IcelandSecurity Policy and Risk Management of Telecommunications Companies
Log nr. 70/2022 um fjarskipti, Art. 78 and 103
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.althingi.is/lagas/nuna/2022070.htmlIn force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- Applies to a telecommunications company that provides public electronic communications services or operates a public electronic communications network in Iceland. Reached by declaring that you provide telecom services.
- Set yourself a documented security policy and procedures to assess, manage and minimise the risks that may threaten your operations (Article 78).
- Protect, as far as you can, information that passes over the network against being lost, damaged or altered by accident or accessed by an unauthorised person (Article 78).
- Carry out a risk assessment at regular intervals on the basis of the security policy, and set and reassess security measures accordingly (Article 78).
- Have a documented response plan and a plan for continuous and uninterrupted operation and service, to limit damage if your operations are seriously disrupted (Article 78).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 103 lets the Post and Telecom Administration fine a breach of Articles 78, 80 and 81(1) up to 4 percent of the total turnover of the last operating year of the telecommunications company or other undertaking party to the breach; a fine on an individual runs from ISK 10,000 to ISK 10,000,000.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The Post and Telecom Administration (Fjarskiptastofa), which may fine a telecommunications company that breaches Articles 78, 80 or 81(1) of the Act under Article 103.
Settledness
- As of
What this law does
Article 78 of Act 70/2022 requires a telecommunications company that provides public electronic communications services or operates a public network to set itself a documented security policy and procedures to assess, manage and minimise the risks that may threaten its operations. Article 78 also requires such a company, as far as it can, to protect information travelling over the network against being lost, damaged or altered by accident or accessed by an unauthorised person.
Article 78 further requires the company to have a documented response plan and a plan for continuous and uninterrupted operation and service in case of a serious disruption of its operations. Article 103 lets the Post and Telecom Administration fine a breach of Article 78 up to 4 percent of total turnover. The Act took effect on .
When LexLint raises it
When your app profile says your app provides telecom services.