Course and certificate
Data Protection (GDPR) for Employees (Personvern for ansatte)
For employees of Norwegian organisations who work with personal data in their jobs. Nine short lessons in plain English explain the data protection rules in the Personal Data Act (personopplysningsloven) and the General Data Protection Regulation (GDPR): terms and roles, the seven basic principles, lawful bases and consent, rights and access requests, staying secure day to day, phishing and fraud, personal data breaches and the duty to notify the Norwegian Data Protection Authority (Datatilsynet, 72 hours), monitoring, e-mail and the national identity number in the workplace, and administrative fines. The course is an introduction for employees. It does not replace the employer's own policies, instructions and training. Then you take a test of 25 questions.
- Jurisdiction
- 🇳🇴 Norway
- Languages
- Norsk bokmål, Dansk, English, Polski, Română, Svenska, Українська
- Lessons
- 9
- Time needed
- About 50 minutes for the lessons and the test
- Assessment
- 25 questions, pass mark 80%
- Refresher
- Recommended after 2 years
- Content updated
- 27 October 2026
- Certificate fee
- kr 390.00, payable after passing
01Who this course is for
- Employees who handle customer data, staff data or other personal data in their jobs
- New employees who need a quick introduction to data protection and information security
- Staff in customer service, administration, HR, sales and health and care services
- Managers and employers who want to give their staff a shared basic knowledge of the GDPR and the Personal Data Act
- Anyone who wants to know what to do about a rights request, a breach or a phishing message
02Syllabus
- 01Data protection and personal data: the rules and the terms
- 02The seven basic principles in Article 5
- 03Lawful bases, consent and information
- 04Your rights and how to handle a request
- 05A secure everyday routine: passwords, equipment and the workplace
- 06Phishing, fraud and social engineering
- 07Breaches: personal data breaches and the duty to notify
- 08Employment: monitoring, e-mail and the national identity number
- 09The employer's duties, sanctions and your role
03Assessment
25 multiple-choice questions drawn from the whole course. The pass mark is 80%. The test is free and can be retaken as often as needed; wrong answers point to the lesson to read again.
04The certificate
- With your name, your score and the date you passed.
- A unique number, recorded in our register.
- Your employer or an inspector scans it to see that it is genuine.
- Download it, print it or show it on your phone.
05Sources
The course follows the published guidance below. We are not affiliated with the bodies that publish it.
- GDPR artikkel 32
- GDPR artikkel 33
- GDPR artikkel 28
- Personopplysningsloven § 12
- GDPR artikkel 5 nr. 1 bokstav e
- GDPR artikkel 5 og 32
06Questions
Is this training required by law?
The data protection rules set no particular course length or certificate for employees. But the controller must make sure that people with access to personal data process it only on instructions (GDPR Article 32(4)) and must have suitable organisational measures. Training is a common way of meeting this. This course gives basic knowledge, and it is the employer who decides whether it covers the organisation's needs.
Is the certificate a qualification set by the authorities?
No. The certificate is proof that you completed the course. It is not a regulated or officially approved qualification, and the Norwegian Data Protection Authority (Datatilsynet) has not assessed the course. The employer decides for itself whether the course fits into the organisation's training.
Who is the course for?
Employees in any industry who handle personal data in their jobs, for example in administration, customer service, HR, sales and health or care services. The course goes through the rules across industries, not the conditions in one particular organisation.
What does the employer or organisation still have to do?
The employer is the controller and must have its own policies and procedures, keep a record of processing activities where required, give instructions on how to use the systems, conclude data processing agreements, carry out risk assessments, secure the systems and have procedures for breaches and rights requests. The organisation must also give training on its own systems and its own risks. The course gives knowledge, but not ready-made answers for your organisation.
Does the course also cover the GDPR and the Personal Data Act?
Yes. The General Data Protection Regulation (GDPR) applies in Norway through the EEA Agreement and has been made Norwegian law by the Personal Data Act (personopplysningsloven). The course explains the principles, the lawful bases, rights, breaches and the duty to notify, as well as Norwegian rules such as the national identity number (§ 12), chapter 9 of the Working Environment Act (arbeidsmiljøloven) and the regulations on employer access to e-mail accounts. It does not give legal advice in individual cases. If you are in doubt, contact the organisation's data protection officer or the Data Protection Authority (Datatilsynet).
What if I fail the test?
It costs nothing. You can see which lessons you should read again, and you can take the test as many times as you like.
When do I pay, and how much?
Only after you have passed: 390 NOK for the certificate. The course and the test are free.
How can others check the certificate?
Every certificate has a number and a QR code. When someone scans the code or types the number on our verification page, your name, the course and the date you passed are shown.
Do I have to take the course again?
The law sets no deadline for this kind of training. The certificate is valid for 24 months from the day you passed, because rules, threats and systems change. Many organisations ask for a refresher at regular intervals, and the employer decides what is required where you work.
Can I use the course to document my knowledge of the rules to the Data Protection Authority (Datatilsynet)?
The certificate shows that you completed a course and passed a test. It is not an approval from the Data Protection Authority (Datatilsynet) and cannot replace the organisation's own documentation. It is the employer who must be able to show that the rules are followed (Article 5(2)).
The certificate confirms that you completed this course and passed its test. It is not a regulated or accredited qualification; your employer decides whether this training meets their requirements.