Norway is a member of the European Economic Area but not of the European Union. The practical consequence for hosting customers is meaningful and underappreciated. The Court of Justice of the European Union has no direct jurisdiction over a Norwegian operator; secondary EU instruments that have not been incorporated into the EEA agreement do not bind Norway; and Norway retains independent national authority over data-protection enforcement.
That is not a legal escape hatch — Norway has GDPR in force through the EEA agreement, and the Datatilsynet is a competent and active regulator. What it gives a customer is a second sovereign legal forum that is closely aligned with EU privacy norms but free of EU-only legislation that the rest of the bloc might pass.
On top of EEA-incorporated GDPR sits Section 100 of the Norwegian Constitution, originally drafted in 1814 and substantially revised in 2004. It guarantees freedom of expression and the protection of communications infrastructure from arbitrary state action — and it is, like the Swedish and Finnish equivalents, written above ordinary statute, not below it.
An Oslo VPS therefore sits inside a jurisdiction that combines the rigour of European data protection, the independence of a non-EU sovereign, and a constitutional commitment to free expression that predates almost every other written constitution on the continent. Three rare attributes, in one stable Nordic democracy.