Data Protection Monitor
Global Privacy & Data Protection Intelligence

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Iceland Data Protection & Privacy Regulation

IS schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence

Last updated · 10 categories · 83 claims · 30 sources in the cumulative register

Iceland's most significant data protection development this cycle sits in health-sector enforcement rather than in legislative change.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Controller/Processor Duties, AdTech & Commercial Privacy, Enforcement & Redress (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityPersónuvernd (Icelandic Data Protection Authority)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)2026-Q4EDPB Coordinated Enforcement Framework erasure-rights report (Iceland participating)
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Law made at European Economic Area (Bloc) level that applies in Iceland is covered once, on the European Economic Area (Bloc) page. This page covers Iceland’s own layer: implementation, national authorities, national options and local enforcement.

Jurisdiction brief

Latest update · 4 November 2026

Lead Signal

Iceland's Supreme Court reversed, in March 2026, administrative fines that Persónuvernd had imposed on five municipalities over their use of Google Workspace and Google Cloud services in schools. The court's stated basis for reversal was procedural rather than substantive: it found that the regulator had not proven sensitive data was in fact processed, not that no data-protection violation occurred. Persónuvernd's own recall decisions, issued following the ruling, state that the underlying violations identified against the municipalities remain unaffected by the court's decision. The practical effect is a narrowing of the enforceable fine rather than a vindication of the municipalities' data-handling practices, which is a materially different signal for any school or public-sector body relying on the same cloud services.

Key regulatory facts for Iceland
Regulatory DimensionIceland Standing Position
JurisdictionIceland (IS)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 83 sourced findings)
Regulator & FrameworkGDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record.
Lawful Processing & Special DataDirectly enforced GDPR provisions with documented Icelandic case law across multiple sectors.
Data Subject RightsRights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland.
Controller/Processor DutiesCore obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among...
Primary Instruments CitedDataGuidance, Persónuvernd (official translation), EDPS, European Data Protection Board, Clickport
Last Confirmed / Updated2026-11-04 (30 sources in cumulative register)

#

GDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record.

Primary frameworkAct No. 90/2018 on Data Protection and the Processing of Personal Data (GDPR (EU) 2016/679 as incorporated into the EEA Agreement, Annex XI)
Supervisory authorityPersónuvernd (Icelandic Data Protection Authority)
Traffic-light rationale — GreenGDPR is directly incorporated and actively enforced by a functioning DPA with a multi-year enforcement track record.

Sub-modules (5)

Regulator And AuthorityGreen

Persónuvernd is the independent statutory DPA supervising GDPR/Act 90/2018 compliance.

Claims (3):

  • Persónuvernd is Iceland's independent Data Protection Authority responsible for supervising compliance with Act No. 90/2018 and the GDPR as incorporated into Icelandic law, with powers to investigate and issue administrative fines against controllers and processors.
  • Persónuvernd — Iceland's Data Protection Authority, entirely distinct from the Central Bank's crypto/AML supervisory role
  • Personuvernd holds the full suite of GDPR Arts. 57 and 58 powers, including audits, access to premises, warnings, reprimands, orders and temporary or permanent processing bans.

Act And InstrumentsGreen

Act No. 90/2018 is the operative implementing statute, cited jointly with GDPR articles in all enforcement decisions.

Claims (5):

  • Act No. 90/2018 on Data Protection and the Processing of Personal Data is Iceland's primary data protection statute, giving domestic effect to the GDPR and forming the joint legal basis cited alongside GDPR articles in Persónuvernd enforcement decisions.
  • Regulation (EU) 2016/679 (GDPR) — Act No. 90/2018, as taken up in the EEA Agreement
  • Persónuvernd — Iceland applies GDPR via EEA Joint Committee Decision No. 154/2018, implemented domestically by Act No. 90/2018, in force 15 July 2018
  • Iceland applies the full GDPR through EEA Joint Committee Decision No. 154/2018 and Act No. 90/2018 on Data Protection, in force since 15 July 2018.
  • GDPR applies in Iceland via EEA incorporation and is implemented domestically by Act No. 90/2018, with Persónuvernd as the Article 51 supervisory authority.

Material ScopeGreen

Material scope mirrors GDPR via EEA Agreement Annex XI incorporation.

Claims (1):

  • The GDPR was incorporated into the EEA Agreement (Annex XI) and applies comprehensively in Iceland as an EEA EFTA state, covering the same material scope of personal data processing as within the EU.

Territorial ScopeGreen

Comprehensive implementation gives Icelandic data subjects protection equivalent to EU Member States.

Claims (1):

  • As an EEA EFTA state, Iceland has implemented EU data protection rules comprehensively such that individuals in Iceland benefit from the same level of protection as individuals in EU Member States.

Regulator Registration And FilingAmber

No general upfront registration regime; Persónuvernd instead operates an online breach-notification portal/form.

Claims (1):

  • Persónuvernd operates a dedicated online notification portal/form through which controllers submit mandatory personal data breach notifications, rather than requiring general upfront processing-notification registration filings.
Category narrative 47 words

Iceland is an EEA/EFTA state that has incorporated the GDPR into its domestic legal order via Act No. 90/2018 on Data Protection and the Processing of Personal Data, giving Persónuvernd (the Icelandic Data Protection Authority) enforcement powers materially equivalent to those of an EU Member State DPA.

Sources and claims (11)
  1. Probable DataGuidance — Persónuvernd is Iceland's independent Data Protection Authority responsible for supervising compliance with Act No. 90/2018 and the GDPR as incorporated into Icelandic law, with powers to investigate and issue administrative fines against controllers and processors. observed
  2. Probable Persónuvernd (official translation) — Act No. 90/2018 on Data Protection and the Processing of Personal Data is Iceland's primary data protection statute, giving domestic effect to the GDPR and forming the joint legal basis cited alongside GDPR articles in Persónuvernd enforcement decisions. observed
  3. Probable EDPS — The GDPR was incorporated into the EEA Agreement (Annex XI) and applies comprehensively in Iceland as an EEA EFTA state, covering the same material scope of personal data processing as within the EU. observed
  4. Probable EDPS — As an EEA EFTA state, Iceland has implemented EU data protection rules comprehensively such that individuals in Iceland benefit from the same level of protection as individuals in EU Member States. observed
  5. Probable European Data Protection Board — Persónuvernd operates a dedicated online notification portal/form through which controllers submit mandatory personal data breach notifications, rather than requiring general upfront processing-notification registration filings. observed
  6. Probable Clickport — Regulation (EU) 2016/679 (GDPR) — Act No. 90/2018, as taken up in the EEA Agreement observed
  7. Probable CookieFines.eu — Persónuvernd — Iceland's Data Protection Authority, entirely distinct from the Central Bank's crypto/AML supervisory role observed
  8. Probable Recording Law — Persónuvernd — Iceland applies GDPR via EEA Joint Committee Decision No. 154/2018, implemented domestically by Act No. 90/2018, in force 15 July 2018 observed
  9. Probable https://ksandk.com/privacy-review/map/iceland/ — Personuvernd holds the full suite of GDPR Arts. 57 and 58 powers, including audits, access to premises, warnings, reprimands, orders and temporary or permanent processing bans.
  10. Probable https://www.recordinglaw.com/world-laws/world-data-privacy-laws/iceland-data-privacy-laws/ — Iceland applies the full GDPR through EEA Joint Committee Decision No. 154/2018 and Act No. 90/2018 on Data Protection, in force since 15 July 2018.
  11. Probable RecordingLaw — GDPR applies in Iceland via EEA incorporation and is implemented domestically by Act No. 90/2018, with Persónuvernd as the Article 51 supervisory authority. observed

#

Directly enforced GDPR provisions with documented Icelandic case law across multiple sectors.

Primary frameworkAct No. 90/2018 (Arts. 6-9, 18) read with GDPR Arts. 5-9
Supervisory authorityPersónuvernd
Traffic-light rationale — GreenDirectly enforced GDPR provisions with documented Icelandic case law across multiple sectors.
D2 · Lawful Processing — Full Module Record4 sub-modules · 29 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Rights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland.

Primary frameworkGDPR Arts. 12-22 as incorporated via Act No. 90/2018
Supervisory authorityPersónuvernd
Traffic-light rationale — GreenRights are directly incorporated; EDPB coordinated actions (access 2025, erasure 2025-26) evidence active supervisory engagement in the EEA, including Iceland.

Sub-modules (5)

Access RightGreen

Article 15 access right enforced; EEA-wide 2025 CEF action examined right-of-access implementation.

Claims (2):

  • Persónuvernd participates as an EEA supervisory authority within the EDPB's Coordinated Enforcement Framework, which ran a 2025 action examining controllers' implementation of the right of access under Article 15 GDPR.
  • Individuals in Iceland hold the full set of GDPR Chapter III data-subject rights, enforceable through complaints to Persónuvernd or the Icelandic courts.

Rectification And ErasureAmber

Article 17 GDPR erasure right subject to 2025-26 EDPB coordinated action across EEA DPAs.

Claims (1):

  • The EDPB launched a coordinated action in 2025-2026 on the right to erasure (Article 17 GDPR) applicable to participating EEA supervisory authorities, with a report on outcomes expected to be adopted in the coming months.

Restriction And ObjectionAmber

Article 18(1) Act 90/2018 disapplies restriction/objection rights for research-only processing, subject to safeguards.

Claims (1):

  • Article 18(1) of Act No. 90/2018 disapplies the rights to access, rectification, restriction of processing, and objection where personal data are processed exclusively for research or statistical purposes, subject to safeguards.

Data PortabilityAmber

Article 20 GDPR portability applies without a documented Icelandic-specific derogation.

Claims (1):

  • The right to data portability under GDPR Article 20 applies directly in Iceland via incorporation of the GDPR through Act No. 90/2018, without a documented Icelandic-specific derogation identified in available sources.

Deadlines And Response WindowsAmber

Standard one-month (extendable) GDPR response window applies; no Iceland-specific modification found.

Claims (1):

  • Controllers in Iceland must respond to data subject rights requests within the GDPR's standard one-month period (extendable by up to two further months for complex requests), incorporated without modification via Act No. 90/2018.
Category narrative 36 words

Access, rectification/erasure, restriction/objection, and portability rights apply per GDPR Arts. 13-22 via Act No. 90/2018, subject to a research-purpose carve-out under Article 18(1) of the Act; no Iceland-specific deviation from GDPR's standard response deadlines was located.

Sources and claims (6)
  1. Probable European Data Protection Board — Persónuvernd participates as an EEA supervisory authority within the EDPB's Coordinated Enforcement Framework, which ran a 2025 action examining controllers' implementation of the right of access under Article 15 GDPR. observed
  2. Probable European Data Protection Board — The EDPB launched a coordinated action in 2025-2026 on the right to erasure (Article 17 GDPR) applicable to participating EEA supervisory authorities, with a report on outcomes expected to be adopted in the coming months. observed
  3. Probable European Data Protection Board — Article 18(1) of Act No. 90/2018 disapplies the rights to access, rectification, restriction of processing, and objection where personal data are processed exclusively for research or statistical purposes, subject to safeguards. observed
  4. Probable Persónuvernd (official translation) — The right to data portability under GDPR Article 20 applies directly in Iceland via incorporation of the GDPR through Act No. 90/2018, without a documented Icelandic-specific derogation identified in available sources. observed
  5. Probable Persónuvernd (official translation) — Controllers in Iceland must respond to data subject rights requests within the GDPR's standard one-month period (extendable by up to two further months for complex requests), incorporated without modification via Act No. 90/2018. observed
  6. Probable RecordingLaw — Individuals in Iceland hold the full set of GDPR Chapter III data-subject rights, enforceable through complaints to Persónuvernd or the Icelandic courts. observed

#

Core obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among controllers.

Primary frameworkGDPR Arts. 24-35 / Act No. 90/2018 Arts. 24-35
Supervisory authorityPersónuvernd
Traffic-light rationale — AmberCore obligations are enforced (multiple fines), but repeated findings of DPIA, DPO-independence, and security failures (Reykjavík, InfoMentor, ice-cream-parlour cases) indicate persistent compliance gaps among controllers.
Periodic update · new data 2026-10-25

Controller/Processor Duties

As at 7 July 2026, Personuvernd issued a reprimand to Borgarholtsskoli for breaching data protection law by storing an anonymous tip naming a teacher without an adequate legal basis. The finding is a reprimand rather than a fine, but it carries a notable limitation: the regulator could not order deletion of the material because public-records retention duties require the consent of the National Archivist before disposal can proceed.

The case sets out, in concrete terms, a structural conflict that controllers in Iceland's public sector face between data-minimisation and lawfulness obligations on one side and statutory records-preservation duties on the other. Where a public body is subject to archival retention law, a finding that data was unlawfully stored does not, on its own, translate into an enforceable deletion remedy; a separate consent process sits between the breach finding and any disposal of the material.

Outlook

How Personuvernd and the National Archivist resolve the practical question of deletion in the Borgarholtsskoli matter will be instructive for any other public-sector controller holding material found to lack a lawful basis for retention, since the same statutory consent requirement would apply in comparable cases.

D4 · Controller & Processor — Full Module Record7 sub-modules · 34 words · 11 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Framework is fully harmonised (green) but enforcement shows recurring onward-transfer risk findings (amber) in ed-tech/cloud processing.

Primary frameworkGDPR Arts. 44-49 as incorporated via Act No. 90/2018 and EEA Agreement Annex XI
Supervisory authorityPersónuvernd
Traffic-light rationale — AmberFramework is fully harmonised (green) but enforcement shows recurring onward-transfer risk findings (amber) in ed-tech/cloud processing.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 40 words · 6 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Strong evidence in education and health; gaps in financial, telecoms, credit, and insurance sub-modules necessitate primary-source escalation.

Primary frameworkGDPR/Act No. 90/2018 general framework; no distinct sectoral statutes identified beyond education/health case law
Supervisory authorityPersónuvernd
Traffic-light rationale — AmberStrong evidence in education and health; gaps in financial, telecoms, credit, and insurance sub-modules necessitate primary-source escalation.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 34 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Framework exists in principle (GDPR incorporation) but no dedicated Icelandic enforcement or guidance evidence found for most adtech sub-modules.

Primary frameworkGDPR consent/legitimate-interest and Art. 21 objection rights as incorporated via Act No. 90/2018
Supervisory authorityPersónuvernd
Traffic-light rationale — RedFramework exists in principle (GDPR incorporation) but no dedicated Icelandic enforcement or guidance evidence found for most adtech sub-modules.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 38 words · 8 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Genetic data and emerging AI-related engagement are evidenced; biometric regime and surveillance carve-outs remain gaps requiring primary-source escalation.

Primary frameworkGDPR Arts. 9, 22 as incorporated via Act No. 90/2018
Supervisory authorityPersónuvernd
Traffic-light rationale — AmberGenetic data and emerging AI-related engagement are evidenced; biometric regime and surveillance carve-outs remain gaps requiring primary-source escalation.
Periodic update · new data 2026-10-11

Algorithmic, Biometric & Surveillance Governance

Iceland's position on algorithmic and AI-specific governance is shaped, at this stage, by what has not yet happened rather than by a settled domestic rule. The EU AI Act, Regulation (EU) 2024/1689, has not been incorporated into the EEA Agreement as at the current research date. The instrument remains under scrutiny by the EEA EFTA states, with a draft Joint Committee Decision reported as pending but not adopted. Until that incorporation occurs, the AI Act's obligations do not bind Icelandic entities in the way they already bind entities within the EU itself, and Iceland's algorithmic-governance landscape continues to rest on the general GDPR framework rather than on AI-specific rules.

That is not to say the space is without regulatory attention. Persónuvernd's Director General is reported to have stated publicly, on 16 September 2026, that a new type of AI-assisted recording device raises privacy questions. The statement is clearly attributed to the regulator and reported by a domestic press source, giving it a reasonably assertive evidentiary basis notwithstanding that it is a public statement rather than a formal decision or guidance document. It indicates that Persónuvernd is monitoring AI-adjacent developments and is prepared to raise concerns under its existing GDPR supervisory mandate even where no AI-specific statute yet applies domestically.

The combination of these two findings describes a jurisdiction in a holding pattern on AI-specific law, but not in one on supervisory attention: the hard legal framework is pending EEA-level action outside Iceland's own control, while Iceland's domestic regulator is already signalling where it expects future scrutiny to land, specifically AI-assisted recording and surveillance technology.

Outlook

The decisive event to watch is adoption of the EEA Joint Committee Decision incorporating the AI Act, which would convert the current non-binding watch posture into an enforceable domestic framework on a timetable set by that decision. In the interim, further public statements or informal guidance from Persónuvernd on AI-assisted recording or similar surveillance technologies are a plausible next marker, continuing the pattern already set by the Director General's September 2026 remarks.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 44 words · 10 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Strong, repeated education-sector enforcement (green signal) offset by gaps in age-verification, minor-profiling, and dependent-adult sub-modules (red signal), yielding an overall amber rating.

Primary frameworkGDPR Art. 8 / Act No. 90/2018 special-category provisions on children's data
Supervisory authorityPersónuvernd
Traffic-light rationale — AmberStrong, repeated education-sector enforcement (green signal) offset by gaps in age-verification, minor-profiling, and dependent-adult sub-modules (red signal), yielding an overall amber rating.
D9 · Children's Privacy — Full Module Record5 sub-modules · 41 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Active enforcement and appeal pathways exist (green signal) but self-reported capacity constraints and unresolved collective-redress/private-right-of-action gaps (amber/red signals) temper the overall rating.

Primary frameworkGDPR Arts. 77-84 / Act No. 90/2018 enforcement provisions
Supervisory authorityPersónuvernd
Traffic-light rationale — AmberActive enforcement and appeal pathways exist (green signal) but self-reported capacity constraints and unresolved collective-redress/private-right-of-action gaps (amber/red signals) temper the overall rating.
Periodic update · new data 2026-11-04

Enforcement & Redress

Iceland's Supreme Court reversed, in March 2026, fines that Persónuvernd had imposed on five municipalities for their use of Google Workspace and Google Cloud services within schools. The court's ground for reversal was that the regulator had not established, to the required standard, that sensitive personal data was in fact processed through those services — a proof failure rather than a substantive clearance. Persónuvernd issued recall decisions following the judgment, and those decisions state in terms that the underlying violations found against the municipalities remain unaffected by the court's reasoning. Read together, the ruling narrows what the regulator could collect in penalties for this specific episode without disturbing its underlying finding that a violation occurred.

Persónuvernd's enforcement powers otherwise continue to rest on the standard tiered maximum, running up to EUR 20 million or 4% of annual worldwide turnover, whichever figure is higher. An independent fines-tracking aggregator separately reports a cumulative total of 66 recorded enforcement actions since 2020, amounting to roughly EUR 1.2 million, though this tally comes from a third-party tracker rather than the regulator's own published register and carries correspondingly less weight.

Outlook

Whether the Supreme Court's ruling is subject to further appeal, and what if anything a primary court filing or a Persónuvernd statement adds beyond the recall decisions already issued, remains to be established. For public-sector bodies and schools using the same cloud services, the practical compliance question — whether sensitive data is in fact processed and under what legal basis — stays open regardless of the financial outcome of this particular case.

Periodic update · new data 2026-10-25

Enforcement & Redress

Personuvernd's enforcement activity in Iceland combines an active regulator with a judiciary willing to intervene on evidentiary grounds. The Borgarholtsskoli reprimand of 7 July 2026, addressing unlawful retention of an anonymous tip naming a teacher, sits within this active enforcement picture, even though the regulator's remedy there was constrained by public-records consent requirements rather than resulting in a fine.

A third-party tracker reports that Personuvernd has taken 66 enforcement actions since 2020, totalling approximately EUR 1.19 million in fines, with a EUR 257,427 fine against Creditinfo Lanstrausti hf in 2023 cited as the largest individual penalty in that period. This figure is drawn from an aggregator rather than from Personuvernd's own published enforcement register, so it should be treated as an indicative volume rather than an authoritative count. Taken together with the Supreme Court's March 2026 reversal of five Google Workspace-related fines on evidentiary grounds, the picture is one of a regulator that is active in bringing cases but subject to a judiciary that checks the evidentiary basis for the penalties it imposes.

Outlook

Whether the evidentiary standard applied in the Google Workspace reversals becomes a durable constraint on Personuvernd's fining practice, or proves specific to that set of cases, is the open question for the enforcement record going forward.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 54 words · 13 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 83 claim(s) (83 category placement(s)), 30 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not settled (3 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties