{
 "jurisdiction_id": "IS",
 "jurisdiction": "Iceland",
 "url": "https://dataprotection.gi/jurisdictions/iceland/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 57,
  "sub_modules": 57,
  "source_register": 16
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "green",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "GDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record.",
   "claims": [
    {
     "statement": "Persónuvernd is Iceland's independent Data Protection Authority responsible for supervising compliance with Act No. 90/2018 and the GDPR as incorporated into Icelandic law, with powers to investigate and issue administrative fines against controllers and processors.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Act No. 90/2018 on Data Protection and the Processing of Personal Data is Iceland's primary data protection statute, giving domestic effect to the GDPR and forming the joint legal basis cited alongside GDPR articles in Persónuvernd enforcement decisions.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The GDPR was incorporated into the EEA Agreement (Annex XI) and applies comprehensively in Iceland as an EEA EFTA state, covering the same material scope of personal data processing as within the EU.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "EDPS",
     "source_url": "https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "As an EEA EFTA state, Iceland has implemented EU data protection rules comprehensively such that individuals in Iceland benefit from the same level of protection as individuals in EU Member States.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "EDPS",
     "source_url": "https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd operates a dedicated online notification portal/form through which controllers submit mandatory personal data breach notifications, rather than requiring general upfront processing-notification registration filings.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/notify-data-breach_en",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "green",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Directly enforced GDPR provisions with documented Icelandic case law across multiple sectors.",
   "claims": [
    {
     "statement": "Persónuvernd enforcement decisions confirm that lawfulness of processing under Article 6 GDPR (as applied via Act No. 90/2018) is directly enforceable, including in the City of Reykjavík Seesaw decision where Article 6 GDPR was found violated.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd applies GDPR Article 7 consent-validity conditions directly, as demonstrated in its fine against the Ministry of Industries and Innovation and YAY ehf. for the digital gift-card app, which cited Article 7 (conditions for consent) among the infringements.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/news/national-news/2021/icelandic-dpa-issues-fine-ministry-industries-and-innovation-and-yay-ehf_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Article 8 of Act No. 90/2018 provides enhanced protections for special categories of personal data, including children's data, as applied in Persónuvernd's fine against the City of Reykjavík for violations of Article 8(1) subparagraphs of the Act concerning student data in the Seesaw system.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Article 18(1) of Act No. 90/2018 permits derogations from certain GDPR data-subject rights where personal data are processed solely for research or statistical purposes, subject to pseudonymisation/separation safeguards.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/system/files/documents/2022-01/legalstudy_on_the_appropriate_safeguards_89.1.pdf",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "green",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Rights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland.",
   "claims": [
    {
     "statement": "Persónuvernd participates as an EEA supervisory authority within the EDPB's Coordinated Enforcement Framework, which ran a 2025 action examining controllers' implementation of the right of access under Article 15 GDPR.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The EDPB launched a coordinated action in 2025-2026 on the right to erasure (Article 17 GDPR) applicable to participating EEA supervisory authorities, with a report on outcomes expected to be adopted in the coming months.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Article 18(1) of Act No. 90/2018 disapplies the rights to access, rectification, restriction of processing, and objection where personal data are processed exclusively for research or statistical purposes, subject to safeguards.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/system/files/documents/2022-01/legalstudy_on_the_appropriate_safeguards_89.1.pdf",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The right to data portability under GDPR Article 20 applies directly in Iceland via incorporation of the GDPR through Act No. 90/2018, without a documented Icelandic-specific derogation identified in available sources.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Controllers in Iceland must respond to data subject rights requests within the GDPR's standard one-month period (extendable by up to two further months for complex requests), incorporated without modification via Act No. 90/2018.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Core obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among controllers.",
   "claims": [
    {
     "statement": "Persónuvernd found the City of Reykjavík in violation of Article 35(1) GDPR (DPIA obligation) and Article 25(1)/(3) (data protection by design) in its use of the Seesaw educational system, resulting in a fine of ISK 5 million.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd found that the City of Reykjavík's DPO failed to be involved in an appropriate and timely manner, lacked adequate independence, and had unresolved conflicts of interest, in violation of Article 35(3) of Act No. 90/2018 and Articles 38 and 39 GDPR.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-investigates-city-reykjav%C3%ADks",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Records-of-processing obligations under GDPR Article 30 apply to controllers and processors in Iceland via direct incorporation through Act No. 90/2018, and Persónuvernd has published templates for data processing agreements and records of processing to support compliance.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/sites/default/files/is_sa_gdpr_art_97questionnaire.pdf",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd's enforcement action against the Ministry of Industries and Innovation and YAY ehf. addressed processor-contract obligations under Article 28(3) GDPR in the context of a government-vendor digital gift-card processing arrangement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/news/national-news/2021/icelandic-dpa-issues-fine-ministry-industries-and-innovation-and-yay-ehf_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd fined a company operating ice cream parlours for failing to implement adequate security and transparency measures around employee video surveillance, finding infringements of Article 13 GDPR and related security/transparency provisions.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/news/national-news/2021/icelandic-dpa-has-fined-company-running-ice-cream-parlours-processing_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd operates a dedicated online breach-notification form and fined InfoMentor ISK 3.5 million for a security failure resulting in a breach affecting 424 children's personal data on an education platform.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-infomentor-isk-35m-student",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd's decision against the City of Reykjavík found violations of Article 17(1) of Act No. 90/2018 (data retention/erasure obligations) in connection with the Seesaw educational system.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "amber",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "Framework is fully harmonised (green) but enforcement shows recurring onward-transfer risk findings (amber) in ed-tech/cloud processing.",
   "claims": [
    {
     "statement": "Persónuvernd found that the City of Reykjavík's use of the Seesaw system created a high risk of personal data being transferred to the United States and processed without adequate protection, in violation of Articles 32, 35(1), and 46 GDPR.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Because the GDPR and its related adequacy decisions are incorporated into the EEA Agreement, transfers of personal data from EU Member States to Iceland are not treated as third-country transfers and do not require a separate adequacy decision.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "EDPS",
     "source_url": "https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "As an EEA EFTA state applying the GDPR directly, Iceland does not issue independent third-country adequacy decisions of its own; it relies on European Commission adequacy decisions incorporated into the EEA Agreement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "EDPS",
     "source_url": "https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Standard Contractual Clauses and Binding Corporate Rules approved under the GDPR are directly available as transfer mechanisms for Icelandic controllers and processors by virtue of the GDPR's incorporation into the EEA Agreement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "EDPS",
     "source_url": "https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The Reykjavík Seesaw decision shows Persónuvernd expects controllers to assess and mitigate the risk of onward transfer to third countries such as the United States, consistent with a transfer-impact-assessment style analysis under GDPR Article 46.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No general data-localisation mandate beyond the GDPR's Chapter V cross-border transfer restrictions was identified for Iceland in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Strong evidence in education and health; gaps in financial, telecoms, credit, and insurance sub-modules necessitate primary-source escalation.",
   "claims": [
    {
     "statement": "Financial-sector personal data processing in Iceland appears to be governed by the general GDPR/Act No. 90/2018 framework without a distinct financial-sector data protection overlay identified in available guidance to date.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd found that Landspítali, Icelandic Genetics ehf., and Íslensk erfðagreining unlawfully processed COVID-19 patients' samples and data for genetic research without proper authorisation, in violation of Article 8 of Act No. 90/2018 and Article 5 GDPR.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-finds-processing-covid-19-personal",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The ePrivacy framework for electronic communications applies in Iceland as an EEA state, though no Iceland-specific ePrivacy/cookie enforcement decision was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd's fine against an ice-cream-parlour operator for unlawful employee video surveillance demonstrates active enforcement of employment-context data protection obligations, including transparency and proportionality requirements.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/news/national-news/2021/icelandic-dpa-has-fined-company-running-ice-cream-parlours-processing_en",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific credit-scoring or automated creditworthiness-assessment data protection finding was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd fined five municipalities a combined ISK 12.8 million over alleged improper processing of primary-school student data through Google Cloud's education technology services.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/iceland-dpa-issues-isk128m-in-edtech-fines/",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific insurance-sector data protection finding or overlay was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "Framework exists in principle (GDPR incorporation) but no dedicated Icelandic enforcement or guidance evidence found for most adtech sub-modules.",
   "claims": [
    {
     "statement": "Cookie and tracker consent requirements in Iceland derive from GDPR consent standards under Act No. 90/2018 operating alongside the ePrivacy framework, though no Iceland-specific cookie-enforcement decision was located in available sources.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific dark-pattern prohibition or enforcement decision was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific guidance on opt-out signals such as Global Privacy Control was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific guidance on data clean rooms or data-collaboration-room arrangements was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific cross-context advertising or 'sale'/'share' of personal data finding was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Direct marketing processing in Iceland is subject to GDPR consent/legitimate-interest standards and the right to object under Article 21 GDPR as incorporated via Act No. 90/2018; no Iceland-specific direct-marketing enforcement decision was identified.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Genetic data and emerging AI-related engagement are evidenced; biometric regime and surveillance carve-outs remain gaps requiring primary-source escalation.",
   "claims": [
    {
     "statement": "Article 22 GDPR profiling/automated-decision-making restrictions apply directly in Iceland via Act No. 90/2018, though no Iceland-specific Persónuvernd enforcement decision addressing Article 22 was located in available sources.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "General GDPR transparency duties regarding automated decision-making apply via Act No. 90/2018, though no dedicated Icelandic ADM-transparency enforcement case was identified in available sources.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd, together with other data protection and privacy authorities, co-signed a February 2026 joint statement on AI-generated imagery emphasising that AI content-generation systems must be developed and used in accordance with applicable data protection and privacy rules, with specific attention to risks facing children and vulnerable groups.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Supervisor / signatory authorities",
     "source_url": "https://www.edps.europa.eu/system/files/2026-02/23-02-26_joint-statement-ai-generated-imagery_en.pdf",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific biometric-data (facial recognition, fingerprint, gait) regime or enforcement decision was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd's decision regarding Landspítali, Icelandic Genetics, and Íslensk erfðagreining addressed unlawful processing of genetic/biological sample data for COVID-19 research, finding breaches of Article 8 of Act No. 90/2018 (special categories) and Article 5 GDPR.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-finds-processing-covid-19-personal",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific analysis of national-security or state-surveillance carve-outs from GDPR/Act No. 90/2018 was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Strong, repeated education-sector enforcement (green signal) offset by gaps in age-verification, minor-profiling, and dependent-adult sub-modules (red signal), yielding an overall amber rating.",
   "claims": [
    {
     "statement": "No Iceland-specific age-verification mechanism or Persónuvernd enforcement decision on age verification was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Act No. 90/2018 and the GDPR require parental consent for information-society services offered directly to children below the relevant age threshold, applied in Iceland via direct GDPR incorporation, though no Iceland-specific enforcement decision on the parental-consent threshold itself was located.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific ban or enforcement decision on profiling of minors was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd fined InfoMentor ISK 3.5 million after unauthorised parties accessed the personal data of 424 children through the company's education platform, treating children's data as meriting special protection under Act No. 90/2018.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-infomentor-isk-35m-student",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific dependent-adult (elderly/mentally incapacitated) data protection finding was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Speculative",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/iceland/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Active enforcement and appeal pathways exist (green signal) but self-reported capacity constraints and unresolved collective-redress/private-right-of-action gaps (amber/red signals) temper the overall rating.",
   "claims": [
    {
     "statement": "Persónuvernd has issued multiple administrative fines under Act No. 90/2018 and the GDPR, ranging from ISK 1.5 million to ISK 12.8 million in identified cases, exercising investigative and sanctioning powers analogous to Article 83 GDPR's maximum-fine provisions.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/iceland-dpa-issues-isk128m-in-edtech-fines/",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd's recent enforcement record includes fines against the City of Reykjavík (Seesaw), InfoMentor (education breach), an employer operating ice cream parlours (employee surveillance), the Ministry of Industries and Innovation/YAY ehf. (digital gift-card app), five municipalities (Google Cloud in schools), and an unlawfulness finding against Landspítali/Icelandic Genetics/Íslensk erfðagreining (COVID-19 genetic research).",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/iceland-dpa-issues-isk128m-in-edtech-fines/",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Persónuvernd has reported resource constraints, noting it is divided into sub-units of around 3-5 staff members each with limited backup capacity, while handling several hundred open cases (approximately 800 open registered cases as reported in its GDPR Article 97 evaluation questionnaire response).",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Board",
     "source_url": "https://www.edpb.europa.eu/sites/default/files/is_sa_gdpr_art_97questionnaire.pdf",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No Iceland-specific collective-redress or class-action mechanism for data protection claims was identified in available sources.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "Persónuvernd (official translation)",
     "source_url": "https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Data subjects in Iceland may lodge complaints with Persónuvernd and seek judicial remedies before Icelandic courts, including appeal of Persónuvernd decisions; a reported Icelandic Supreme Court ruling partially confirmed a Persónuvernd decision, evidencing an available judicial-review pathway.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/iceland-supreme-court-partially-confirms-personuvernd",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "In February 2026, Persónuvernd (represented by Data Protection Commissioner Helga Þórisdóttir and Head of International Affairs & Guidance Helga Sigríður Þórhallsdóttir) co-signed a multilateral joint statement with other data protection and privacy authorities addressing risks from AI-generated imagery, including harms to children and vulnerable groups.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "European Data Protection Supervisor / signatory authorities",
     "source_url": "https://www.edps.europa.eu/system/files/2026-02/23-02-26_joint-statement-ai-generated-imagery_en.pdf",
     "source_tier": null,
     "observed_at": null
    }
   ]
  }
 ]
}