IcelandAct No. 90/2018 on Data Protection and the Processing of Personal Data
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 July 2018.
A comprehensive regime rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Establish a lawful basis under Act No. 90/2018 Article 8 (mirroring General Data Protection Regulation (GDPR) Article 6) before processing personal data of a person in Iceland, including data collected by crawling.
- Treat Act No. 90/2018, not the EU GDPR Regulation directly, as the controlling instrument for a person in Iceland, since GDPR reaches Iceland only through this Act's own EEA-incorporation mechanism.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Iceland is not an EU member, so the General Data Protection Regulation (GDPR) does not apply directly. GDPR reaches Iceland through EEA Joint Committee Decision No. 154/2018, incorporating it into the EEA Agreement, and Act No. 90/2018 gives that incorporation domestic legal force. The Act's own Article 2 names Decision No. 154/2018 as the incorporation mechanism, and the Act reproduces the GDPR text itself as an appendix. Persoonuvernd (the Icelandic Data Protection Authority) is the supervisory authority.
Privacy law is a settled, fully in-force regime in Iceland since 2018, distinct from Iceland's AI-law posture, where the EU AI Act's own EEA incorporation was still pending as of August 2026.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot
Read the law
Althingi official consolidated-law database
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.