Understanding Act on Privacy and Processing of Personal Data No. 90/2018: A Comprehensive Guide

· About Act on Privacy and Processing of Personal Data No. 90/2018

Key Takeaways

  • Act No. 90/2018 is Iceland’s national data protection law implementing the GDPR in the EEA context, and it has been in force since 15 July 2018.[1][3]
  • Persónuvernd (the Icelandic Data Protection Authority) enforces the Act and supervises processing by public bodies, companies, and other controllers and processors operating in Iceland.[1][9]
  • The Act applies broadly to controllers and processors in Iceland and also reaches certain outside-Iceland processing where Icelandic law or EEA GDPR rules apply through the Act’s territorial and sectoral provisions.[1][13]
  • The law retains the GDPR’s administrative-fine framework, including penalties of up to EUR 20 million or 4% of worldwide annual turnover for the most serious infringements, with lower caps for lesser breaches.[7]
  • Icelandic authorities continue updating related sector laws in 2025–2026, but the core Act 90/2018 remains the governing privacy statute and the official consolidated text was updated in the law gazette as of 1 September 2026.[1][4]
  • For sensitive categories such as genetic and biometric data, research processing, and automated decision-making, Iceland follows GDPR-style safeguards and national supplements rather than creating a separate standalone regime.[1][6][13]

What It Is

Act on Privacy and Processing of Personal Data No. 90/2018 is Iceland’s main data protection statute. It implements the GDPR into Icelandic law and fills in national rules where the GDPR allows member states and EEA states to legislate on enforcement structure, exemptions, criminal offences, public-sector processing, and certain special categories of data.[1][3][13]

The Act is enforced by Persónuvernd, the independent supervisory authority. The official English translation states that the Act entered into force on 15 July 2018, while the parliamentary enactment date was 27 June 2018.[2][3][9]

The current consolidated law text was published in the official legal database on 1 September 2026, with the page last updated on 4 September 2026.[1] Public sources available in 2025–2026 indicate continuing amendments in adjacent sectors, but no source identified a wholesale replacement of Act 90/2018 as of September 2026.[1][4][5]

Who Must Comply

The Act applies to processing of personal data by controllers and processors in Iceland, including public authorities and private entities.[1][9][13] It is the domestic legal framework for GDPR compliance in Iceland and therefore covers routine business processing, HR, customer data, surveillance, health data, and research processing unless a specific exemption applies.[1][13]

It also covers some processing activities with extraterritorial effect through the GDPR framework incorporated into Icelandic law, meaning organisations outside Iceland can be caught where they target individuals in Iceland or otherwise fall within the GDPR territorial scope as implemented domestically.[1][3][13]

The law includes special rules and derogations for matters such as public-interest processing, research, and certain sector-specific processing. The official materials also note that the Data Protection Authority may require authorisation for some high-risk processing carried out for public-interest purposes.[13]

Exemptions are not a general opt-out from privacy law; rather, they are narrow statutory derogations for journalistic, academic, artistic, and other GDPR-recognised purposes, plus specific Icelandic sector rules and authorisation mechanisms.[1][13]

Core Requirements

  1. Lawful basis and transparency. Controllers must process personal data on a recognised legal basis and provide the required notices to individuals when data is collected from them or obtained from another source.[13]
  1. Purpose limitation and data minimisation. Data may be used only for defined and legitimate purposes, and only to the extent necessary for those purposes, in line with the GDPR principles incorporated by the Act.[1][3]
  1. Special category safeguards. Processing of sensitive data, including genetic and biometric data, requires a lawful basis and enhanced safeguards, with national rules supporting stricter handling where the GDPR permits it.[1][6]
  1. Rights handling. Controllers must support data subject rights, including access, rectification, erasure, restriction, portability, and objection, subject to the Act’s specific national derogations and limitations.[1][13]
  1. Automated decision-making controls. The Act preserves GDPR-style restrictions on decisions based solely on automated processing, including profiling, and requires suitable safeguards where such processing is permitted.[1][3][6]
  1. Security and breach response. Controllers and processors must implement appropriate technical and organisational measures and notify breaches to the supervisory authority where the GDPR threshold is met, subject to Icelandic procedural rules and sector-specific overlays.[1][4][7]
  1. Research processing rules. Processing for research purposes is permitted only under the Act’s conditions and related safeguards, reflecting Iceland’s special approach to health, academic, and scientific research data.[1][13]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Act adopted | 27 June 2018 | Parliament enacted Act No. 90/2018.[2] | | Act entered into force | 15 July 2018 | Core Icelandic data protection statute became operational.[3] | | Consolidated law page updated | 1 September 2026 | Official consolidated text current in the legal database.[1] | | Latest visible update on official law page | 4 September 2026 | Indicates the law text was maintained after the 1 September 2026 consolidation.[1] |

Maximum fines and sanctions: The penalty framework tracks the GDPR model. Lesser infringements can reach EUR 10 million or 2% of worldwide annual turnover, while the most serious violations can reach EUR 20 million or 4% of worldwide annual turnover.[7] Other sanctions can include orders to stop processing, corrective measures, and case-specific constraints imposed by Persónuvernd under the Act.[1][9][13]

How to Comply

  1. Map all processing and controllers. Build a complete inventory of processing activities, systems, categories of data, recipients, transfers, retention periods, and legal bases. This is the foundation for both GDPR-style accountability and Icelandic supervisory review.[1][13]
  1. Classify sensitive and high-risk processing. Flag genetic, biometric, health, research, surveillance, and automated decision-making uses early, because these trigger heightened scrutiny and sometimes authorisation or special safeguards under the Act.[1][6][13]
  1. Align governance to ISO 27001 and NIST CSF 2.0. Use ISO 27001 for an information security management system and NIST CSF 2.0 for risk governance, detection, response, and recovery; both map well to the Act’s security and breach-management expectations.[1][7]
  1. Add AI and automated decision controls. Use ISO 42001 to formalise AI governance, including data provenance, human oversight, bias review, and documentation for profiling or automated decisions, which fits Iceland’s GDPR-based restrictions on solely automated decisions.[1][3][6]
  1. Refresh notices and rights workflows. Ensure privacy notices cover the controller identity, purposes, legal basis, retention, recipients, transfers, and rights handling, and make sure inbound rights requests are triaged within statutory timeframes and exceptions.[13]
  1. Implement breach playbooks. Define internal escalation, evidence preservation, legal review, and notification decision trees so that reportable breaches can be assessed quickly against the Icelandic/GDPR threshold and sector rules.[1][4][7]
  1. Document research and special-purpose approvals. For scientific, health, or public-interest research, keep a written basis for necessity, minimisation, access controls, and any approvals or authorisations required by sector law or Persónuvernd practice.[1][13]

Related Regulations

The GDPR is the central instrument that Act 90/2018 implements domestically, so most Icelandic compliance questions are solved by reading the Act together with the GDPR.[1][3]

The EEA framework matters because Iceland applies EU GDPR concepts through its EEA obligations, making Iceland’s regime closely aligned with the wider European data protection model.[1][3]

The Health Records Act and related health-sector amendments can overlap with Act 90/2018 for breach handling, access rights, and medical-record duties, and 2025–2026 materials indicate lawmakers continue to clarify the division of responsibilities.[10]

The Electronic Monitoring and workplace-surveillance rules may conflict with general GDPR-style principles on proportionality and notice, so employers should reconcile surveillance settings with both privacy and labour obligations.[5]

The AI-related sector proposals and guidance discussed in 2025–2026 do not replace Act 90/2018, but they may influence how automated decision-making, training data, and governance are interpreted in practice.[4]

FAQ

Does Act 90/2018 apply to companies outside Iceland?

Yes, if their processing falls within the GDPR territorial scope as incorporated into Icelandic law. That typically includes offering goods or services to people in Iceland or monitoring their behaviour in ways that trigger GDPR jurisdiction.[1][3][13]

Does the Act cover genetic and biometric data?

Yes. These are treated as sensitive categories requiring enhanced safeguards and a valid legal basis, with national and GDPR rules working together rather than separately.[1][6]

Are research projects exempt?

No. Research is not an exemption from privacy law; it is a regulated purpose with specific conditions, safeguards, and, in some cases, authorisation or special handling rules.[1][13]

Can Persónuvernd fine companies?

Yes. The Act preserves an administrative-fine model aligned with the GDPR, including the higher-tier maximum of EUR 20 million or 4% of global turnover for serious breaches.[7][9]

Has the law changed in 2025 or 2026?

The consolidated official text was current and updated in early September 2026, and 2025–2026 sources show related sector amendments and guidance activity. No source located a full replacement of Act 90/2018, so it remains the core statute as of 6 September 2026.[1][4][5][10]

Sources

Put it into practice

More compliance guides