Online GDPR course for employees and managers

6 modules in the course

Each module links directly to lovdata.no and the Data Protection Authority's guidance.

How the course is built. Open a module to see what it covers and which statutory provisions it rests on.

1. 01What data protection and GDPR are, and why they apply to your business

   The module establishes that GDPR is Norwegian law through the Personal Data Act section 1 and applies to every business that processes personal data, even the smallest. You learn what personal data and processing are, with examples such as e-mail, IP address and photos, and the difference between data protection and information security. It also sets the course's honest limits: training as part of internal control, not a certification.

   Legal basis:Personopplysningsloven §1

2. 02Legal basis and the core principles

   Every processing activity needs one of the six grounds in art. 6(1): consent, contract, legal obligation, vital interests, public interest or legitimate interest. You learn why consent is rarely the right ground in employment, why health data such as sick leave is a special category under art. 9, and how the principles in art. 5 mean the business must be able to document compliance.

   Legal basis:GDPR art. 5 til 9

3. 03The rights of the people whose data you hold

   The module covers the rights in art. 13 to 22: information, access, rectification, erasure, restriction, data portability and the right to object. The deadline to respond is one month, extendable by two months for numerous or complex requests (art. 12(3)). You learn to give access without leaking other people's data, and why erasure is not absolute when other law requires records to be kept.

   Legal basis:GDPR art. 12 til 22

4. 04Your business's duties: accountability, routines and internal control

   The controller carries the main responsibility and must be able to demonstrate compliance (art. 24), and that responsibility does not move to suppliers. You learn what a record of processing activities is, and why the exemption for businesses under 250 employees often falls away when you process payroll or health data (art. 30(5)). The module also covers data protection by design (art. 25) and when a data protection officer and an impact assessment are required.

   Legal basis:GDPR art. 24 til 30GDPR art. 37 til 39

5. 05Information security and data processors in practice

   Art. 32 requires technical and organisational measures matched to the risk, such as access control, two-factor authentication, encryption, updates and backups, and paragraph 4 says staff may only process data on instruction. That is why routines and training are needed. You learn when a supplier is a processor and needs a data processing agreement under art. 28, and why most breaches come from ordinary everyday mistakes.

   Legal basis:GDPR art. 32GDPR art. 28

6. 06When things go wrong: incident handling and breaches

   A personal data breach can be anything from a misdirected e-mail to a lost laptop. Under art. 33 the controller must report the breach to the authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk. Where the risk is high, the people affected must also be told (art. 34), and every breach must be documented, including those not reported.

   Legal basis:GDPR art. 33 og 34Datatilsynet: avvikshåndtering