--- title: "Iceland Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/iceland/ source_html: /jurisdictions/iceland/index.html description: "Iceland data protection and privacy regulation: 10 categories, 83 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 48134e0c6aefca95c8da10b7a22cd0e3dac371d0ed1b8f32f2471639aaee4867 generator: "fe-fleet/md-twin@1.0" --- # Iceland Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Iceland Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 83 claims · 30 sources in the cumulative register Download report (PDF) Expand all Iceland's most significant data protection development this cycle sits in health-sector enforcement rather than in legislative change. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Controller/Processor Duties, AdTech & Commercial Privacy, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ICELAND)[Build Report](/reports/?j=ICELAND)[Compare](/compare/?j=ICELAND) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Persónuvernd (Icelandic Data Protection Authority) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-Q4 EDPB Coordinated Enforcement Framework erasure-rights report (Iceland participating) Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 83 Claims 11 Tier-1 sources Traffic-light mix 3 green 6 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Law made at European Economic Area (Bloc) level that applies in Iceland is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Iceland’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 805 Full executive summary 380 ###### Latest update · 4 November 2026 #### Lead Signal Iceland's Supreme Court reversed, in March 2026, administrative fines that Persónuvernd had imposed on five municipalities over their use of Google Workspace and Google Cloud services in schools. The court's stated basis for reversal was procedural rather than substantive: it found that the regulator had not proven sensitive data was in fact processed, not that no data-protection violation occurred. Persónuvernd's own recall decisions, issued following the ruling, state that the underlying violations identified against the municipalities remain unaffected by the court's decision. The practical effect is a narrowing of the enforceable fine rather than a vindication of the municipalities' data-handling practices, which is a materially different signal for any school or public-sector body relying on the same cloud services. #### Other Developments Persónuvernd's maximum administrative fine continues to follow the standard tiers under the GDPR framework as it applies in Iceland, running up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher. Separately, an independent fines-tracking aggregator reports that Persónuvernd has issued 66 recorded enforcement actions since 2020, totalling approximately EUR 1.2 million, though this figure has not been checked against the regulator's own enforcement register and should be read as indicative rather than official. #### Cross-Monitor Connections No material connections to adjacent regulatory domains arose from the enforcement developments. #### Outlook The authoritative status of the Supreme Court ruling, including whether it is under further appeal, has not yet been confirmed against a primary court or regulator source. Public bodies that received the reversed fines, and others relying on similar cloud arrangements, should expect the underlying compliance question to remain live even as the specific financial penalty has been set aside. 1 earlier update not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Iceland's most significant data protection development this cycle sits in health-sector enforcement rather than in legislative change. Persónuvernd is confirmed to have fined Primary Health Care in the Capital Area in February 2025 after the organisation granted eleven third parties access to a joint electronic medical records system covering approximately 195,000 individuals without the ministerial permission required for that access, a breach that had persisted for several years before it was addressed. This is a high-confidence, high-materiality finding: it demonstrates that Iceland has a genuine structural weak point in inter-institutional data-sharing controls within the health sector, one that went undetected or unaddressed for an extended period despite the scale of personal data involved. #### Other Developments Persónuvernd's enforcement powers remain at the GDPR-standard ceiling. The authority can impose fines up to EUR 20 million or 4% of annual global turnover for serious violations, the same penalty structure available to EU member-state supervisory authorities, underscoring that the health-sector fine sits within an enforcement framework with substantial headroom relative to the scale of the underlying breach. Two EU-level procedural and substantive reforms are approaching that will affect obligations relevant to Iceland once incorporated. The EU has adopted Regulation (EU) 2025/2518, laying down additional procedural rules for cross-border GDPR enforcement cooperation among EEA data protection authorities including Persónuvernd, applicable from April 2027. Separately, the EU's proposed Digital Omnibus (2025/0360 (COD)) would, if adopted, extend the deadline for notifying supervisory authorities of a breach from 72 to 96 hours, but only for high-risk breaches; this remains a proposal rather than a binding rule and has not yet taken effect. The EU AI Act's applicability to Iceland remains pending. Its incorporation into the EEA Agreement has not occurred, meaning no Icelandic AI-specific risk-assessment duty is currently in force under that instrument. #### Cross-Monitor Connections The pending EU AI Act incorporation is directly relevant to the artificial-intelligence monitor's coverage of Iceland: once incorporated via the EEA Agreement, Icelandic organisations would become subject to AI risk-assessment obligations that do not currently apply, a development the AI monitor should track for its own incorporation-timing assessment rather than this monitor re-analysing AI-specific risk methodology. The health-sector enforcement finding, while a data-protection matter in the first instance, may also be relevant to broader institutional-governance monitoring to the extent regulatory failures in inter-institutional data-sharing controls recur in other sectoral contexts, though this cycle's evidence is specific to the health sector and should not be generalised beyond it. #### Outlook Iceland's data-protection posture remains structurally stable at the level of its core framework, but three vectors are worth tracking going forward: the practical follow-through from the Persónuvernd health-sector fine, the April 2027 application of Regulation (EU) 2025/2518's cross-border enforcement procedures, and whether the Digital Omnibus proposal or the AI Act's EEA incorporation move from proposed or pending status toward adoption. None of these is confirmed to resolve on a specific date this cycle. This is intelligence-register orientation on the operating environment, not legal advice or a compliance instruction. Read full brief · 805 words ###### Latest update · 25 October 2026 #### Regulatory Status Iceland operates under a settled omnibus data protection framework, with active enforcement developments during this period. Personuvernd reprimanded Borgarholtsskoli on 7 July 2026 over unlawful retention of an anonymous tip naming a teacher, a case left unresolved on the question of deletion because public-records retention duties require the National Archivist's consent. Separately, reports indicate that Iceland's Supreme Court revoked five fines against municipalities over Google Workspace use in March 2026 on evidentiary grounds, while the underlying breach findings are reported to stand. On the broader enforcement record, a third-party tracker attributes 66 enforcement actions to Personuvernd since 2020, totalling approximately EUR 1.19 million in fines, including a EUR 257,427 fine against Creditinfo Lanstrausti hf in 2023; this figure is not drawn from the regulator's own published register and is reported with that caveat. #### Outlook The coming period will indicate whether the National Archivist consent process resolves the Borgarholtsskoli deletion question, and whether the evidentiary reasoning behind the Supreme Court's fine reversals shapes how Personuvernd substantiates future penalty decisions. 1 earlier update not shown here. ###### Standing brief · as of 23 August 2026 #### Regulatory Status Iceland's most material data-protection development this cycle is enforcement rather than legislative: Persónuvernd fined Primary Health Care in the Capital Area in February 2025 after the organisation granted eleven third parties unauthorised access to a joint electronic medical records system covering approximately 195,000 individuals, a breach persisting for several years. Persónuvernd's penalty ceiling for serious violations remains EUR 20 million or 4% of global turnover, the GDPR-standard maximum. Two EU-level instruments are on the near-term horizon: Regulation (EU) 2025/2518, applicable April 2027, formalising cross-border GDPR enforcement cooperation among EEA authorities; and the proposed Digital Omnibus (2025/0360 (COD)), which would extend high-risk breach-notification deadlines to 96 hours if adopted. Separately, the EU AI Act's incorporation into the EEA Agreement, and therefore its Icelandic applicability, remains pending. #### Outlook Iceland's core data-protection architecture is stable, but organisations should track the April 2027 application of Regulation (EU) 2025/2518, the progress of the Digital Omnibus proposal, and the timing of AI Act incorporation, alongside any follow-through from the health-sector enforcement action. This is illustrative orientation, not legal advice. Read full brief · 380 words Key regulatory facts for Iceland Regulatory Dimension Iceland Standing Position Jurisdiction Iceland (IS) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 83 sourced findings) Regulator & Framework GDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record. Lawful Processing & Special Data Directly enforced GDPR provisions with documented Icelandic case law across multiple sectors. Data Subject Rights Rights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland. Controller/Processor Duties Core obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among... Primary Instruments Cited DataGuidance, Persónuvernd (official translation), EDPS, European Data Protection Board, Clickport Last Confirmed / Updated 2026-11-04 (30 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Iceland: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record. Primary framework Act No. 90/2018 on Data Protection and the Processing of Personal Data (GDPR (EU) 2016/679 as incorporated into the EEA Agreement, Annex XI) Supervisory authority [Persónuvernd (Icelandic Data Protection Authority)](https://www.personuvernd.is) Traffic-light rationale — Green GDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record. #### Sub-modules (5) #### Regulator And AuthorityGreen Persónuvernd is the independent statutory DPA supervising GDPR/Act 90/2018 compliance. Claims (3): - Persónuvernd is Iceland's independent Data Protection Authority responsible for supervising compliance with Act No. 90/2018 and the GDPR as incorporated into Icelandic law, with powers to investigate and issue administrative fines against controllers and processors. - Persónuvernd — Iceland's Data Protection Authority, entirely distinct from the Central Bank's crypto/AML supervisory role - Personuvernd holds the full suite of GDPR Arts. 57 and 58 powers, including audits, access to premises, warnings, reprimands, orders and temporary or permanent processing bans. #### Act And InstrumentsGreen Act No. 90/2018 is the operative implementing statute, cited jointly with GDPR articles in all enforcement decisions. Claims (5): - Act No. 90/2018 on Data Protection and the Processing of Personal Data is Iceland's primary data protection statute, giving domestic effect to the GDPR and forming the joint legal basis cited alongside GDPR articles in Persónuvernd enforcement decisions. - Regulation (EU) 2016/679 (GDPR) — Act No. 90/2018, as taken up in the EEA Agreement - Persónuvernd — Iceland applies GDPR via EEA Joint Committee Decision No. 154/2018, implemented domestically by Act No. 90/2018, in force 15 July 2018 - Iceland applies the full GDPR through EEA Joint Committee Decision No. 154/2018 and Act No. 90/2018 on Data Protection, in force since 15 July 2018. - GDPR applies in Iceland via EEA incorporation and is implemented domestically by Act No. 90/2018, with Persónuvernd as the Article 51 supervisory authority. #### Material ScopeGreen Material scope mirrors GDPR via EEA Agreement Annex XI incorporation. Claims (1): - The GDPR was incorporated into the EEA Agreement (Annex XI) and applies comprehensively in Iceland as an EEA EFTA state, covering the same material scope of personal data processing as within the EU. #### Territorial ScopeGreen Comprehensive implementation gives Icelandic data subjects protection equivalent to EU Member States. Claims (1): - As an EEA EFTA state, Iceland has implemented EU data protection rules comprehensively such that individuals in Iceland benefit from the same level of protection as individuals in EU Member States. #### Regulator Registration And FilingAmber No general upfront registration regime; Persónuvernd instead operates an online breach-notification portal/form. Claims (1): - Persónuvernd operates a dedicated online notification portal/form through which controllers submit mandatory personal data breach notifications, rather than requiring general upfront processing-notification registration filings. Iceland is an EEA/EFTA state that has incorporated the GDPR into its domestic legal order via Act No. 90/2018 on Data Protection and the Processing of Personal Data, giving Persónuvernd (the Icelandic Data Protection Authority) enforcement powers materially equivalent to those of an EU Member State DPA. Sources and claims (11) - [DataGuidance](https://www.dataguidance.com/news/iceland-pers%C3%B3nuvernd-fines-city-reykjav%C3%ADk-isk-5m-use) — Persónuvernd is Iceland's independent Data Protection Authority responsible for supervising compliance with Act No. 90/2018 and the GDPR as incorporated into Icelandic law, with powers to investigate and issue administrative fines against controllers and processors. - [Persónuvernd (official translation)](https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_) — Act No. 90/2018 on Data Protection and the Processing of Personal Data is Iceland's primary data protection statute, giving domestic effect to the GDPR and forming the joint legal basis cited alongside GDPR articles in Persónuvernd enforcement decisions. - [EDPS](https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en) — The GDPR was incorporated into the EEA Agreement (Annex XI) and applies comprehensively in Iceland as an EEA EFTA state, covering the same material scope of personal data processing as within the EU. - [EDPS](https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en) — As an EEA EFTA state, Iceland has implemented EU data protection rules comprehensively such that individuals in Iceland benefit from the same level of protection as individuals in EU Member States. - [European Data Protection Board](https://www.edpb.europa.eu/notify-data-breach_en) — Persónuvernd operates a dedicated online notification portal/form through which controllers submit mandatory personal data breach notifications, rather than requiring general upfront processing-notification registration filings. - [Clickport](https://clickport.io/blog/privacy-analytics-iceland) — Regulation (EU) 2016/679 (GDPR) — Act No. 90/2018, as taken up in the EEA Agreement - [CookieFines.eu](https://cookiefines.eu/countries/is) — Persónuvernd — Iceland's Data Protection Authority, entirely distinct from the Central Bank's crypto/AML supervisory role - [Recording Law](https://recording-law.vercel.app/world-laws/world-data-privacy-laws/iceland-data-privacy-laws/) — Persónuvernd — Iceland applies GDPR via EEA Joint Committee Decision No. 154/2018, implemented domestically by Act No. 90/2018, in force 15 July 2018 - [https://ksandk.com/privacy-review/map/iceland/](https://ksandk.com/privacy-review/map/iceland/) — Personuvernd holds the full suite of GDPR Arts. 57 and 58 powers, including audits, access to premises, warnings, reprimands, orders and temporary or permanent processing bans. - [https://www.recordinglaw.com/world-laws/world-data-privacy-laws/iceland-data-privacy-laws/](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/iceland-data-privacy-laws/) — Iceland applies the full GDPR through EEA Joint Committee Decision No. 154/2018 and Act No. 90/2018 on Data Protection, in force since 15 July 2018. - [RecordingLaw](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/iceland-data-privacy-laws/) — GDPR applies in Iceland via EEA incorporation and is implemented domestically by Act No. 90/2018, with Persónuvernd as the Article 51 supervisory authority. ### Iceland: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Directly enforced GDPR provisions with documented Icelandic case law across multiple sectors. Primary framework Act No. 90/2018 (Arts. 6-9, 18) read with GDPR Arts. 5-9 Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Green Directly enforced GDPR provisions with documented Icelandic case law across multiple sectors. D2 · Lawful Processing — Full Module Record 4 sub-modules · 29 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland. Primary framework GDPR Arts. 12-22 as incorporated via Act No. 90/2018 Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Green Rights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland. #### Sub-modules (5) #### Access RightGreen Article 15 access right enforced; EEA-wide 2025 CEF action examined right-of-access implementation. Claims (2): - Persónuvernd participates as an EEA supervisory authority within the EDPB's Coordinated Enforcement Framework, which ran a 2025 action examining controllers' implementation of the right of access under Article 15 GDPR. - Individuals in Iceland hold the full set of GDPR Chapter III data-subject rights, enforceable through complaints to Persónuvernd or the Icelandic courts. #### Rectification And ErasureAmber Article 17 GDPR erasure right subject to 2025-26 EDPB coordinated action across EEA DPAs. Claims (1): - The EDPB launched a coordinated action in 2025-2026 on the right to erasure (Article 17 GDPR) applicable to participating EEA supervisory authorities, with a report on outcomes expected to be adopted in the coming months. #### Restriction And ObjectionAmber Article 18(1) Act 90/2018 disapplies restriction/objection rights for research-only processing, subject to safeguards. Claims (1): - Article 18(1) of Act No. 90/2018 disapplies the rights to access, rectification, restriction of processing, and objection where personal data are processed exclusively for research or statistical purposes, subject to safeguards. #### Data PortabilityAmber Article 20 GDPR portability applies without a documented Icelandic-specific derogation. Claims (1): - The right to data portability under GDPR Article 20 applies directly in Iceland via incorporation of the GDPR through Act No. 90/2018, without a documented Icelandic-specific derogation identified in available sources. #### Deadlines And Response WindowsAmber Standard one-month (extendable) GDPR response window applies; no Iceland-specific modification found. Claims (1): - Controllers in Iceland must respond to data subject rights requests within the GDPR's standard one-month period (extendable by up to two further months for complex requests), incorporated without modification via Act No. 90/2018. Access, rectification/erasure, restriction/objection, and portability rights apply per GDPR Arts. 13-22 via Act No. 90/2018, subject to a research-purpose carve-out under Article 18(1) of the Act; no Iceland-specific deviation from GDPR's standard response deadlines was located. Sources and claims (6) - [European Data Protection Board](https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en) — Persónuvernd participates as an EEA supervisory authority within the EDPB's Coordinated Enforcement Framework, which ran a 2025 action examining controllers' implementation of the right of access under Article 15 GDPR. - [European Data Protection Board](https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en) — The EDPB launched a coordinated action in 2025-2026 on the right to erasure (Article 17 GDPR) applicable to participating EEA supervisory authorities, with a report on outcomes expected to be adopted in the coming months. - [European Data Protection Board](https://www.edpb.europa.eu/system/files/documents/2022-01/legalstudy_on_the_appropriate_safeguards_89.1.pdf) — Article 18(1) of Act No. 90/2018 disapplies the rights to access, rectification, restriction of processing, and objection where personal data are processed exclusively for research or statistical purposes, subject to safeguards. - [Persónuvernd (official translation)](https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_) — The right to data portability under GDPR Article 20 applies directly in Iceland via incorporation of the GDPR through Act No. 90/2018, without a documented Icelandic-specific derogation identified in available sources. - [Persónuvernd (official translation)](https://www.personuvernd.is/media/uncategorized/Act_No_90_2018_on_Data_Protection_and_the_Processing_of_Personal_) — Controllers in Iceland must respond to data subject rights requests within the GDPR's standard one-month period (extendable by up to two further months for complex requests), incorporated without modification via Act No. 90/2018. - [RecordingLaw](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/iceland-data-privacy-laws/) — Individuals in Iceland hold the full set of GDPR Chapter III data-subject rights, enforceable through complaints to Persónuvernd or the Icelandic courts. ### Iceland: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among controllers. Primary framework GDPR Arts. 24-35 / Act No. 90/2018 Arts. 24-35 Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Amber Core obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among controllers. Periodic update · new data 2026-10-25 #### Controller/Processor Duties As at 7 July 2026, Personuvernd issued a reprimand to Borgarholtsskoli for breaching data protection law by storing an anonymous tip naming a teacher without an adequate legal basis. The finding is a reprimand rather than a fine, but it carries a notable limitation: the regulator could not order deletion of the material because public-records retention duties require the consent of the National Archivist before disposal can proceed. The case sets out, in concrete terms, a structural conflict that controllers in Iceland's public sector face between data-minimisation and lawfulness obligations on one side and statutory records-preservation duties on the other. Where a public body is subject to archival retention law, a finding that data was unlawfully stored does not, on its own, translate into an enforceable deletion remedy; a separate consent process sits between the breach finding and any disposal of the material. #### Outlook How Personuvernd and the National Archivist resolve the practical question of deletion in the Borgarholtsskoli matter will be instructive for any other public-sector controller holding material found to lack a lawful basis for retention, since the same statutory consent requirement would apply in comparable cases. D4 · Controller & Processor — Full Module Record 7 sub-modules · 34 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is fully harmonised (green) but enforcement shows recurring onward-transfer risk findings (amber) in ed-tech/cloud processing. Primary framework GDPR Arts. 44-49 as incorporated via Act No. 90/2018 and EEA Agreement Annex XI Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Amber Framework is fully harmonised (green) but enforcement shows recurring onward-transfer risk findings (amber) in ed-tech/cloud processing. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 40 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong evidence in education and health; gaps in financial, telecoms, credit, and insurance sub-modules necessitate primary-source escalation. Primary framework GDPR/Act No. 90/2018 general framework; no distinct sectoral statutes identified beyond education/health case law Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Amber Strong evidence in education and health; gaps in financial, telecoms, credit, and insurance sub-modules necessitate primary-source escalation. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 34 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Framework exists in principle (GDPR incorporation) but no dedicated Icelandic enforcement or guidance evidence found for most adtech sub-modules. Primary framework GDPR consent/legitimate-interest and Art. 21 objection rights as incorporated via Act No. 90/2018 Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Red Framework exists in principle (GDPR incorporation) but no dedicated Icelandic enforcement or guidance evidence found for most adtech sub-modules. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 38 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Genetic data and emerging AI-related engagement are evidenced; biometric regime and surveillance carve-outs remain gaps requiring primary-source escalation. Primary framework GDPR Arts. 9, 22 as incorporated via Act No. 90/2018 Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Amber Genetic data and emerging AI-related engagement are evidenced; biometric regime and surveillance carve-outs remain gaps requiring primary-source escalation. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Iceland's position on algorithmic and AI-specific governance is shaped, at this stage, by what has not yet happened rather than by a settled domestic rule. The EU AI Act, Regulation (EU) 2024/1689, has not been incorporated into the EEA Agreement as at the current research date. The instrument remains under scrutiny by the EEA EFTA states, with a draft Joint Committee Decision reported as pending but not adopted. Until that incorporation occurs, the AI Act's obligations do not bind Icelandic entities in the way they already bind entities within the EU itself, and Iceland's algorithmic-governance landscape continues to rest on the general GDPR framework rather than on AI-specific rules. That is not to say the space is without regulatory attention. Persónuvernd's Director General is reported to have stated publicly, on 16 September 2026, that a new type of AI-assisted recording device raises privacy questions. The statement is clearly attributed to the regulator and reported by a domestic press source, giving it a reasonably assertive evidentiary basis notwithstanding that it is a public statement rather than a formal decision or guidance document. It indicates that Persónuvernd is monitoring AI-adjacent developments and is prepared to raise concerns under its existing GDPR supervisory mandate even where no AI-specific statute yet applies domestically. The combination of these two findings describes a jurisdiction in a holding pattern on AI-specific law, but not in one on supervisory attention: the hard legal framework is pending EEA-level action outside Iceland's own control, while Iceland's domestic regulator is already signalling where it expects future scrutiny to land, specifically AI-assisted recording and surveillance technology. #### Outlook The decisive event to watch is adoption of the EEA Joint Committee Decision incorporating the AI Act, which would convert the current non-binding watch posture into an enforceable domestic framework on a timetable set by that decision. In the interim, further public statements or informal guidance from Persónuvernd on AI-assisted recording or similar surveillance technologies are a plausible next marker, continuing the pattern already set by the Director General's September 2026 remarks. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 44 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong, repeated education-sector enforcement (green signal) offset by gaps in age-verification, minor-profiling, and dependent-adult sub-modules (red signal), yielding an overall amber rating. Primary framework GDPR Art. 8 / Act No. 90/2018 special-category provisions on children's data Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Amber Strong, repeated education-sector enforcement (green signal) offset by gaps in age-verification, minor-profiling, and dependent-adult sub-modules (red signal), yielding an overall amber rating. D9 · Children's Privacy — Full Module Record 5 sub-modules · 41 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Iceland: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Active enforcement and appeal pathways exist (green signal) but self-reported capacity constraints and unresolved collective-redress/private-right-of-action gaps (amber/red signals) temper the overall rating. Primary framework GDPR Arts. 77-84 / Act No. 90/2018 enforcement provisions Supervisory authority [Persónuvernd](https://www.personuvernd.is) Traffic-light rationale — Amber Active enforcement and appeal pathways exist (green signal) but self-reported capacity constraints and unresolved collective-redress/private-right-of-action gaps (amber/red signals) temper the overall rating. Periodic update · new data 2026-11-04 #### Enforcement & Redress Iceland's Supreme Court reversed, in March 2026, fines that Persónuvernd had imposed on five municipalities for their use of Google Workspace and Google Cloud services within schools. The court's ground for reversal was that the regulator had not established, to the required standard, that sensitive personal data was in fact processed through those services — a proof failure rather than a substantive clearance. Persónuvernd issued recall decisions following the judgment, and those decisions state in terms that the underlying violations found against the municipalities remain unaffected by the court's reasoning. Read together, the ruling narrows what the regulator could collect in penalties for this specific episode without disturbing its underlying finding that a violation occurred. Persónuvernd's enforcement powers otherwise continue to rest on the standard tiered maximum, running up to EUR 20 million or 4% of annual worldwide turnover, whichever figure is higher. An independent fines-tracking aggregator separately reports a cumulative total of 66 recorded enforcement actions since 2020, amounting to roughly EUR 1.2 million, though this tally comes from a third-party tracker rather than the regulator's own published register and carries correspondingly less weight. #### Outlook Whether the Supreme Court's ruling is subject to further appeal, and what if anything a primary court filing or a Persónuvernd statement adds beyond the recall decisions already issued, remains to be established. For public-sector bodies and schools using the same cloud services, the practical compliance question — whether sensitive data is in fact processed and under what legal basis — stays open regardless of the financial outcome of this particular case. Periodic update · new data 2026-10-25 #### Enforcement & Redress Personuvernd's enforcement activity in Iceland combines an active regulator with a judiciary willing to intervene on evidentiary grounds. The Borgarholtsskoli reprimand of 7 July 2026, addressing unlawful retention of an anonymous tip naming a teacher, sits within this active enforcement picture, even though the regulator's remedy there was constrained by public-records consent requirements rather than resulting in a fine. A third-party tracker reports that Personuvernd has taken 66 enforcement actions since 2020, totalling approximately EUR 1.19 million in fines, with a EUR 257,427 fine against Creditinfo Lanstrausti hf in 2023 cited as the largest individual penalty in that period. This figure is drawn from an aggregator rather than from Personuvernd's own published enforcement register, so it should be treated as an indicative volume rather than an authoritative count. Taken together with the Supreme Court's March 2026 reversal of five Google Workspace-related fines on evidentiary grounds, the picture is one of a regulator that is active in bringing cases but subject to a judiciary that checks the evidentiary basis for the penalties it imposes. #### Outlook Whether the evidentiary standard applied in the Google Workspace reversals becomes a durable constraint on Personuvernd's fining practice, or proves specific to that set of cases, is the open question for the enforcement record going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 54 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties