IcelandAct No. 90/2018, Breach Notification in Iceland
Log nr. 90/2018, arts. 2 and 27, incorporating Regulation (EU) 2016/679, Arts. 33-34; art. 17
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify Personuvernd without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Iceland, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
These lines are LexLint's reading of the law's text. Also read by: Persónuvernd (the Icelandic Data Protection Authority) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://personuvernd.is/einstaklingar/spurt-og-svarad/allar-spurningar-og-svor/oryggisbrestur
- Guidance body
- Persónuvernd (the Icelandic Data Protection Authority)
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 27 of the Act states the duty to notify Persónuvernd within 72 hours and to inform data subjects, and refers to Articles 33 and 34 of the Regulation for content, but itself says nothing about keeping a record. The record duty sits in Article 33(5) of the Regulation, which the row cites and which the Act gives the force of law and prints in full: the controller documents every breach, its facts, effects and remedial action, so that the authority can verify compliance. Those items are not log content values, so no contents are listed. No period for keeping the record is stated. The cited provisions state no scope clause.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679 Article 33(5), as incorporated by Act No. 90/2018 Article 2
- Trigger
- security_incident
What this law does
Act No. 90/2018 carries the General Data Protection Regulation (GDPR) breach-notification duties into Icelandic law: a controller must notify Personuvernd without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. It must notify affected individuals without undue delay where the breach is likely to result in a high risk.
Article 27 of the Act states both duties and refers to Article 33 of the Regulation for the content of the notification to Personuvernd. Article 27 refers to Article 34 for the content of the notice to individuals and its exceptions. Article 17(7) of the Act adds that the Article 34 notice to individuals does not apply where items 1 and 4 of Article 17(4) apply.
Those items are national security, and the prevention, investigation, detection or prosecution of offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .