Iceland. Comprehensive data protection. Act
Act 90/2018Act No. 90/2018 on Data Protection and the Processing of Personal Data (Lög um persónuvernd og vinnslu persónuupplýsinga)
In force
§1Summary
- Synopsis
Gives the GDPR effect in Iceland as an EEA state and sets national supplementary rules, replacing Act 77/2000. Persónuvernd supervises and can impose fines.
- Key themes
- Unique features
Age of digital consent 13; specific rules on use of the national ID number (kennitala) and electronic monitoring.
- SaaS relevance
SaaS providers targeting Icelandic users are subject to the GDPR as applied in Iceland.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority 72h; individuals without undue delay if high risk
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (EEA)
- Maximum penalty
- €20m or 4% global turnover (ISK equivalent)
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text althingi.is
- Authority
- Persónuvernd (Icelandic Data Protection Authority)
§5Where it applies
- Domestic law of
- Iceland
§6Sources and verification
- Sources consulted
- Verification
High confidence.
EEA state – GDPR applies.