Privacy policy - Littler Norway

1.     Introduction

Littler advokatfirma AS (“Littler Norway”) takes privacy seriously and processes personal data in a lawful, secure and responsible manner.

This privacy policy describes how Littler Norway processes your personal data and what rights you have as a data subject.

Littler Norway is the controller for all processing activities in the firm. For contact details, please see section 9 below.

2.     Categories of data subjects

This privacy policy is directed at the following categories of data subjects (natural persons):

• Private individuals who are clients of ours
• Individuals working for businesses that are clients of ours or for prospective business clients
• Individuals involved in matters we handle
• Individuals working for our suppliers and business partners
• Individuals applying for a position with us
• Other individuals who are otherwise in contact with us, such as course participants and newsletter subscribers

3.     Purposes and legal bases for processing

3.1  Establishing a client relationship

Before we accept a legal engagement, we carry out a conflict check. In this connection, we process information about names, the subject matter of the case and the name of any opposing party. The legal basis for the processing is Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation), as the conflict check is necessary for us to comply with the Code of Conduct for Lawyers (Regler for god advokatskikk). The processing activity is also based on Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in acting ethically.

Littler Norway is a member of Littler Global, a Swiss association of law firms (“Verein”) established under Swiss law. When carrying out conflict checks, we share information about names, the subject matter of the case and the name of any opposing party with Littler Mendelson PC (a member firm of Littler Global), which carries out a global conflict check. The legal basis for this processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as the processing activity is necessary to fulfil our legal obligations and to safeguard our legitimate interests in acting in accordance with our clients’ interests. The processing involves the transfer of personal data outside the EEA. The transfer mechanism is Article 46(2)(c) of the GDPR (standard data protection clauses adopted by the European Commission). You can read more about the European Commission’s standard contractual clauses on the European Commission’s website here. The transfers take place within the framework of Littler Global's Intra Group Data Transfer and Processing Agreement and are based on a valid transfer mechanism where required, including the European Commission's Standard Contractual Clauses.

Once the conflict check has been carried out, we perform identity verification in accordance with the Norwegian Anti-Money Laundering Act, where required. The legal basis for the processing is Article 6(1)(c) (processing is necessary for compliance with a legal obligation).

In connection with establishing the client relationship, we register and store relevant contact details. For business clients, we process the names, email addresses and telephone numbers of contact persons. The legal basis for the processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as the processing activities are necessary for us to be able to assist the client. For private individuals, we process the individual’s name, address, email address and telephone number. The legal basis for the processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is party).

3.2  Client relationship administration

We process contact details for the purpose of client administration, including invoicing. The legal basis for the processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in invoicing for our engagements. For private clients, the legal basis for the processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is party).

3.3  Case handling

A legal engagement normally means that we gain access to personal data about parties, opposing parties and/or other individuals involved in the matter. Such information may appear in documents we receive from the client or others.

For business clients, the legal basis for processing personal data in connection with the performance of legal engagements is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in fulfilling the engagement agreement with each client and in providing legal services in a proper manner. For private clients, the legal basis for the processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is party).

The legal basis for processing special categories of personal data in the performance of legal engagements is Article 9(2)(f) of the GDPR (processing is necessary for the establishment, exercise or defence of legal claims).

3.4  Use of artificial intelligence (AI)

We use AI-based tools to support case handling and internal operations, including drafting documents, summarising documents and extracting information from case documents. Such tools may be integrated into our case management and office support systems or used as standalone services. We only use AI tools that have been approved under our internal assessment process. Approval requires, among other things, that the data is processed within a closed environment, that the content is not used to train the supplier’s AI models or made available to unauthorised persons, and that a data processing agreement has been entered into with the supplier. AI-generated content is quality-assured by a lawyer, and AI tools are not used to make automated decisions about individuals.

For business clients and other data subjects, the legal basis for processing personal data when using AI tools is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in providing legal services in an efficient and quality-assured manner. For private clients, the legal basis for the processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract to which the data subject is party). The legal basis for processing special categories of personal data is Article 9(2)(f) of the GDPR (processing is necessary for the establishment, exercise or defence of legal claims). You may at any time object to processing based on legitimate interests; see the section on your rights below.

3.5  Archiving

We normally store case documentation for ten years after a legal engagement has ended.

The legal basis for the processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in being able to document what has happened in the matter, respond to enquiries from the client, and in connection with lawyers’ liability for damages.

The legal basis for processing special categories of personal data after the engagement has ended is Article 9(2)(f) (processing is necessary for the establishment, exercise or defence of legal claims).

3.6  Recruitment

We receive personal data in connection with recruitment. We process information about age, education, CV, application and contact details. We only process information that is necessary to assess whether the candidate is suitable for a position to be filled.

The legal basis for the processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in assessing applicants’ suitability for positions, communicating with applicants and recruiting staff.

If we retain application documents for a period after a recruitment process has ended, this is done on the basis of Article 6(1)(a) of the GDPR (the data subject has given consent to the processing of his or her personal data for one or more specific purposes). The purpose of such processing will be to be able to consider the individual for employment at a later date.

3.7  Information about suppliers and business partners

Littler Norway processes personal data about contact persons at suppliers and business partners, including contact details and job titles.

The legal basis for the processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in being able to administer the contractual relationship and comply with our contractual obligations.

We may also process the personal data for purposes that are not incompatible with the original purpose of the processing, such as to comply with our legal obligations, or where we as a law firm become involved in a process that makes processing necessary.

3.8  Contact details of course participants

In connection with courses and/or events organised by Littler Norway, contact details of registered participants are processed. The legal basis for the processing is Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract with the data subject).

3.9  Newsletters

We send newsletters by email to individuals who have signed up for the newsletter and to individuals who have received legal services from us and/or registered for our events in recent years.

The personal data we process in connection with sending newsletters are the recipient’s name and email address. In addition, we collect information on whether recipients actually open the newsletter and/or click on links. The purpose of the latter is to gain insight into which topics interest the recipient group.

For individuals who have signed up for our newsletter via our website, the legal basis for the processing is Article 6(1)(a) of the GDPR (the data subject has given consent to the processing of his or her personal data for one or more specific purposes). For other recipients, the legal basis for the processing is Article 6(1)(f) of the GDPR (processing is necessary for the purposes of legitimate interests), as we have a legitimate interest in marketing our business.

Recipients can unsubscribe from the newsletter at any time by clicking the unsubscribe link in the newsletter or by contacting us at This email address is being protected from spambots. You need JavaScript enabled to view it..

4.     Information security

Littler Norway has implemented proportionate and organisational security measures to achieve an adequate level of information security in line with fundamental principles of confidentiality, integrity, availability and resilience.

5.     Recipients

Our lawyers and employees are subject to a duty of confidentiality. Information will not be shared with third parties unless there is a lawful basis for sharing it.

We may share personal data if we are required to do so by law and/or if it is necessary to fulfil the engagement agreement. Categories of recipients may include public authorities, courts and/or opposing parties.

We use data processors to assist us with various processes, including operating providers of IT services and accounting systems. This means that data processors process personal data on behalf of Littler Norway in various contexts. We have entered into data processing agreements with our data processors, which ensure that personal data is processed in accordance with applicable regulations. Furthermore, the data processors we use may only process personal data in accordance with our instructions, and the data processors cannot themselves decide how the personal data is to be used. When AI tools are used, the providers of the tools and their sub-processors are data processors that process the personal data in accordance with our instructions. As a general rule, such processing takes place within the EU/EEA. Where the use of a tool involves the transfer of personal data outside the EU/EEA, this only takes place where there is a valid transfer mechanism under Chapter V of the GDPR.

Littler is part of Littler Global. Unless otherwise agreed, Littler may share information, including personal data, with other member firms of Littler Global, both within and outside the EEA, to the extent necessary to carry out the engagement. Such sharing takes place pursuant to an internal agreement between the member firms of Littler Global governing the transfer and processing of personal data (Intra Group Data Transfer and Processing Agreement). Among other things, this agreement ensures that the information is subject to equivalent requirements regarding confidentiality and information security, and that transfers to countries outside the EEA are carried out in accordance with the provisions of the General Data Protection Regulation (GDPR) governing transfers of personal data to third countries.

Please also note that we transfer personal data outside the EU/EEA in connection with conflict checks when establishing client relationships. This processing is described in more detail in section 3.1 above.

6.     Retention period

Littler Norway processes personal data for as long as necessary to fulfil the original purpose for which the data was collected, and for purposes that are otherwise not incompatible with the original purpose for which it was collected, including to fulfil legal obligations.

The table below provides an overview of the retention periods for various categories of personal data at Littler Norway.

7.      Your rights

Data subjects have a number of rights under the GDPR. As a starting point, you may request access to, rectification of or erasure of the personal data we process about you. You also have the right to request restriction of processing, to object to the processing and to data portability. The right to object applies in particular to processing based on legitimate interests, including the use of AI tools as described above. You can read more about your rights on the website of the Norwegian Data Protection Authority (Datatilsynet): www.datatilsynet.no.

To exercise your rights, you must contact us. Our contact details can be found in section 9 below. We will respond to your enquiry as soon as possible, and no later than within 30 days.

If you believe that our processing of personal data does not correspond to what is described in this privacy policy, or that we otherwise process personal data in breach of applicable data protection legislation, you may lodge a complaint with the Norwegian Data Protection Authority. Information on how to lodge a complaint can be found on the Norwegian Data Protection Authority’s website: www.datatilsynet.no.

8.     Changes to this privacy policy

We reserve the right to amend this privacy policy as necessary. We encourage interested parties to check this privacy policy regularly for changes. This privacy policy was last updated on 14 October 2026.

9.     Contact

If you have any questions about this privacy policy or our processing of personal data, please contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..

This website uses cookies. We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our website with our social media, advertising and analytics partners, who may combine it with other information that you have provided to them or that they have collected from your use of their services.

Cookies are small text files that can be used by websites to make a user’s experience more efficient.

The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission.

This site uses different types of cookies. Some cookies are placed by third-party services that appear on our pages.

You can change or withdraw your consent via the Cookie Declaration on our website.

Read our Privacy Policy to learn more about who we are, how you can contact us and how we process personal data.