Iceland

Article 210.a punishes whoever produces, imports, acquires for himself or others, distributes, or possesses image material showing the sexual abuse of a child, or showing a child in a sexual manner, with fines or imprisonment of up to six years, and imposes the same penalty on whoever views such material online or through other information or telecommunications technology.

A separate paragraph, added by Act No. 29/2022, punishes whoever produces, imports, acquires, distributes, or possesses image material showing persons 18 years of age or older acting sexually while playing the role of a child, or a depiction of a child in such material even though it is not real, such as in a cartoon or another simulated image, with fines or imprisonment of up to two years; this paragraph binds a synthetic or AI-generated depiction on the same terms as a hand-drawn one, since it turns on the image showing what is not real rather than on how the image was produced.

The article separately exempts consensual, close-in-age sexting among 15-to-17-year-olds and a 15-to-17-year-old's own self-distributed material from both the abuse and viewing offenses.

Act No. 90/2018 carries the General Data Protection Regulation (GDPR) breach-notification duties into Icelandic law: a controller must notify Personuvernd without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. It must notify affected individuals without undue delay where the breach is likely to result in a high risk.

Article 27 of the Act states both duties and refers to Article 33 of the Regulation for the content of the notification to Personuvernd. Article 27 refers to Article 34 for the content of the notice to individuals and its exceptions. Article 17(7) of the Act adds that the Article 34 notice to individuals does not apply where items 1 and 4 of Article 17(4) apply.

Those items are national security, and the prevention, investigation, detection or prosecution of offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security.

Iceland is not an EU member, so the General Data Protection Regulation (GDPR) does not apply directly. GDPR reaches Iceland through EEA Joint Committee Decision No. 154/2018, incorporating it into the EEA Agreement, and Act No. 90/2018 gives that incorporation domestic legal force. The Act's own Article 2 names Decision No. 154/2018 as the incorporation mechanism, and the Act reproduces the GDPR text itself as an appendix. Persoonuvernd (the Icelandic Data Protection Authority) is the supervisory authority.

Privacy law is a settled, fully in-force regime in Iceland since 2018, distinct from Iceland's AI-law posture, where the EU AI Act's own EEA incorporation was still pending as of August 2026.

Article 16 of Act No. 90/2018 provides that a European Commission adequacy decision under General Data Protection Regulation (GDPR) Article 45 applies in Iceland only in accordance with the EEA Joint Committee's own decision, and requires the Minister to confirm such decisions and publish notice in the Law Gazette before they take domestic effect. This is a genuinely distinctive two-step mechanism: an adequacy decision does not apply automatically the moment the Commission adopts it.

Otherwise, a transfer outside the EEA requires appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49-equivalent derogation; transfers within the EEA, including to Norway and Liechtenstein, move freely.

Act No. 90/2018 gives Regulation (EU) 2016/679 the force of law in Iceland (art. 2), and its own article 22 restates the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects a person, pointing to Article 22 of the Regulation for its exceptions.

Where such a decision rests on a contract or explicit consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under the Regulation's Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of a proportionate law, with suitable safeguards in place.

Its Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Act No. 90/2018 carries the General Data Protection Regulation (GDPR) data subject rights, access, rectification, erasure, restriction, portability, and objection, into Icelandic law. Rights are exercisable against the controller, with Personuvernd as the escalation path for a complaint.

Article 17(3) of the Act disapplies the rights to information and access, Article 13(1) to (3), Article 14(1) to (4) and Article 15 of the Regulation, where overriding interests of individuals connected to the information, including the data subject, weigh more heavily.

Article 17(4) lets a law restrict the Article 13 to 15 rights where the restriction respects the essence of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard one of eight listed aims, among them national security, defence, public security and the prevention or prosecution of offences.

Article 17(5) allows the paragraph 4 restrictions to be applied to personal data in working papers used by the controller to prepare decisions and not shared with others, so far as necessary to secure the preparation of proceedings. Article 17(6) allows information in cases before public authorities to be withheld from the Article 15(1) right of access to the same extent as the exceptions to the right to information under the Information Act and the Administrative Procedure Act.

Article 18(2) disapplies Articles 15, 16, 18 and 21 of the Regulation where personal data is processed solely for scientific or historical research or for statistical purposes, so far as the rights can be considered to make the purpose impossible or seriously impair it.

Article 18(3) disapplies Articles 15, 16, 18, 19, 20 and 21 on the same terms where the data is processed solely for archiving in the public interest, and the data subject keeps the right to lodge a statement to be kept with the records about them.

Article 19 disapplies the duty to inform under Article 13(3) and Article 14(4) when a public authority passes personal data to another public authority for a statutory task, where the data passed is limited to what is necessary to perform the authority's legal duty. No Icelandic-specific timeline departure from GDPR's one-month response window was found.

Persoonuvernd holds investigative and corrective powers and administrative-fine authority. Because General Data Protection Regulation (GDPR) reaches Iceland through national legislation rather than direct EU regulation applicability, Act No. 90/2018 sets Iceland's fine ceiling in Icelandic krona rather than by direct reference to the EUR-denominated GDPR figures.

Article 46 of the Act itself confirms a lower tier of ISK 100,000 to 1.2 billion or 2 percent of worldwide annual turnover and a higher tier of ISK 100,000 to 2.4 billion or 4 percent, mirroring the GDPR Article 83(4)/(5) structure, alongside daily compulsion fines under Article 45 and a criminal-penalty track for deliberate breaches. Individuals may seek compensation for material or non-material damage, mirroring GDPR Article 82.

Act No. 90/2018, Article 3, item 3 defines sensitive personal data as information on race, ethnic origin, political opinions, religion, life stance (lífsskoðun, philosophical belief) or trade union membership (point (a)); health information, being personal data on a person's physical or mental health, including health services received, and information on drug, alcohol and substance use (point (b)); information on a person's sex life and sexual orientation (point (c)); genetic information (point (d)); and biometric data (point (e)), which it defines as personal data obtained through specific technical processing relating to a person's physical, physiological or behavioral characteristics that allow or confirm unique identification, giving facial images and fingerprint data as illustrative examples using a non-exhaustive such as construction, where the data is processed to identify the person uniquely.

It does not name voiceprints or voice data anywhere in this definition. Article 11 forbids processing sensitive personal data under item 3 of Article 3 unless one of the lawful bases in Article 9 of the Act is met together with one of the further conditions listed in Article 11, set out in more detail in Article 9 of Regulation (EU) 2016/679, the first of which is the data subject's explicit consent.

Article 229 punishes whoever without authorization obtains access to data or programs of others stored in computer-readable form, with fines or imprisonment of up to one year, unless the conduct is justified by reference to public or private interests. The provision names no security-measure element and no carve-out for a page that carries no access control, and no reported Icelandic decision addresses whether reading such a page without any barrier satisfies the without-authorization element.

This text replaced an earlier version of Article 229 by Act No. 8/2021, which took effect immediately upon its own publication; the same 2021 amendment rewrote the former Article 228 into a separate privacy-intrusion offense, so a citation to "Article 228" for this duty predates the current numbering.

Article 50 gives the maker of a catalogue, table, form, database, or similar work containing a substantial collection of information, or that is the result of a substantial investment, the exclusive right to reproduce or publish the work in whole or in a substantial part.

Repeated and systematic extraction or re-utilisation of an insubstantial part of the database is prohibited where it conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests. The right lasts 15 years from the turn of the year following the database's creation, or, if published within that period, 15 years from the turn of the year following publication.

A person entitled to use a database has a separate statutory right to the actions necessary to access and make normal use of its content, and the right runs alongside, rather than displacing, any copyright the database's contents separately carry. This article implements the EU Database Directive (96/9/EC).

The EEA Joint Committee adopted Decision No. 333/2023 on 8 December 2023, incorporating the later Digital Single Market Copyright Directive (2019/790), which would add a text-and-data-mining exception; the decision was published in the Official Journal on 13 June 2024, and its entry into force is conditioned on completion of the constitutional-procedure notifications it requires, so the Act carries no such exception today.

Article 1 of Act 78/2025 gives Regulation (EU) 2022/2554 (DORA) the force of law in Iceland. Article 5 lets the Financial Supervisory Authority fine a person who breaches Articles 5 to 14 of the Regulation on ICT risk management. Article 5 also lets the Authority fine a breach of Articles 24 to 30 of the Regulation on digital operational resilience testing and ICT third-party risk.

Article 3 makes the Central Bank of Iceland the competent authority, with the Financial Supervisory Authority supervising compliance. The Act took effect on 1 January 2026.

Article 7 requires an operator of essential services or a provider of digital services within the Act's scope to maintain a documented policy and processes to assess, manage and minimise the risk to the security of its network and information systems, including risk from rare events with serious consequences, to set a security policy, perform regular risk assessments, and determine and re-assess security measures, both technical and organisational, on that basis, with access control and regular testing against current international best-practice benchmarks.

It also requires a documented incident-response plan and a business-continuity plan to limit damage from a serious operational disruption, covering incident logging, root-cause analysis, restoration of normal operation, and prevention of recurrence, backed by an active internal-control system. The duty binds an operator of essential services in the digital-infrastructure sector, defined as an internet exchange point, a domain-name-system service provider, or a top-level domain registry.

It also binds a provider of digital services operating an online marketplace, an online search engine, or a cloud computing service, other than a provider that qualifies as a micro-enterprise under the Act on Annual Accounts. The Act's other essential-service sectors, banking and financial-market infrastructure, transport, health services, and energy, heating and water utilities, carry the same duty but are gated by sector and criticality criteria this vocabulary does not express.

Article 78 of Act 70/2022 requires a telecommunications company that provides public electronic communications services or operates a public network to set itself a documented security policy and procedures to assess, manage and minimise the risks that may threaten its operations. Article 78 also requires such a company, as far as it can, to protect information travelling over the network against being lost, damaged or altered by accident or accessed by an unauthorised person.

Article 78 further requires the company to have a documented response plan and a plan for continuous and uninterrupted operation and service in case of a serious disruption of its operations. Article 103 lets the Post and Telecom Administration fine a breach of Article 78 up to 4 percent of total turnover. The Act took effect on 1 September 2022.

Article 5 of Act 78/2025 lets the Financial Supervisory Authority fine a person who breaches Article 17 of Regulation (EU) 2022/2554 on the ICT-related incident management process. Article 5 also lets the Authority fine a breach of the duty to classify ICT-related incidents and cyber threats under Article 18 of the Regulation. Article 5 further lets the Authority fine a breach of the duty to report serious ICT-related incidents under paragraphs 1, 3 and 4 of Article 19 of the Regulation. Article 6 applies the administrative sanctions whether the breach was intentional or negligent.

Article 80 of Act 70/2022 requires a telecommunications company that operates a public network or provides public electronic communications services to notify the national cybersecurity team and the Post and Telecom Administration without delay of every serious security incident that threatens the security or operation of public networks or services.

Article 80 also requires notification to the Administration without delay where there is a risk that the security or confidentiality of information on telecommunications networks will be breached or where it has been. Article 81 requires a telecommunications company to inform the users who may be affected where a special or extensive threat affects a network or service. Act 51/2025 amended Article 80 and took effect on 22 July 2025.

Article 8 requires an operator of essential services or a provider of digital services within the Act's scope to notify Iceland's national cybersecurity incident-response team of a serious incident or risk threatening the security of its network and information systems as soon as may be, with severity assessed by the number of users affected, the duration of the incident, its geographic spread and scale, and its possible effect on other critical infrastructure or on economic and social activity or digital services; the notification must also disclose any outsourcing arrangement the operator relies on and any possible cross-border contagion effect.

The duty carries no fixed reporting-clock deadline of its own, unlike the tiered 24-hour, 72-hour and one-month clock of the EU's NIS2 Directive. An operator in banking and financial-market infrastructure instead notifies under Regulation (EU) 2022/2554 (DORA) and Iceland's implementing act. The duty binds the same digital-infrastructure and digital-service-provider population as Article 7, and the same broader, sector-gated essential-service categories that this vocabulary cannot express.

Article 1 applies the Act to the liability of manufacturers and distributors for loss caused by a defect in a product they made or distributed. The explanatory memorandum to the 2014 amending bill treats the Act as the implementation in Iceland of the European Communities directive on product liability. Article 2 gives compensation for personal injury and for loss of a provider.

Article 2 also covers damage to a thing only where the loss is at least 500 euros and the thing is ordinarily intended for private use or consumption and was mainly so used by the injured person. Article 3 defines a product as any kind of movable, including products of nature, parts that have become part of another movable or of an immovable, and electricity.

Article 4 treats as manufacturer whoever makes a finished product, a part of one or supplies a raw material, and whoever presents themselves as manufacturer by putting a name, trademark or other mark on a product. Article 4 also treats as manufacturer whoever imports a product into Iceland in the course of business to sell, rent or trade in it.

Under article 4, where the injured person cannot find out who made or imported a product, every distributor of it counts as its manufacturer unless the distributor names the manufacturer, importer or its own supplier without undue delay. A product is defective when it is not as safe as could legitimately be expected in all the circumstances, in particular how it was presented, the use that could reasonably be expected and when it was distributed.

Article 6 puts on the injured person the burden of proving the loss, the defect and the causal link between them. Article 7 frees the manufacturer from liability if it proves that it did not distribute the product, that making or distributing it was not in the course of business, that the defect is due to mandatory public rules on its design, or that the defect could not be found on the scientific and technical knowledge available when the product was distributed.

Article 8 caps a manufacturer's total liability for personal injury caused by identical products with the same defect at 70 million euros. Article 10 makes a distributor liable for loss under article 2 unless it shows the loss cannot be traced to its own fault or neglect. Article 11 makes two or more liable persons jointly and severally liable for the same loss. Article 12 bars agreements made before the loss that depart from the Act to the injured person's disadvantage.

Article 13 leaves the injured person's rights under the general rules on damages untouched. Article 14 time-bars a claim three years after the injured person learned or could have learned of the loss, the defect and the manufacturer's name and residence. Article 14 also extinguishes a claim that is not yet time-barred ten years after the manufacturer distributed the product. The Act entered into force on 1 January 1992.

The Act does not apply to loss caused by a product that the manufacturer distributed before the Act entered into force. The Act was amended in 2014 by Act 3/2014.

Article 28 bars a media service provider that distributes audio or video content from distributing content, including commercial audio or video communications, that could have a harmful effect on a child's physical, mental, or moral development, in particular pornography or gratuitous violence, subject to watershed-hour, technical-restriction, and news-content exceptions for linear programming.

Since Act No. 27/2024 transposed the revised Audiovisual Media Services Directive as incorporated into the EEA Agreement by EEA Joint Committee Decision No. 337/2022 of 9 December 2022, a video-sharing platform provider established in Iceland or directing content to the Icelandic public must, under the new Article 36.a, take appropriate measures to protect children from content, user-generated content, and commercial communications that could harm their physical, mental, or moral development, and, under Article 36.d, must among other things establish and operate an age-verification system for users with regard to content that could harm a child's physical, mental, or moral development, alongside a flagging system, a user-controlled parental-control system, and media-literacy measures.

The Media Commission enforces both duties with administrative fines of up to ISK 10,000,000, and may not process a child's personal data collected under the parental-control or age-verification measures for commercial purposes such as direct marketing or profiling.

Article 1 of the Copyright Act gives the author of a literary or artistic work ownership of it within the limits the Act sets. Article 1 extends the protection that its third paragraph gives to plans, drawings, models and similar explanatory material, the same protection as literary works, to computer programs. Article 2 gives the author the exclusive right to make copies of the work and to make it available to the public, in its original or altered form, in translation or other adaptation.

A copy under Article 2 is any direct or indirect, temporary or permanent making of a copy of the work, in whole or in part, by any method and in any form. A work is made available to the public under Article 2 when copies are offered for sale, rent or loan or otherwise distributed to the public, when copies are shown publicly, or when the work is performed publicly.

A public performance under Article 2 includes making the work available so that anyone can reach it from a place, at a time and with equipment of their own choosing. Article 54 makes a breach of the Act punishable only when it is committed intentionally or with gross negligence. Article 54 sets imprisonment of up to two years for the offences it lists, and the list includes acts contrary to the author's exclusive right.

Article 56 requires a person who has breached the Act intentionally or negligently to pay damages. The Act took effect on 29 November 1972.

Article 13 of the Trade Marks Act bars registration of a mark that is liable to mislead people, for example about the nature, condition or geographical origin of goods or services. Article 13 also bars registration of a mark that without authorisation contains a coat of arms or other state emblem, a flag, the emblem of an Icelandic municipality, an official inspection or quality mark, or anything liable to be mistaken for them.

Article 14 bars registration, without the consent of the right holder concerned, of a mark that gives reason to believe it refers to the name of an active business, another person's name or image, or a distinctive property name or a picture of the property. The bar in Article 14 does not cover long-dead persons. Article 40 allows a court to prohibit the use of a trade mark that is misleading, in the form in which it is used. Article 40 lets anyone with an interest to protect bring that action. The Act took effect on 1 June 1997.

Article 14 permits, without the copyright owner's consent, a quotation from a published literary work, including a stage work, and a published film work or musical work, where the quotation is made in connection with criticism, science, general presentation, or another recognised purpose, provided it is made within reasonable limits and the material quoted is correctly represented.

The same conditions permit publishing images and drawings of published works of art. The provision carries no headline-length or short-extract cap distinct from this fair-practice test, is not restricted to press or news content. The Act's own consolidated text carries no separate press-publisher neighbouring right and no text-and-data-mining opt-out exception of the kind the EU's Digital Single Market Copyright Directive would add once incorporated into the EEA Agreement.

The Act took effect on 29 November 1972. In the current text of Article 14, a phrase of the second paragraph comes from Act No. 9/2006 and the third paragraph from Act No. 9/2016.

Article 15 of the Copyright Act permits newspapers and periodicals to reprint, and radio to broadcast, topical articles on economic, political or religious subjects from newspapers or periodicals, and broadcast material of the same kind. Article 15 does not permit reprinting where a notice with the articles, or in the broadcast, states that reprinting is prohibited. Article 15 requires the source to be named whenever such an article is reprinted.

Article 15 permits newspapers, periodicals, television and films to publish images or drawings of published works of art in connection with an account of current events, and this does not extend to works made for the purpose of being published in that way. The Act took effect on 29 November 1972.