🇮🇸Act No. 90/2018 on Data Protection and the Processing of Personal Data

← Back to laws in Iceland

Iceland's GDPR implementation law

Act No. 90/2018 incorporates Regulation (EU) 2016/679 into Icelandic law through the EEA framework. The Act applies broadly to automated and structured manual processing and extends selected protections beyond the EEA Agreement's material scope.

Children, deceased persons and identifiers

Article 10 sets 13 as the Article 8 consent age and requires reasonable efforts to verify parental authorisation below that age. Article 4 applies the Act, as appropriate, to personal data of deceased people for five years after death and longer for information that can reasonably be expected to remain confidential. Article 13 permits use of the national identification number only for an objective purpose where necessary for secure identification.

Criminal data, monitoring and credit information

Article 12 limits public- and private-sector processing and disclosure of criminal-offence data to stated grounds, including explicit consent or clearly overriding legitimate interests. Article 14 requires an objective purpose for electronic monitoring, additional necessity for limited-access areas, prominent notice at workplaces and public places, controlled disclosure and deletion when retention is no longer justified. Article 15 makes credit-information operations and specified financial or creditworthiness processing for third-party disclosure subject to Persónuvernd licensing.

Expression and regulatory oversight

Article 6 balances privacy with journalism, art and literature and identifies the provisions that continue to apply to processing exclusively for those purposes. Persónuvernd may investigate, order corrective action, issue rules and impose sanctions under the Act and GDPR framework.