IcelandAct No. 90/2018 on Data Protection and the Processing of Personal Data
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis under Act No. 90/2018 Article 8 (mirroring General Data Protection Regulation (GDPR) Article 6) before processing personal data of a person in Iceland, including data collected by crawling.
- Treat Act No. 90/2018, not the EU GDPR Regulation directly, as the controlling instrument for a person in Iceland, since GDPR reaches Iceland only through this Act's own EEA-incorporation mechanism.
These lines are LexLint's reading of the law's text. Also read by: Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://island.is/domar/s-2C2A2D4B-4092-47D2-BF61-2A79EE35EAA8
- Case citation
- Persónuvernd and the Icelandic State v Reykjavíkurborg, Supreme Court of Iceland (Hæstiréttur Íslands), Case No. 18/2024, judgment of
- Open questions
- Which provisions count as 'Sérákvæði annarra laga um vinnslu persónuupplýsinga sem sett eru innan ramma reglugerðarinnar' (special provisions of other acts on the processing of personal data made within the framework of the Regulation), which under Article 5 of Act No. 90/2018 'ganga framar ákvæðum laga þessara' (take precedence over the provisions of this Act)?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 26 makes every controller and processor keep a register of its processing activities, with content, form and accessibility as in Article 30 of the Regulation; fewer than 250 staff is exempt unless the processing is risky, not occasional, or covers sensitive or criminal-offence data. Article 10 separately makes a controller relying on consent able to show that the data subject consented. The register's items (purposes, categories, recipients) are not log content values, so only the consent state is listed. Neither article sets a period for keeping the register or the consent record, so no retention is stated. Article 41 lets the authority demand information, carry out audits and obtain access to all necessary data. The breach record (Article 33(5) of the Regulation) is carried on the breach row, and Article 27 of the Act, which this row also covers, itself states only the duty to notify. The Article 7(3) duty to appoint a representative and the territorial prong that depends on where processing equipment is located are not hook values and are left out of the hook.
- Kind
- Explicit
- As of
- Provision
- Article 26 (register of processing activities), with Article 10 (proof of consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Iceland is not an EU member, so the General Data Protection Regulation (GDPR) does not apply directly. GDPR reaches Iceland through EEA Joint Committee Decision No. 154/2018, incorporating it into the EEA Agreement, and Act No. 90/2018 gives that incorporation domestic legal force. The Act's own Article 2 names Decision No. 154/2018 as the incorporation mechanism, and the Act reproduces the GDPR text itself as an appendix. Persoonuvernd (the Icelandic Data Protection Authority) is the supervisory authority.
Privacy law is a settled, fully in-force regime in Iceland since 2018, distinct from Iceland's AI-law posture, where the EU AI Act's own EEA incorporation was still pending as of August 2026.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .