The question · Asked in October 2026
“I am thinking to create a tool and/or word add-in for data masking/data desensitization at local computer, is there law or regulations I should know before making it available to (paid) users?”
Summary of the answer
A tool that runs only locally leaves the customers as GDPR controllers, and reversible masking is pseudonymisation, not anonymisation (GDPR art. 4 no. 5). Consumer sales fall under digitalytelsesloven, angrerettloven § 22 and markedsføringsloven § 7. Be aware that the EU’s new Product Liability Directive, the Cyber Resilience Act and the AI Act were adopted in the EU but had not been taken into the EEA Agreement when the answer was written; they may matter in the future.
A quick finding, not legal advice. Ask a legal expert to confirm it, and ask Lovkart again for today’s law.
Sources the answer used
18 sourcesLaws and regulations
- personopplysningsloven § 1lovdata.no
- GDPR art. 4lovdata.no
- GDPR art. 25lovdata.no
- GDPR recitals 26, 78lovdata.no
- digitalytelsesloven § 1lovdata.no
- digitalytelsesloven § 3lovdata.no
- digitalytelsesloven § 8lovdata.no
- digitalytelsesloven § 9lovdata.no
- angrerettloven § 22lovdata.no
- markedsføringsloven § 7lovdata.no
- ehandelsloven § 8lovdata.no
- produktansvarsloven § 1-2lovdata.no
- likestillings- og diskrimineringsloven § 18lovdata.no
Preparatory works
- Prop. 66 LS (2021–2022)regjeringen.no
EU law
- C-413/23 Pcuria.europa.eu
- Cyber Resilience Act (2024/2847)eur-lex.europa.eu
- Product Liability Directive (2024/2853)eur-lex.europa.eu
- AI Act (2024/1689)eur-lex.europa.eu