{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"LOGOS","Áslaug Björgvinsdóttir"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 5/1/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
["Question","Iceland"]
["Key Legislation Overview"]
["What is the key legislation?","The \nAct on Data Protection and the Processing of Personal Data No. 90/2018.Note: On July 15, 2018, the \nIcelandic Act on Data Protection and the processing of Personal Data No. 90/2018 (the “\nData Protection Act” or the “\nAct”) entered into force, repealing the \nAct on the Protection and Processing of Personal Data No. 77/2000. The \nAct implements \nRegulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“\nGDPR”).\nSince the \nData Protection Act entered into force the Data Protection Authority has issued some regulations, rules and public guidelines, such as on the processing of personal data in police records and for enforcement purposes (\nregulation no. 577/2020), rules on the licensing of the processing of personal data (\nrules no. 811/2019), advertisement on processing actives that require a data protection impact assessment (\nadvertisement no. 828/2019) and guidelines on data protection officers, guidelines on consent, guidelines on data breach and guidelines for processors guidelines for the implementation of information technology systems for processing children's personal information. \nFurthermore, the rules and guidelines published by the Data Protection Authority on the basis of the previous \nAct No. 77/2000 remain in force provided that they are not in violation of the new \nAct. These are, among others, \nrules on electronic surveillance no. 837/2006,\n rules concerning the security of personal data (Rules No. 299/2001), rules on employers’ supervision of employee’s emails (\nAdvertisement No. 1001/2001) and rules on the transfer of personal data over borders (\nAdvertisement No. 228/2010).\n"]
["Key Data Protection Provisions"]
["What data is protected?","The \nData Protection Act protects personal data as defined in the \nAct.\nNote: Personal data in the \nData Protection Act is defined as any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The definition in the Act is based on the definition of personal data provided in \nGDPR.\nExamples of what would be considered personal data include names, addresses, ID numbers, photos and fingerprints.\nSensitive personal data is specifically defined in the \nAct as (i) data on race, ethnic origin, political opinions, religious beliefs, other life philosophies and on trade-union membership; (ii) health data, i.e. data relating to a person’s physical or mental health, including data on the healthcare a person has received and data on use of medical drugs, alcohol and narcotics; (iii) data concerning sex life and sexual behavior; (iv) genetic data i.e. personal data relating to inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person, and which result, in particular, from an analysis of a biological sample from the natural person in question; and (v) biometric data i.e. data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data, provided that the data is processed in order to identify a person with a unique way.\n\n\n \n"]
["Who is subject to privacy obligations?","The \nData Protection Act applies to data controllers and data processors, both in the private and public sector.\nNote: The \nAct specifically defines data controllers as the natural or legal person, public authority or other party which, alone or jointly with others, determines the purposes and means of the processing of personal data. Data processor, however, is a natural or legal person, public authority or other party which processes personal data on behalf of the controller. \nThe \nAct applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form, or are intended to form, part of a filing system. \nThe \nAct applies to the processing of personal data in the context of the activities of a controller or a processor who is established in Iceland, regardless of whether the processing takes place in the European Economic Area or not.\nThe \nAct also applies to the processing of personal data of data subjects in Iceland, conducted in the context of the activities of a controller or a processor, not established in the European Economic Area, or where the processing activities are related to (i) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the European Economic Area; or (ii) the monitoring of their behavior as far as their behavior takes place within the area.\n\n\n \n"]
["What are the principles applicable to personal data processing?"," The Act  sets forth main principles relating to the collection and processing of personal data which must always be adhered to. \n\n Note:  \n\n \n\t The Act  sets forth the main principles relating to the collection and processing of personal data and stipulates that personal data must be: processed in a lawful, fair and transparent manner;  \n\t collected for explicitly specified, legitimate and objective purposes and not processed further for other and incompatible purposes; further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that proper safeguards are adhered to; \n\t adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; \n\t reliable and kept up to date when necessary, personal data which are unreliable or incomplete, having regard to the purposes of their processing, shall be erased or rectified; \n\t preserved in a form which does not permit the identification of data subjects for longer than is necessary for the purposes of the processing;  \n\t processed in a manner that ensures appropriate security of the personal data. \n \n\n \nThe controller is responsible for and must be able to demonstrate its compliance with the above principles.  \n"]
["How is the processing of personal data regulated?","The processing of personal data requires a legal basis under the \nAct. To process sensitive personal data additional requirements must be fulfilled.\n"]
["How are storage, security and retention of personal data regulated?","The data controller and data processor, if any, is responsible for establishing and updating risk analysis procedures and putting security measures in place, in conformity with laws, rules and instructions given by the Data Protection Authority. Data controllers must also routinely conduct internal audits on the security of their processing. Personal data must be erased when an objective reason to preserve it no longer exists.\nNote: The controller shall implement appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with the \nAct, taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons.\nThe controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organizational measures, which are designed to implement data-protection principles and to integrate the necessary safeguards into the processing in order to meet the requirements of the \nAct and protect the rights of data subjects.\nThe controller shall implement appropriate technical and organizational measures for ensuring that, by default, only personal data that are necessary for each specific purpose of the processing are processed.\nBoth the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in cases where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.\nThe controller shall also conduct internal audits on the processing of personal data to ensure that they are processed in accordance with prevailing laws and regulations and the security measures that are to be implemented.\nInternal audits shall be conducted routinely. The frequency and intensity of the audits shall be relative to the danger associated with the processing, the nature of the data processed, the technology used to ensure the security of the data and the cost associated with conducting the audits. They shall nonetheless be conducted at least annually.\nThe controller shall see to it that a report is written on each of the measures that the internal audit is comprised of. In such a report, the results of each part of the audit shall be described. Internal audit reports shall be preserved in a secure manner. The Data Protection Authority has the right to review these reports at any time.\nThe Data Protection Authority has provided instructions on how to conduct internal audits, see \nRules no. 299/2001 on the security of personal data. The \nAct requires that when there is no longer an objective reason to preserve personal data, the controller shall erase them.\n"]
["What are the data subjects' rights?","Data subjects have the right to receive information about the process of their personal data and have the right to request access to and the correction of their personal data.\nNote: The data subject has a right to obtain information about processing, regardless of whether the personal data is obtained from the data subject itself or not, as well as a right of access to personal data concerning the data subject, in accordance with \nArticles 13-15 of GDPR, cf. Article 17(2) of the Act.The information that the data controller shall provide the data subject with is among others the identity and the contact details of the controller, the purposes of the processing for which the personal data are intended as well as the legal basis for the processing and the categories of personal data concerned.\nThe data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and other information such as the purposes of the processing, the categories of personal data concerned and the recipients or categories of recipient to whom the personal data have been or will be disclosed. \nWhere the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.\nThe data subject has a right to obtain from the controller the rectification of inaccurate personal data concerning him or her, as well as a right to obtain from the controller the erasure of personal data concerning him or her.\n\n\n \n"]
["Are there restrictions on cross-border data transfers?","The \nAct restricts transfers of personal data to countries outside the \nEEA and to international organizations. Such transfers may only be carried out if the transfer has a legal basis under Chapter 5 of the \nGDPR.\nNote: In the absence of a decision by the European Commission, a controller or processor may transfer personal data to a third country or an international organization only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. \n"]
["Are there any notification requirements for data breaches?","In case of a data breach, the \nAct requires controllers to notify the breach to the Data Protection Authority and in high-risk cases, also to the data subjects.  \nNote: In the case of a personal data breach, the controller must without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the Data Protection Authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.\nIf a data processor becomes aware of a data breach it shall notify the controller without undue delay after becoming aware of it. \nWhen the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subjects affected by the data breach. \n"]
["Who is the privacy regulator?","According to the \nData Protection Act, the Data Protection Authority is responsible for monitoring the application of the \nAct and administrative rules based on it.\nNote: The Icelandic Data Protection Authority (\nICE: Persónuvernd) is an independent authority with a specific board of directors and is administratively subject to the Minister of Justice.\nThe Data Protection Authority acts with independence in exercising its functions and its decisions according to the \nAct cannot be referred to a higher administrative authority.\nThe Data Protection Authority’s main task according to the \nAct is to monitor the application of the \nAct, \nGDPR and other rules on data protection. The Data Protection Authority handles and investigates complaints lodged by a data subject, or by a body, organization or association, and rules whether a violation has occurred. Furthermore, the Data Protection Authority shall inter alia promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing; advise the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing; upon request, provide information to any data subject concerning the exercise of their rights under the \nAct and, if appropriate, cooperate with the supervisory authorities in other Member States to that end and to fulfil any other tasks related to the protection of personal data.\nThe Data Protection Authority has the investigative powers according to \nArticle 58 of GDPR, cf. Article 41 and 42 of the Act. These are, among others, the power to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks; the power to carry out investigations in the form of data protection audits and the power to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks.\n\n\n \n"]
["What are the consequences of a privacy breach?","Noncompliance with the law can result in criminal sanctions, penalties and compensation.\n"]
["How is electronic marketing regulated?","Electronic marketing is regulated by the \nElectronic Communication Act No. 81/2003 and direct marketing requires the prior consent of the recipient.\n"]
["Are there any recent developments or expected reforms?","The \nData Protection Act entered into force on July 15, 2018, implementing \nGDPR. No further developments of the legislative text are expected at this time.\n"]