IcelandAct No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from Iceland
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Confirm that a European Commission adequacy decision has its own EEA Joint Committee decision and ministerial confirmation, published in the Law Gazette, before relying on it for a transfer of personal data of a person in Iceland outside the EEA, under Act No. 90/2018 Article 16.
- Rely on Standard Contractual Clauses, Binding Corporate Rules, or a narrow derogation where no confirmed adequacy decision covers the destination country.
These lines are LexLint's reading of the law's text. Also read by: Persónuvernd (the Icelandic Data Protection Authority) (guidance, recorded ); Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The authority later set aside the fine imposed in the decision linked as guidance.
- As of
- Case link
- https://island.is/domar/s-2C2A2D4B-4092-47D2-BF61-2A79EE35EAA8
- Guidance link
- https://personuvernd.is/urlausnir/uttekt-a-notkun-reykjavikurborgar-a-skyjalausn-google-i-grunnskolastarfi
- Case citation
- Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of
- Guidance body
- Persónuvernd (the Icelandic Data Protection Authority)
- Open questions
- Does a decision of the European Commission under Article 45 of the Regulation apply in Iceland from its adoption, or only once the EEA Joint Committee has decided and the Minister has published a notice, given that Article 16 of Act No. 90/2018 provides that such decisions 'gilda hér á landi í samræmi við ákvörðun sameiginlegu EES-nefndarinnar' (apply in Iceland in accordance with the decision of the EEA Joint Committee)?
What it makes you log
Logging duty
Article 16 makes Commission adequacy decisions apply in Iceland only in accordance with the EEA Joint Committee decision and requires the Minister to confirm each one and publish a notice in the Law Gazette. The notice is the Minister's own publication, not a record the controller or processor must keep, and the article places no logging, documentation or production duty on a controller. Transfer safeguards (Articles 44 to 49 of the Regulation) are not cited by this row. No scope clause is stated in Article 16.
- Kind
- None
- As of
What this law does
Article 16 of Act No. 90/2018 provides that a European Commission adequacy decision under General Data Protection Regulation (GDPR) Article 45 applies in Iceland only in accordance with the EEA Joint Committee's own decision, and requires the Minister to confirm such decisions and publish notice in the Law Gazette before they take domestic effect. This is a genuinely distinctive two-step mechanism: an adequacy decision does not apply automatically the moment the Commission adopts it.
Otherwise, a transfer outside the EEA requires appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49-equivalent derogation; transfers within the EEA, including to Norway and Liechtenstein, move freely.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .