Iceland

Article 210.a punishes whoever produces, imports, acquires for himself or others, distributes, or possesses image material showing the sexual abuse of a child, or showing a child in a sexual manner, with fines or imprisonment of up to six years, and imposes the same penalty on whoever views such material online or through other information or telecommunications technology.

A separate paragraph, added by Act No. 29/2022, punishes whoever produces, imports, acquires, distributes, or possesses image material showing persons 18 years of age or older acting sexually while playing the role of a child, or a depiction of a child in such material even though it is not real, such as in a cartoon or another simulated image, with fines or imprisonment of up to two years; this paragraph binds a synthetic or AI-generated depiction on the same terms as a hand-drawn one, since it turns on the image showing what is not real rather than on how the image was produced.

The article separately exempts consensual, close-in-age sexting among 15-to-17-year-olds and a 15-to-17-year-old's own self-distributed material from both the abuse and viewing offenses.

Act No. 90/2018 carries the General Data Protection Regulation (GDPR) breach-notification duties into Icelandic law: a controller must notify Personuvernd without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms, and must notify affected individuals without undue delay where the breach is likely to result in a high risk.

No Icelandic-specific timeline departure was found; this dimension rests on secondary commentary corroborating the Act's GDPR-mirroring structure rather than the breach-notification section's own text.

Iceland is not an EU member, so the General Data Protection Regulation (GDPR) does not apply directly. GDPR reaches Iceland through EEA Joint Committee Decision No. 154/2018, incorporating it into the EEA Agreement, and Act No. 90/2018 gives that incorporation domestic legal force. The Act's own Article 2 names Decision No. 154/2018 as the incorporation mechanism, and the Act reproduces the GDPR text itself as an appendix. Persoonuvernd (the Icelandic Data Protection Authority) is the supervisory authority.

Privacy law is a settled, fully in-force regime in Iceland since 2018, distinct from Iceland's AI-law posture, where the EU AI Act's own EEA incorporation was still pending as of August 2026.

Article 16 of Act No. 90/2018 provides that a European Commission adequacy decision under General Data Protection Regulation (GDPR) Article 45 applies in Iceland only in accordance with the EEA Joint Committee's own decision, and requires the Minister to confirm such decisions and publish notice in the Law Gazette before they take domestic effect. This is a genuinely distinctive two-step mechanism: an adequacy decision does not apply automatically the moment the Commission adopts it.

Otherwise, a transfer outside the EEA requires appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49-equivalent derogation; transfers within the EEA, including to Norway and Liechtenstein, move freely.

Act No. 90/2018 carries the General Data Protection Regulation (GDPR) data subject rights, access, rectification, erasure, restriction, portability, and objection, into Icelandic law, including the qualified Article 22-equivalent right against a decision based solely on automated processing. Rights are exercisable against the controller, with Personuvernd as the escalation path for a complaint. No Icelandic-specific timeline departure from GDPR's one-month response window was found.

Persoonuvernd holds investigative and corrective powers and administrative-fine authority. Because General Data Protection Regulation (GDPR) reaches Iceland through national legislation rather than direct EU regulation applicability, Act No. 90/2018 sets Iceland's fine ceiling in Icelandic krona rather than by direct reference to the EUR-denominated GDPR figures.

Article 46 of the Act itself confirms a lower tier of ISK 100,000 to 1.2 billion or 2 percent of worldwide annual turnover and a higher tier of ISK 100,000 to 2.4 billion or 4 percent, mirroring the GDPR Article 83(4)/(5) structure, alongside daily compulsion fines under Article 45 and a criminal-penalty track for deliberate breaches. Individuals may seek compensation for material or non-material damage, mirroring GDPR Article 82.

Act No. 90/2018 Article 3, item 14 defines biometric data as personal data obtained through specific technical processing relating to a person's physical, physiological or behavioural characteristics that allow or confirm unique identification, and gives facial images and fingerprint data as illustrative examples using a non-exhaustive such as construction. It does not name voiceprints or voice data anywhere in this definition.

Article 9 prohibits processing biometric data for the purpose of uniquely identifying a natural person absent an Article 9(2)-style exception such as explicit consent, mirroring General Data Protection Regulation (GDPR) Article 9 with no Iceland-specific narrowing or widening found.

Article 229 punishes whoever without authorization obtains access to data or programs of others stored in computer-readable form, with fines or imprisonment of up to one year, unless the conduct is justified by reference to public or private interests.

The provision is not limited to defeating a technical access control, but it does not by its own terms reach merely reading a page that carries no such control; no reported Icelandic decision has applied it to open-web scraping of a public, unauthenticated page.

This text replaced an earlier version of Article 229 by Act No. 8/2021, which took effect on the date of the Act's own publication; an earlier English translation of the Code (via a secondary legislation-tracking site) attributed similarly worded unauthorized-access language to Article 228, which the same 2021 amendment rewrote into a separate privacy-intrusion offense, so a citation to "Article 228" for this duty predates the current numbering.

Article 50 gives the maker of a catalogue, table, form, database, or similar work containing a substantial collection of information, or that is the result of a substantial investment, the exclusive right to reproduce or publish the work in whole or in a substantial part.

Repeated and systematic extraction or re-utilisation of an insubstantial part of the database is prohibited where it conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests. The right lasts 15 years from the turn of the year following the database's creation, or, if published within that period, 15 years from the turn of the year following publication.

A person entitled to use a database has a separate statutory right to the actions necessary to access and make normal use of its content, and the right runs alongside, rather than displacing, any copyright the database's contents separately carry.

This article implements the EU Database Directive (96/9/EC); the Act carries no text-and-data-mining exception, since the later Digital Single Market Copyright Directive (2019/790), which would add one, has not been incorporated into the EEA Agreement in a form binding Iceland.

Article 7 requires an operator of essential services or a provider of digital services within the Act's scope to maintain a documented policy and processes to assess, manage and minimise the risk to the security of its network and information systems, including risk from rare events with serious consequences, to set a security policy, perform regular risk assessments, and determine and re-assess security measures, both technical and organisational, on that basis, with access control and regular testing against current international best-practice benchmarks.

It also requires a documented incident-response plan and a business-continuity plan to limit damage from a serious operational disruption, covering incident logging, root-cause analysis, restoration of normal operation, and prevention of recurrence, backed by an active internal-control system. The duty binds an operator of essential services in the digital-infrastructure sector, defined as an internet exchange point, a domain-name-system service provider, or a top-level domain registry.

It also binds a provider of digital services operating an online marketplace, an online search engine, or a cloud computing service, other than a provider that qualifies as a micro-enterprise under the Act on Annual Accounts. The Act's other essential-service sectors, banking and financial-market infrastructure, transport, health services, and energy, heating and water utilities, carry the same duty but are gated by sector and criticality criteria this vocabulary does not express.

Article 8 requires an operator of essential services or a provider of digital services within the Act's scope to notify Iceland's national cybersecurity incident-response team of a serious incident or risk threatening the security of its network and information systems as soon as may be, with severity assessed by the number of users affected, the duration of the incident, its geographic spread and scale, and its possible effect on other critical infrastructure or on economic and social activity or digital services; the notification must also disclose any outsourcing arrangement the operator relies on and any possible cross-border contagion effect.

The duty carries no fixed reporting-clock deadline of its own, unlike the tiered 24-hour, 72-hour and one-month clock of the EU's NIS2 Directive. An operator in banking and financial-market infrastructure instead notifies under Regulation (EU) 2022/2554 (DORA) and Iceland's implementing act. The duty binds the same digital-infrastructure and digital-service-provider population as Article 7, and the same broader, sector-gated essential-service categories that this vocabulary cannot express.

Article 28 bars a media service provider that distributes audio or video content from distributing content, including commercial audio or video communications, that could have a harmful effect on a child's physical, mental, or moral development, in particular pornography or gratuitous violence, subject to watershed-hour, technical-restriction, and news-content exceptions for linear programming.

Since Act No. 27/2024 transposed the revised Audiovisual Media Services Directive as incorporated into the EEA Agreement by EEA Joint Committee Decision No. 337/2022 of 9 December 2022, a video-sharing platform provider established in Iceland or directing content to the Icelandic public must, under the new Article 36.a, take appropriate measures to protect children from content, user-generated content, and commercial communications that could harm their physical, mental, or moral development, and, under Article 36.d, must among other things establish and operate an age-verification system for users with regard to content that could harm a child's physical, mental, or moral development, alongside a flagging system, a user-controlled parental-control system, and media-literacy measures.

The Media Commission enforces both duties with administrative fines of up to ISK 10,000,000, and may not process a child's personal data collected under the parental-control or age-verification measures for commercial purposes such as direct marketing or profiling.

Article 14 permits, without the copyright owner's consent, a quotation from a published literary work, including a stage work, and a published film work or musical work, where the quotation is made in connection with criticism, science, general presentation, or another recognised purpose, provided it is made within reasonable limits and the material quoted is correctly represented.

The same conditions permit publishing images and drawings of published works of art. The provision carries no headline-length or short-extract cap distinct from this fair-practice test, is not restricted to press or news content, and no reported Icelandic decision applies it to a systematic news aggregator rather than an individual quoting a published work.

The Act's own consolidated text carries no separate press-publisher neighbouring right and no text-and-data-mining opt-out exception of the kind the EU's Digital Single Market Copyright Directive would add once incorporated into the EEA Agreement. The provision's own commencement date is not stated in the consolidated text or in the sources checked, and it carries no amendment footnote in the current text, indicating it is original to the 1972 Act.