If you want to learn more about the types of information we collect and the basis for Norid's processing of customer data, you can read the article Norid's processing of customer data.
Norid requires correct information in the agreement with the subscribers
A domain name is created when an enterprise or a private individual is assigned a subscription for the domain name. The subscriber is granted exclusive rights to use the domain name for the duration of the subscription.
The subscriber is responsible for providing accurate information and for keeping that information up to date. In the subscription agreement Norid requires that the information is correct and up-to-date. Accurate information is a prerequisite both for the subscriber to be granted the right to use a domain name and for this right to be maintained 2.
The subscription agreement requires the subscriber to provide correct information
15.5 The subscriber is obliged to provide correct information, both at the time of the application and for as long as the registration is maintained. The subscriber is obliged to respond to enquiries from Norid regarding whether the registered information is still correct. The subscriber is then obliged to document the information that has been provided.
15.6 The subscriber is obliged to keep registered information (contact information and technical information) updated at all times.
Domain name policy for Norwegian domain names, Section 15
If the information is incorrect or outdated, the subscriber must contact the registrar so the information can be updated. Norid follows the same principle as the National Population Register and the Brønnøysund Register Center, where it is the responsibility of the registered party to report changes in the registered information. Unlike the public registers, where this duty is based on law, Norid has this as part of the agreement with the subscriber.
Norid processes updates received through registrars continuously. Our processing is included in the annual subscription fee.
Norid requires the registrar to know who the subscriber is and assist the subscriber
The domain registrar submits domain name applications on behalf of the subscriber. Norid requires the registrar to know who the subscriber is but leaves it up to the registrar to determine the appropriate methods to fulfill this requirement. This is regulated in the agreement Norid has with all registrars.
The registrar agreement requires the registrar to know who the subscriber is
3.3 Administration of the Domain Name Subscription
The Registrar shall know who the Subscriber is at all times, and shall be able to verify who the Subscriber is at the request of Norid. Norid is entitled to introduce new systems for verification and other verification requirements if this is necessary for security reasons, or is required by a statute, regulation or official decision.
Norid's registrar agreement, section 3
If the registrar agreement is breached, Norid has the right to demand compliance and may suspend access to the registration service until the registrar rectifies the breach. Repeated violations may give Norid the right to terminate the agreement.
The registrar must assist the subscriber in keeping information updated
To ensure that subscribers can easily update their information, Norid requires registrars to assist subscribers in fulfilling their obligations to Norid.
The registrar agreement obligates registrars to assist subscribers
4.3 Information
The Registrar shall annually inform the Subscriber of information that is registered in the Registry Service concerning the Subscriber’s Domain Name Subscription that is administered by the Registrar. The Registrar shall assist the Subscriber with updating the information.
The Registrar shall continuously update changes to the information about a Domain Name Subscriber in the Registry Service once the Registrar becomes aware of these changes.
Norid's registrar agreement, section 4
Norid verifies that the subscriber exists
The subscriber is identified to Norid through a unique identifier. If the subscriber is a business entity, the identifier is the organization number registered in the Brønnøysund Register Centre. If the subscriber is a private individual, the identifier is the national ID number registered in the National Population Register. The identifier determines who the subscriber is and who holds the usage rights to the domain name, regardless of who submitted the application.
Before granting the right to use a domain name, Norid checks the National Population Register or the Brønnøysund Register Center to verify that there is a registered individual or business with the provided name and identifier (national ID number or organization number).
Example: Norid receives an application (via a domain registrar) stating that Sintef AS, with organization number 919 303 808, is applying for usage rights to the domain name «eksempeldomene.no». Norid checks the Brønnøysund Register Centre to verify that a business with this organization number and name exists. If the business does not exist, the application is rejected.
The registration process is automated, with a processing time of approximately 0.7 seconds.
Norid regularly verifies that the subscriber still exists
The agreement with the domain subscribers states that Norid may delete domain names if the subscriber no longer exists.
The subscription agreement grants Norid the right to delete domain names if the subscriber no longer exists
12.1 The following circumstances may result in Norid deleting a domain name so that the name is made available to others:<…>
- The domain name subscriber no longer exists. For organisations, this means that they have been deleted from the Norwegian Central Coordinating Register for Legal Entities; for individuals, that they have died.
Domain name policy for Norwegian domain names, Section 12
Norid conducts daily automated checks to verify that organizations still exist in the Brønnøysund Register. If the check reveals that a business has been deleted, Norid automatically initiates the termination of all domain subscriptions registered to that business. A notice is sent to the subscriber’s email address, and a message is sent to the relevant registrars. During the termination period, a representative for the subscriber may transfer the domain names to a new subscriber, provided that the new subscriber meets Norid’s allocation rules.
For private individuals, Norid conducts an annual check to verify that the person has not been recorded as deceased in the National Population Register. If the check reveals that a subscriber is deceased, the personal identifier used by Norid is blocked, preventing new subscriptions from being created under that identity. The registrar typically contacts the next of kin and either terminates the domain subscription or assists in transferring the domain name to one of the heirs.
Automatic verification of other information
Before assigning a domain name and when changes are made to registered information, Norid performs several automated checks on the information provided about the subscriber, the registrar, the technical contact, and the domain subscription.
We check, among other things, that:
- the specified name servers respond according to the technical requirements in the allocation rules.
- key data is valid (if the domain name is secured with DNSSEC and key data is provided).
- the syntax of email addresses complies with standard formatting.
- the country code in the postal address is valid.
- the postal code and city for Norwegian addresses match the official postal service database (a Norwegian postal address is required for subscribers but not for registrars or technical contacts).
- phone numbers, if provided, have the correct number of digits. If the number is Norwegian, its syntax is further checked against Norwegian telephone number requirements.
Domain subscriptions are automatically deleted if not renewed
A domain subscription starts from the date the domain name is registered in Norid’s system (registration date). The subscription lasts for one year from the registration date and continues only if the subscriber chooses to renew it. The registrar requests the renewal on behalf of the subscriber. Subscriptions that are not renewed are terminated, and the domain name becomes available to other applicants.
The measures in light of the GDPR requirements
Accuracy principle
The General Data Protection Regulation (GDPR) (Article 5, Section 1, Letter d) sets out the so-called accuracy principle. This principle states that personal data must be accurate and, when necessary, updated. Any reasonable step must be taken to ensure that inaccurate personal data is erased or corrected without delay.
The wording of the GDPR and its preamble provide limited guidance, but the Norwegian Data Protection Authority (Datatilsynet) has suggested the following measures to maintain data «accuracy»: For example, systems can regularly notify users to check their personal information. Many banks implement this by prompting users to verify their details when logging into online banking. 3 This suggests that the accuracy principle can, in some cases, be fulfilled by allowing the data subject to review and update their registered information.
The registration system for the Norwegian top-level domain follows this principle by displaying the subscriber’s registered information at least once a year. Registrars are required to assist subscribers in correcting any errors. Norid processes all updates to subscriber information free of charge for both registrars and subscribers.
Complete information
The GDPR (Article 16) also states that the data subject has the right to have inaccurate personal data corrected without undue delay and, under certain conditions, the right to have incomplete personal data completed.
Norid automatically verifies that all required information is provided before granting a subscriber the right to use a domain name. Therefore, it is unlikely that incomplete information would be registered. However, if such a case arises, corrections can be made in the same manner as for inaccurate information.
Footnotes
- 1. Companies that have a contract with Norid to submit orders on behalf of subscribers and generally act as intermediaries between Norid and the subscriber. Subscriber information is collected when registrars connect to Norid’s registration service and submit applications on behalf of subscribers.
- 2. If the subscriber has provided incorrect information or Norid is unable to contact them, Norid ultimately has the right to terminate the domain subscription.
- 3. Norwegian Data Protection Authority (Datatilsynet), “Accuracy” (https://www.datatilsynet.no/rettigheter-og-plikter/personvernprinsippene/grunnleggende-personvernprinsipper/riktighet/), last updated July 16, 2019