Act No. 90/2018, Persoonuvernd Enforcement in Iceland

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Article 48 punishes an aggravated individual offense, committed intentionally and for profit in a particularly reprehensible manner, resulting in the personal data of a large number of registered individuals that must by law or by its nature be kept confidential reaching a third party or being made public, with imprisonment of up to three years. A representative or employee of a legal entity who commits this offense in the course of the entity's activities may be punished alongside the administrative fine imposed on the entity under Article 46. A separate individual breach of the confidentiality duties in Articles 36 and 44 is punishable by fines or imprisonment of up to one year, rising to imprisonment of up to three years where committed to obtain an unlawful gain for the offender or another person.

Penalty structure

Article 46 sets two administrative-fine tiers, each with a floor of ISK 100,000. This entry records the higher tier: ISK 100,000 to 2.4 billion, or up to 4 percent of worldwide annual turnover in the preceding financial year, whichever is higher, for infringement of the Regulation's basic processing principles and consent conditions (Articles 5, 6, 7 and 9), the data subject rights (Articles 12 to 22), the cross-border transfer conditions (Articles 44 to 49), and two Act-specific triggers: refusing Personuvernd access to data and premises under Article 41, and disregarding a Personuvernd order restricting or banning processing, correcting or erasing data, or halting a data flow under Article 42. A lower tier, ISK 100,000 to 1.2 billion, or up to 2 percent of worldwide annual turnover, whichever is higher, covers the controller and processor obligations in Articles 8, 25 to 39, 42 and 43 of the Regulation, the certification-body obligations in Articles 42 and 43, and the monitoring-body obligations in Article 41(4). Where a controller or processor infringes more than one provision in the same or related processing operations, Article 46 caps the total fine at the amount set for the most serious infringement, and the fining power lapses five years after the conduct ended.

Rule

Higher of

As of

2 September 2026

Minimum

100,000

Currency

ISK

Fixed cap

2,400,000,000

Turnover percentage cap

4

Enforcement body

Personuvernd, Iceland's independent data protection authority, designated the supervisory authority under Act No. 90/2018 Article 39 and empowered to impose administrative fines under Article 46.

Obligation class

Governance