IcelandNotification of Security Incidents by Telecommunications Companies and Information to Users
Log nr. 70/2022 um fjarskipti, Art. 80 and 81(1)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.althingi.is/lagas/nuna/2022070.htmlIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to a telecommunications company that operates a public electronic communications network or provides public electronic communications services in Iceland. Reached by declaring that you provide telecom services.
- Notify the national cybersecurity team and the Post and Telecom Administration without delay of every serious security incident that threatens the security or operation of public networks or services (Article 80).
- Notify the Post and Telecom Administration without delay if there is a risk that the security or confidentiality of information on telecommunications networks will be breached, or if it has been (Article 80).
- In judging how serious an incident is, look in particular to the number of users affected, how long it lasts, its geographical spread and scale, the extent to which the network or service is affected, and its effect on economic and social activity (Article 80).
- Include in the notification any possible outsourcing arrangement and any possible contagion effect, even across borders (Article 80).
- Inform the users who may be affected, free of charge, of a special or extensive threat to a network or service, and of the security measures and remedies available (Article 81(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 103 lets the Post and Telecom Administration fine a breach of Articles 78, 80 and 81(1) up to 4 percent of the total turnover of the last operating year of the telecommunications company or other undertaking party to the breach; a fine on an individual runs from ISK 10,000 to ISK 10,000,000.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The Post and Telecom Administration (Fjarskiptastofa), which may fine a telecommunications company that breaches Articles 78, 80 or 81(1) of the Act under Article 103.
Settledness
- As of
What this law does
Article 80 of Act 70/2022 requires a telecommunications company that operates a public network or provides public electronic communications services to notify the national cybersecurity team and the Post and Telecom Administration without delay of every serious security incident that threatens the security or operation of public networks or services.
Article 80 also requires notification to the Administration without delay where there is a risk that the security or confidentiality of information on telecommunications networks will be breached or where it has been. Article 81 requires a telecommunications company to inform the users who may be affected where a special or extensive threat affects a network or service. Act 51/2025 amended Article 80 and took effect on .
When LexLint raises it
When your app profile says your app provides telecom services.