Persónuverndarfulltrúa

Persónuverndarfulltrúa is the Icelandic term for a Data Protection Officer (DPO). This role is established under the General Data Protection Regulation (GDPR), which is implemented in Iceland through national legislation. The primary responsibility of a persónuverndarfulltrúa is to oversee the organization's data protection strategy and its implementation in compliance with GDPR.

Key duties of a persónuverndarfulltrúa include advising and monitoring the organization regarding data protection obligations, acting as a point of contact for data subjects and the supervisory authority (in Iceland, this is the Data Protection Authority, Persónuvernd), and contributing to data protection impact assessments. They should be independent and report directly to the highest management level within the organization.

Not all organizations are required to appoint a persónuverndarfulltrúa. The GDPR mandates a DPO for public authorities, organizations whose core activities involve regular and systematic monitoring of data subjects on a large scale, or organizations processing special categories of personal data or data relating to criminal convictions and offenses on a large scale. Even if not mandatory, appointing a DPO can be beneficial for organizations committed to strong data protection practices. The persónuverndarfulltrúa must possess expert knowledge of data protection law and practices.