Businesses and public bodies collect more and more information about us. In Iceland, data protection law protects your rights over your own data. Here are the main rights and obligations.
What is personal data?
Personal data is any information that can be linked to an identifiable person: name, ID number (kennitala), email address, location and much more.
Iceland applies the EU General Data Protection Regulation (GDPR) through its Data Protection Act of 2018, so the rules are the same as in the EU.
Your rights
You have the right to access the data a business holds about you, to have it corrected if it is wrong and, in certain cases, to have it deleted. You can also object to processing and ask to receive your data in a portable format.
Organisations must normally respond to your request within one month, free of charge.
Duties of businesses
Businesses that process personal data have significant obligations. They need a lawful basis for processing, must inform people about it, keep the data secure and respect individuals' rights.
Personal data breaches must in most cases be reported to the authority within 72 hours. Breaches of the rules can lead to substantial fines.
When your data protection is violated
If you believe your rights have been violated, for example through unlawful processing or a data leak, you can complain to the Icelandic Data Protection Authority (Persónuvernd), which supervises the law. You may also be able to claim compensation for damage.
These cases fall under data protection, IT and telecoms law.
Compliance for businesses
For businesses operating in Iceland, complying with data protection rules is essential to avoid fines and damage to their reputation. A lawyer can help with privacy policies, contracts with processors and handling incidents if they occur.
Getting legal help
Find a lawyer under data protection, IT and telecoms law or browse lawyers in your region.