Act on Privacy and Processing of Personal Data No. 90/2018
Iceland's implementation of GDPR principles, with additional requirements specific to the country's context. Establishes comprehensive data protection requirements, including specific provisions for automated decision-making and profiling. Includes enhanced protections for genetic and biometric data, and special considerations for research data processing.
| Jurisdiction | Iceland |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Latest development |
Analysis
Key Requirements
Iceland's Act on Privacy and Processing of Personal Data No. 90/2018 implements GDPR principles with additional country-specific requirements. The main requirements include:
- Lawful basis for processing: Personal data must be processed fairly, lawfully, and for legitimate purposes, with only the minimum necessary data collected Central Bank of Iceland
- Data subject rights: Individuals have the right to access, correct, delete, and obtain copies of their personal data, as well as opt-out of targeted advertising or data sales Osano
- Data protection impact assessments: Controllers must conduct assessments for high-risk processing activities, including targeted advertising, data sales, and processing of sensitive data DLA Piper
- Enhanced protections for sensitive data: Special safeguards are required for processing genetic, biometric, and other sensitive personal information ICO GDPR Guide
- Automated decision-making restrictions: Specific limitations and safeguards apply to automated processing, including profiling, that produces legal or similarly significant effects DLA Piper
- Data breach notification: Controllers must notify the Icelandic Data Protection Authority of breaches, with some exceptions for national security or criminal investigations CaseGuard
Compliance Challenges
Organizations often face several challenges when complying with Iceland's data protection law:
- Implementing data subject rights: Ensuring systems can efficiently handle access, correction, and deletion requests Osano
- Conducting thorough data protection impact assessments: Properly identifying and mitigating risks in high-risk processing activities DLA Piper
- Managing international data transfers: Navigating complex requirements for transferring data outside of Iceland and the EEA ICO GDPR Guide
- Ensuring compliance across diverse data processing activities: Adapting practices across various business functions and third-party relationships CaseGuard
Implementation Best Practices
To effectively implement the Act's requirements, organizations should:
- Conduct a comprehensive data mapping exercise to identify all personal data processing activities ICO GDPR Guide
- Implement robust consent management systems for collecting and tracking user preferences Osano
- Develop clear policies and procedures for handling data subject requests and breach notifications DLA Piper
- Regularly train employees on data protection principles and organizational procedures Central Bank of Iceland
- Utilize data protection impact assessment tools and frameworks, such as those provided by the Icelandic Data Protection Authority
Recent Updates
As of February 2025, there have been no major recent updates to the Act. However, organizations should:
- Monitor the Icelandic Data Protection Authority website for any new guidance or interpretations
- Stay informed about broader GDPR developments that may impact Iceland's implementation, such as through the European Data Protection Board
Related Regulations
Iceland's Act on Privacy and Processing of Personal Data interacts with several related regulations:
- GDPR: As an EEA member, Iceland's law closely aligns with and implements GDPR requirements CaseGuard
- ePrivacy Directive: Complements data protection law in the electronic communications sector European Commission
- NIS Directive: Addresses cybersecurity aspects that may overlap with data protection concerns ENISA
Industry Impact
The Act has significant impacts across various industries:
- Financial Services: Enhanced requirements for protecting sensitive financial data and implementing strong customer authentication Central Bank of Iceland
- Healthcare: Strict controls on processing health data, genetic information, and conducting medical research ICO GDPR Guide
- Technology and E-commerce: Increased focus on user consent, data minimization, and restrictions on profiling and automated decision-making Osano
- Research and Academia: Special considerations for processing personal data in scientific, historical, and statistical research contexts DLA Piper
Sources
- Central Bank of Iceland - Personal Data Protection
- Osano - Data Privacy Laws
- DLA Piper - Data Protection Laws in Iceland
- ICO - Guide to the General Data Protection Regulation (GDPR)
- CaseGuard - Iceland's New Data Protection Law and GDPR Implementation
- Icelandic Data Protection Authority
- European Data Protection Board
- European Commission - ePrivacy Regulation
- ENISA - NIS Directive
Recent developments
- — Recent amendments to Iceland's Health Records Act reference Act No. 90/2018 on Data Protection and Processing of Personal Data, clarifying roles between the Data Protection Authority and Directorate of Health to avoid duplication in handling breaches; from December 1, 2026, digital medical records become compulsory with enhanced patient access rights to certain data.[1] (source)
Read the full guide to Act on Privacy and Processing of Personal Data No. 90/2018
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: GDPR policy generator (generatepolicy.com)
- Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
- Build it yourself: Privacy Dual Coverage Bundle (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates