The Norwegian Data Protection Authority (Datatilsynet) has published guidelines clarifying the modalities for exercising the right of access by data subjects, particularly regarding the format of the response provided by the data controller.

Following several individual requests, the authority specifies that the right to obtain a copy of one's data does not necessarily equate to a right to receive a paper copy. In accordance with the guidelines of the European Data Protection Board (EDPB), if the access request is made electronically, the response must be provided in a commonly used electronic form, unless otherwise requested by the data subject. The data controller may use various means such as encrypted email, postal mail, or a self-service digital tool. The authority also reminds that the data controller must verify the identity of the requester in case of reasonable doubt, without requiring more information than necessary for this purpose.