Incident Response Planning D.2 Incident Reporting CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation USMCADIGITAL-1 Cross-Border Data Flows and Localisation USMCADIGITAL-2 Personal Information Protection and Consumer Protection VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation CPS230-13 Board Accountability for Operational Risk Management 4.4.7 Emergency and Incident Response AL-DPA-12 International Data Transfers DS-2 Ensure software supply chain security CA-ITSG33-SC-01 Security Control Catalogue CAT-D5-1 Incident planning and strategy ISO28001-PC-04 Supply Chain Continuity Planning ISO20000-11 Incident management ISO23894-A.5 Privacy and Data Protection in AI 27010-16.1 Continuity of Sharing ITIL4-11 Incident management NFPA1600-6.3 Emergency Response Operations NRFCS-7 Detection, Logging, Incident Response, Breach Notification, and Fraud Detection NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation PASONE-6 Incident Management, Audit, Handover, Operational Phase, Decommissioning PNGCYBER-4 Incident Response, Investigation, Evidence Preservation, Data Retention PSPF24-1 Security Culture, Governance, Risk Management RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration IM8-RES.3 Incident Response TEFCAREC-1 Common Agreement Conformance and Onboarding TURKEYKVKK-2 Information Notice and Data Subject Rights USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 221 it maps to, and the evidence behind each claim, over MCP and REST.