Privacy work starts by mapping which information you use, why and who receives it. A cookie banner or standard privacy notice cannot solve this alone.
This article is a practical introduction, not a full legal assessment of a particular setup. If you are unsure about the legal basis, sensitive data or provider chains, obtain a specific professional assessment. The rules must be applied to what the business actually does.
Separate three different questions
GDPR regulates personal data processing. Norway’s Electronic Communications Act has separate rules on storing and accessing information on users’ devices. The Marketing Control Act regulates matters including email and SMS marketing. Several rules may apply at once.
A valid basis for answering an enquiry therefore does not automatically permit subscribing the person to a newsletter or sharing their information with an advertising platform.
Map purposes and legal bases
List forms, mailing lists, CRM, analytics and advertising tags. Record each processing purpose, necessary information and legal basis. Consent is one of several possible GDPR bases; The Norwegian Data Protection Authority explains the assessment.
Do not request more contact form fields than you need. A standard form should not invite sensitive information if the receiving process is not designed for it.
Check tracking before consent
Since 1 January 2025, Norway’s Electronic Communications Act requires prior GDPR-valid consent for cookies and similar technologies outside its narrow exemptions. See The Norwegian Data Protection Authority’s guidance.
Users must be able to make a genuine choice and withdraw it. Test the website in a fresh browser session before a choice, after rejection, after acceptance and after withdrawal. Also investigate video, maps, chat and integrations that may load third-party technology. Calling a solution server-side or ‘cookieless’ does not, by itself, determine which rules apply.
Keep newsletters separate from contact
Norwegian Consumer Authority guidance describes the general requirement for prior consent to electronic marketing to individuals. This can also include a personal work email address.
Under the Norwegian rules, the existing-customer exception requires, among other things, an address obtained during a sale, your own similar offerings and a simple, free opt-out when collecting the address and in subsequent emails. A download or unanswered quotation request does not in itself establish such a customer relationship. Document the assessment and subscription.
Clarify providers, access and storage
Identify which providers receive data, their roles and the agreements needed. Also investigate any processing outside the EEA. A familiar product name does not prove your specific use is appropriate.
Privacy principles includes data minimisation, storage limitation and security. Establish routines for access, deletion and rights requests. Do not leave old exports without a responsible owner.
Make checks part of every change
When introducing a form or tool, check the data flow before publication. Update user information and test that it matches the solution. Changed integrations can also change which data is shared.
Start with one practical check: complete every form with test data and follow the information to all recipients. That provides a better starting point than simply reading the banner text.
