IcelandAct No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from Iceland
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 July 2018.
A cross border transfer rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Confirm that a European Commission adequacy decision has its own EEA Joint Committee decision and ministerial confirmation, published in the Law Gazette, before relying on it for a transfer of personal data of a person in Iceland outside the EEA, under Act No. 90/2018 Article 16.
- Rely on Standard Contractual Clauses, Binding Corporate Rules, or a narrow derogation where no confirmed adequacy decision covers the destination country.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 16 of Act No. 90/2018 provides that a European Commission adequacy decision under General Data Protection Regulation (GDPR) Article 45 applies in Iceland only in accordance with the EEA Joint Committee's own decision, and requires the Minister to confirm such decisions and publish notice in the Law Gazette before they take domestic effect. This is a genuinely distinctive two-step mechanism: an adequacy decision does not apply automatically the moment the Commission adopts it.
Otherwise, a transfer outside the EEA requires appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49-equivalent derogation; transfers within the EEA, including to Norway and Liechtenstein, move freely.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot
Read the law
Althingi official consolidated-law database, Article 16
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.