Norway Introduces Strict Cybersecurity Measures Under New Electronic Communications Act 2025

Norway’s New Electronic Communications Act: Strengthening Cybersecurity Standards

On 1 January 2025, Norway implemented the Electronic Communications Act (Prop. 93 LS), introducing enhanced cybersecurity measures for electronic communication networks and services.

The new regulations aim to bolster digital security, requiring service providers to adopt proactive risk management strategies and transparent communication practices in the event of breaches.

Vedtak til lov om elektronisk kommunikasjon (ekomloven)

Lovvedtak 1 (2024–2025)

Stortinget

Continuous Risk Assessments for Enhanced Security

The Act mandates electronic communication operators to conduct ongoing risk assessments to safeguard their networks and services.

This approach compels operators to remain vigilant against emerging threats by regularly updating security protocols and ensuring that their systems are robust enough to withstand cyberattacks.

These risk assessments are not a one-time measure but an ongoing obligation, reflecting the dynamic nature of cybersecurity threats.

Operators must monitor vulnerabilities, implement necessary fixes, and adopt modern technologies to protect communication infrastructure from potential exploitation.

Breach Notification Requirements

The legislation also introduces strict timelines for reporting security breaches. Service providers are required to inform the Norwegian Data Protection Authority (DPA) within 72 hours of detecting a significant breach.

This allows regulators to assess the impact, coordinate responses, and hold operators accountable for lapses in security.

Moreover, in cases where users’ data or privacy might be compromised, service providers must notify affected subscribers within 24 hours.

This swift notification requirement prioritises transparency, giving users the information they need to protect themselves from potential misuse of their personal data.

Safeguarding User Privacy

A core component of the Act is its focus on protecting user and subscriber privacy. With the increasing volume of personal information stored and transmitted through digital networks, the new regulations aim to prevent unauthorised access and data breaches that could harm users.

By mandating immediate action and user notifications, the Act acknowledges the importance of timely communication in mitigating the effects of security incidents.

This measure empowers users to take necessary precautions, such as changing passwords or monitoring account activity, in response to potential threats.

Implications for Service Providers

The Act places a significant operational burden on service providers, requiring them to invest in robust cybersecurity frameworks and maintain high levels of readiness to detect and address security breaches.

Companies operating in Norway must now integrate these requirements into their existing protocols, ensuring compliance with both national and international cybersecurity standards.

Failure to adhere to these regulations could result in penalties and damage to a company’s reputation. As such, many operators are expected to enhance their investments in cybersecurity technologies and training programs for their staff.

A Timely Response to Rising Cyber Threats

Norway’s Electronic Communications Act reflects the growing urgency of addressing cybersecurity threats in an increasingly interconnected world.

With digital communication forming the backbone of modern society, the Act provides a framework for operators to protect infrastructure and maintain public trust in electronic communication services.

Lov om elektronisk kommunikasjon (ekomloven)

Stortinget har behandlet et lovforslag fra regjeringen om ny lov om elektronisk kommunikasjon (ekomloven). Loven regulerer mobil- og bredbåndstjenester og andre kommunikasjonstjenester og elektroniske kommunikasjonsnett, som meldingstjenester i internettbaserte applikasjoner og sosiale medier. I tillegg reguleres datasentre for første gang. Loven vil ersatte gjeldende ekomloven fra 2003. Stortinget vedtok, men noen mindre justeringer i §§ 2-7, 4-5 og 4-6, loven i tråd med regjeringens forslag.

Stortinget