IcelandAct No. 90/2018, Persoonuvernd Enforcement in Iceland
Log nr. 90/2018, arts. 39, 41, 42, 45 to 48 and 51; Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect Persoonuvernd to have jurisdiction and fining power, denominated in Icelandic krona at a level converging with the General Data Protection Regulation (GDPR) Article 83 tiers, over your processing of personal data of a person in Iceland.
- Expect any person who suffered material or non-material damage from an infringement to have a right to compensation from you as controller or processor, under Act No. 90/2018.
These lines are LexLint's reading of the law's text. Also read by: Persónuvernd (the Icelandic Data Protection Authority) (guidance, recorded ); Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 48 punishes an aggravated individual offense, committed intentionally and for profit in a particularly reprehensible manner, resulting in the personal data of a large number of registered individuals that must by law or by its nature be kept confidential reaching a third party or being made public, with imprisonment of up to three years. A representative or employee of a legal entity who commits this offense in the course of the entity's activities may be punished alongside the administrative fine imposed on the entity under Article 46. A separate individual breach of the confidentiality duties in Articles 36 and 44 is punishable by fines or imprisonment of up to one year, rising to imprisonment of up to three years where committed to obtain an unlawful gain for the offender or another person.
Penalty structure
Article 46 sets two administrative-fine tiers, each with a floor of ISK 100,000. This entry records the higher tier: ISK 100,000 to 2.4 billion, or up to 4 percent of worldwide annual turnover in the preceding financial year, whichever is higher, for infringement of the Regulation's basic processing principles and consent conditions (Articles 5, 6, 7 and 9), the data subject rights (Articles 12 to 22), the cross-border transfer conditions (Articles 44 to 49), and two Act-specific triggers: refusing Personuvernd access to data and premises under Article 41, and disregarding a Personuvernd order restricting or banning processing, correcting or erasing data, or halting a data flow under Article 42. A lower tier, ISK 100,000 to 1.2 billion, or up to 2 percent of worldwide annual turnover, whichever is higher, covers the controller and processor obligations in Articles 8, 25 to 39, 42 and 43 of the Regulation, the certification-body obligations in Articles 42 and 43, and the monitoring-body obligations in Article 41(4). Where a controller or processor infringes more than one provision in the same or related processing operations, Article 46 caps the total fine at the amount set for the most serious infringement, and the fining power lapses five years after the conduct ended.
- Rule
- Higher of
- As of
- Minimum
- 100,000
- Currency
- ISK
- Fixed cap
- 2,400,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Personuvernd, Iceland's independent data protection authority, designated the supervisory authority under Act No. 90/2018 Article 39 and empowered to impose administrative fines under Article 46.
Settledness
- As of
- Case link
- https://island.is/domar/s-2C2A2D4B-4092-47D2-BF61-2A79EE35EAA8
- Guidance link
- https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/nidurfelling-hluta-akvordunar-personuverndar-fra-28-november-2023-i-mali-nr-2022020363-19-3-2026
- Case citation
- Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of
- Guidance body
- Persónuvernd (the Icelandic Data Protection Authority)
- Open questions
- How must Persónuvernd weigh the factors in Article 47 of Act No. 90/2018, to which it must give 'tilhlýðilegt tillit' (due regard), when deciding whether to fine a public body, after the Supreme Court found no grounds to fine the respondent in Case No. 18/2024?
What it makes you log
Logging duty
Persónuvernd's powers in Article 41 include ordering a controller or processor to provide any information it needs, carrying out audits of the processing, and obtaining access to all necessary data and to premises, and the remedies, daily fines, administrative fines and compensation in Articles 42 and 45 to 51 follow from breach. The power is exercised at the authority's own discretion and names no record the regulated party must keep, so no record duty is found. Article 39 item 15 has the authority itself list infringements and the measures taken, which is the authority's own register, not a duty on a controller. Article 39(2) refers to Article 7, but none of the cited provisions states a territorial hook of its own.
- Kind
- None
- As of
What this law does
Persoonuvernd holds investigative and corrective powers and administrative-fine authority. Because General Data Protection Regulation (GDPR) reaches Iceland through national legislation rather than direct EU regulation applicability, Act No. 90/2018 sets Iceland's fine ceiling in Icelandic krona rather than by direct reference to the EUR-denominated GDPR figures.
Article 46 of the Act itself confirms a lower tier of ISK 100,000 to 1.2 billion or 2 percent of worldwide annual turnover and a higher tier of ISK 100,000 to 2.4 billion or 4 percent, mirroring the GDPR Article 83(4)/(5) structure, alongside daily compulsion fines under Article 45 and a criminal-penalty track for deliberate breaches. Individuals may seek compensation for material or non-material damage, mirroring GDPR Article 82.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .