Approval of the Controller Binding Corporate Rules of Statkraft

The Norwegian Data Protection Authority ("the Norwegian SA") approves the Controller Binding Corporate Rules (BCRs) of Statkraft, ensuring appropriate safeguards for personal data transfers. The approved BCRs cover data transfers between members of the Statkraft Group in EEA countries and third countries, including purposes and categories of data subjects concerned. Important compliance considerations include: * Implementing supplementary measures to ensure an essentially equivalent level of protection as provided in the EU. * Conducting assessments to determine whether any legislation or practices of the third country may impinge on the ability to comply with commitments taken in the BCRs. * Providing information on the binding corporate rules, including provisions on data subjects' rights and liabilities.