Data protection & privacy law in Iceland (2026)

Legal framework

Act No. 90/2018 on Data Protection and Processing of Personal Data (implementing EU GDPR via EEA Agreement); supervised by Persónuvernd (Icelandic Data Protection Authority)

GDPR & data protection in Iceland

In Iceland, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Icelandic Data Protection Authority (Persónuvernd).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Icelandic Data Protection Authority (Persónuvernd)

Applies to

any organisation processing the personal data of people in Iceland, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Iceland supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Iceland

1. 01Legal basis: Act No. 90/2018

   The Icelandic Parliament enacted Act No. 90/2018 on Data Protection and Processing of Personal Data in July 2018 to transpose the GDPR into national law via the EEA Agreement. It covers all automated and relevant manual processing by controllers and processors established in Iceland, or targeting individuals there.

   dlapiperdataprotection.com whitecase.com

2. 02Supervisory authority: Persónuvernd

   Persónuvernd (personuvernd.is) is Iceland's independent data protection authority, constituted as the supervisory authority for GDPR Article 51 purposes. It investigates complaints, conducts audits, issues guidance, and participates in EDPB consistency mechanisms as a non-voting member.

   personuvernd.is edpb.europa.eu

3. 03Core obligations & data-subject rights

   Controllers must satisfy one of the GDPR's six lawful bases (consent, contract, legal obligation, vital interests, public task, or legitimate interests); stricter conditions apply to special-category data. Data subjects hold the full GDPR suite of rights: access, rectification, erasure, restriction, portability, and objection.

   dlapiperdataprotection.com linklaters.com

4. 04Administrative fines & criminal sanctions

   Act 90/2018 mirrors the GDPR's two-tier fine structure: up to ISK 1.2 billion or 2% of global annual turnover for lower-tier violations (security, DPIAs, records), and up to ISK 2.4 billion or 4% for higher-tier violations (core principles, data-subject rights, international transfers). Intentional, profit-driven breaches can result in up to three years' imprisonment.

   dlapiperdataprotection.com linklaters.com

5. 052025-2026 DPA priorities: cybersecurity, health data & AI

   Persónuvernd's 2025 annual report identified cybersecurity incidents, health-data processing, and AI governance as its top supervisory priorities. The authority also published new rules on workplace electronic monitoring, alongside model consent labels and guidance on email/internet monitoring.

   grip.globalrelay.com dataguidance.com

6. 06EU AI Act & EEA incorporation

   The EU AI Act entered into force on 1 August 2024 and becomes fully applicable by August 2026. As an EEA EFTA state, Iceland requires a separate EEA Joint Committee decision to incorporate the AI Act; Persónuvernd is expected to play a supervisory role for AI systems once incorporated.

   grip.globalrelay.com dlapiperdataprotection.com

GDPR in Iceland: FAQ

Timeline of decisions

1. 28 Nov 2023Enforcement · official
   Persónuvernd Fines Multiple Municipalities for Unlawful Google Workspace for Education Use

   Following the EDPB's 2022 coordinated cloud-services enforcement action, Iceland's DPA fined Garðabær (€16,590), Hafnarfjörður (€18,580), and Reykjanesbær (€16,590) for transferring pupils' data to the US without adequate safeguards, establishing a precedent on public-sector cloud security compliance.

   European Data Protection Board (EDPB)

2. 1 Jul 2023Enforcement
   Persónuvernd Fines Creditinfo Lánstraust €253,400 for Unlawful Credit-Data Processing

   Iceland's data protection authority issued its largest-ever GDPR fine against credit bureau Creditinfo Lánstraust hf. for processing personal financial data without a sufficient legal basis, following a complaint from the Consumers' Association of Iceland.

   DataGuidance / Persónuvernd

3. 15 Jul 2018Law · official
   Data Protection Act No. 90/2018 Enters Into Force, GDPR Implemented via EEA Agreement

   Following the EEA Joint Committee Decision of 6 July 2018, Iceland enacted Act No. 90/2018 to implement the GDPR, empowering Persónuvernd as the independent supervisory authority and imposing GDPR-equivalent data-security, breach-notification, and data-subject rights obligations on all controllers.

   Ísland.is (Official Government of Iceland Portal)

Sources

1. 1.personuvernd.is/
2. 2.gamli.personuvernd.is/information-in-english/about-us/
3. 3.dlapiperdataprotection.com/index.html?t=law&c=IS
4. 4.dlapiperdataprotection.com/index.html?t=enforcement&c=IS
5. 5.edpb.europa.eu/our-work-tools/our-documents/member-state/iceland_en
6. 6.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-iceland
7. 7.linklaters.com/en/insights/data-protected/data-protected---iceland
8. 8.grip.globalrelay.com/icelands-dpa-signals-continued-focus-on-cybersecurity-health-data-and
9. 9.dataguidance.com/news/iceland-pers%C3%B3nuvernd-releases-new-rules-electronic