IS-ACT-90-2018
Act No. 90/2018 on Data Protection and the Processing of Personal Data
Persónuvernd
🇮🇸Iceland
Skin
Iceland overview
Iceland combines the EEA GDPR with Act No. 90/2018
Iceland gives the GDPR legal force through Act No. 90/2018 and adds national rules on children, deceased persons, criminal-offence data, national identifiers, electronic monitoring, credit information, expression, research and regulatory procedure. Persónuvernd is the independent supervisory authority.
Important Icelandic overlays
A child may consent to a directly offered information-society service from age 13. The Act protects certain personal data of deceased persons for five years after death, or longer where confidentiality can reasonably be expected. Use of the Icelandic identification number must have an objective purpose and be necessary for secure identification.
Electronic monitoring must have an objective purpose; monitoring of areas normally used by a limited group requires a special operational need, prominent notice and purpose-bound retention. Operating credit-information services and processing financial or creditworthiness information for disclosure requires authorisation from Persónuvernd.
Key Iceland law
Act No. 90/2018 on Data Protection and the Processing of Personal Data - incorporates the EEA GDPR and provides Iceland-specific rules and enforcement.
What this means for you
Apply the GDPR and separately verify Iceland's age-13 rule, deceased-person protections, strict treatment of criminal data and kennitala, electronic-monitoring rules, credit-information licensing and Persónuvernd requirements.