Handles health records, in Iceland

Log nr. 78/2019, Art. 7 · Read the law's page

• Maintain a documented security policy and risk-management process, assess and re-assess risk on a regular basis, and put in place technical and organisational security measures, including access control, tested regularly against current international best practice.
• Maintain a documented incident-response plan and a business-continuity plan covering incident logging, root-cause analysis, restoration of normal operation, and prevention of recurrence, and operate an active internal-control system consistent with this Act and any sector-specific law.
• This duty binds an operator of essential services in Iceland's digital-infrastructure sector (an internet exchange point, a domain-name-system service provider, or a top-level domain registry) and a provider of digital services operating an online marketplace, an online search engine, or a cloud computing service, other than a micro-enterprise; it also binds an operator of essential services in banking and financial-market infrastructure, transport, health services, or energy, heating and water utilities, reached by declaring that you operate an essential service.
• A breach of this duty draws an administrative fine of up to ISK 10,000,000, capped at 3 percent of turnover for a legal entity, and, if committed intentionally, imprisonment for up to two years.

Log nr. 78/2019, Art. 8 · Read the law's page

• This duty binds the same digital-infrastructure operators and digital-service providers as the risk-management duty of Article 7, other than a micro-enterprise, plus the same broader sector-gated essential-service population, reached by declaring that you operate an essential service.
• Notify Iceland's national cybersecurity incident-response team as soon as may be about a serious incident or risk threatening the security of a network or information system; the Act sets no fixed hour-based clock of its own for this notification.
• State in the notification the number of affected users, the incident's duration, its geographic spread and scale, any outsourcing arrangement relied on, and any possible cross-border contagion effect.
• An operator in banking or financial-market infrastructure notifies under Regulation (EU) 2022/2554 (DORA) and Iceland's implementing act instead of under this article.
• A breach of this duty draws an administrative fine of up to ISK 10,000,000, capped at 3 percent of turnover for a legal entity, and, if committed intentionally, imprisonment for up to two years; knowingly or recklessly giving a false notification is separately punishable under the General Penal Code.