Digital sovereignty resources for Norwegian organizations

General Data Protection Regulation

The GDPR establishes strict requirements for processing personal data of EU residents. It requires a lawful basis for all processing, grants individuals rights to access, correct, delete and port their data, and imposes significant penalties up to 4% of global turnover for violations.

Clarifying Lawful Overseas Use of Data Act

The CLOUD Act establishes that US jurisdiction follows the company, not the data location. US companies must comply with warrants for data they control even if stored in EU datacenters. This creates direct conflicts with GDPR and undermines the 'datacenter location' approach to data sovereignty.

Directive on measures for a high common level of cybersecurity across the Union

NIS2 significantly expands the scope of the original NIS Directive to cover more sectors and entity types. It requires organizations to implement risk management measures, report significant incidents within 24 hours, secure their supply chains, and ensure management bodies are trained and accountable for cybersecurity.

Digital Operational Resilience Act

DORA creates a comprehensive framework for digital operational resilience in financial services. It requires financial entities to implement robust ICT risk management, report major ICT incidents, test their digital resilience regularly, and manage risks from third-party ICT service providers including cloud platforms.