Norway: Compliance

The European Data Protection Board has released groundbreaking guidelines on anonymisation that fundamentally reshape how organisations must assess data identifiability. These new rules introduce the concept of "relative identifiability," establish strict processor obligations, and set demanding standards for AI training data that could transform compliance practices across the EU.

ESMA's 2027 Annual Work Programme signals a shift toward more intensive supervision of digital operational resilience, with heightened focus on DORA compliance, ESG rating providers, and fund reporting systems. Norwegian asset managers face increased scrutiny on ICT third-party risk management, incident handling protocols, and ESG disclosure practices as supervisory expectations evolve from implementation support to enforcement.

This newsletter examines significant competition law and regulatory developments across five European jurisdictions, analyzing how enforcement authorities are reshaping market oversight through new investigative tools, merger remedies, and abuse of dominance cases.

Statnett and Fornybar Norge have introduced stricter maturity criteria for grid capacity access, requiring approved zoning plans for projects over 100 MW and reducing maximum implementation periods from ten to six years.

EU-kommisjonen har identifisert tre strukturelle utfordringer som hindrer europeiske bankers konkurranseevne: nasjonal fragmentering, manglende differensiering mellom store og små banker...

Finansdepartementet har vedtatt å underlegge finansieringsforetak, eiendomsmeglingsforetak, inkassoforetak og Norsk naturskadepool sentrale deler av DORA-regelverket fra 1. september 2026. Endringen markerer et viktig skifte fra nasjonalt IKT-regelverk til et harmonisert europeisk rammeverk for digital operasjonell motstandsdyktighet. Berørte virksomheter må nå vurdere om eksisterende styrings- og risikostyringsprosesser oppfyller de nye kravene til IKT-risikostyring, hendelsesrapporteri