Data protection and IT lawyers in Iceland

Data protection, IT and telecoms law covers how personal data may be collected and used, the contracts and liability around software and IT services, cyber security, and the regulation of telecommunications and electronic communications.

Data protection

Iceland applies the EU General Data Protection Regulation (GDPR) through the Data Protection Act No. 90/2018. The rules are supervised by the Icelandic Data Protection Authority (Persónuvernd), which handles complaints and can impose fines of up to €20 million or 4% of global turnover.

• Individuals have the right to access, correct and delete their data and to object to its processing.
• Organisations need a lawful basis, must inform people, keep data secure and report breaches within 72 hours.
• Monitoring of employees, camera surveillance and the use of the national ID number (kennitala) are subject to specific rules.

Read data protection in Iceland for individuals' rights.

Electronic communications and cyber security

Telecom operators and internet services are regulated by the Electronic Communications Act, supervised by the Electronic Communications Office of Iceland (Fjarskiptastofa). Operators of essential services and digital service providers must meet security requirements under Act No. 78/2019 on the security of network and information systems.

IT contracts

Software licences, cloud services, development projects and outsourcing all depend on clear contracts covering ownership of code, service levels, liability and data processing. When a supplier processes personal data for you, a data processing agreement is mandatory under the GDPR.

When to contact a data protection or IT lawyer

Seek advice when you launch a service that processes personal data, after a data breach, when Persónuvernd opens a case, when you negotiate a major IT or cloud contract, or if your rights over your own data are not respected. For software ownership, see also intellectual property law.