Act No. 90/2018, Data Subject Rights in Iceland

Log nr. 90/2018 (data subject rights provisions)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 July 2018.

A data subject rights rule binding public and private bodies.

As of 24 August 2026.

What it requires

Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Iceland within one month of receipt, under Act No. 90/2018.
Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Iceland.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Act No. 90/2018 carries the General Data Protection Regulation (GDPR) data subject rights, access, rectification, erasure, restriction, portability, and objection, into Icelandic law, including the qualified Article 22-equivalent right against a decision based solely on automated processing. Rights are exercisable against the controller, with Personuvernd as the escalation path for a complaint. No Icelandic-specific timeline departure from GDPR's one-month response window was found.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Althingi official consolidated-law database

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app