Duty LXD-0946
Processes personal data, in Iceland
Act No. 90/2018 on Data Protection and the Processing of Personal Datasince 2 lines
Log nr. 90/2018 um personuvernd og vinnslu personuupplysinga (Act No. 90/2018), passed by Althingi , in force · Read the law's page
- Establish a lawful basis under Act No. 90/2018 Article 8 (mirroring GDPR Article 6) before processing personal data of a person in Iceland, including data collected by crawling.
- Treat Act No. 90/2018, not the EU GDPR Regulation directly, as the controlling instrument for a person in Iceland, since GDPR reaches Iceland only through this Act's own EEA-incorporation mechanism.
Act No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from Icelandsince 2 lines
Log nr. 90/2018, Art. 16 · Read the law's page
- Confirm that a European Commission adequacy decision has its own EEA Joint Committee decision and ministerial confirmation, published in the Law Gazette, before relying on it for a transfer of personal data of a person in Iceland outside the EEA, under Act No. 90/2018 Article 16.
- Rely on Standard Contractual Clauses, Binding Corporate Rules, or a narrow derogation where no confirmed adequacy decision covers the destination country.
Act No. 90/2018, Data Subject Rights in Icelandsince 1 line
Log nr. 90/2018, art. 2, incorporating Regulation (EU) 2016/679, Arts. 12-21; arts. 17 to 19 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Iceland within one month of receipt, under Act No. 90/2018.
Act No. 90/2018, Breach Notification in Icelandsince 3 lines
Log nr. 90/2018, arts. 2 and 27, incorporating Regulation (EU) 2016/679, Arts. 33-34; art. 17 · Read the law's page
- Notify Personuvernd without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Iceland, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
Act No. 90/2018, Persoonuvernd Enforcement in Icelandsince 2 lines
Log nr. 90/2018, arts. 39, 41, 42, 45 to 48 and 51; Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Expect Persoonuvernd to have jurisdiction and fining power, denominated in Icelandic krona at a level converging with the GDPR Article 83 tiers, over your processing of personal data of a person in Iceland.
- Expect any person who suffered material or non-material damage from an infringement to have a right to compensation from you as controller or processor, under Act No. 90/2018.