Persónuverndarkröfur

Persónuverndarkröfur are formal requests made by individuals in Iceland to obtain information about personal data that organizations or public authorities hold about them. The term stems from the Icelandic word *persónuvernd*, meaning privacy, and reflects Iceland’s commitment to protecting personal data under national and European law.

The regulation of these requests is governed mainly by the Icelandic Data Protection Act (Persónuverndarlög) and the European Union’s General Data Protection Regulation (GDPR), which Iceland follows closely through the European Economic Area agreement. Under the law, anyone whose data is processed has the right to request: access to the data, correction of inaccuracies, deletion or restriction of processing, and, in certain circumstances, the right to object or to obtain a data portability file.

To make a persónuverndarkröfu a person must submit the request in writing to the designated data controller or the supervisory authority. The Icelandic Data Protection Authority (Persónuverndarmanninn) is the central body that ensures compliance. Requests must include identifying details and a clear description of the information sought. The data controller is obliged to respond within one month of receipt of the request, or within two months in complex cases. If a request is denied, the person has the right to appeal to the Authority, which can impose fines or other sanctions on non‑compliant entities.

Because persónuverndarkröfur apply to both public and private organizations that process personal data, individuals must be aware of how to specify their request and what evidence may be needed to verify identity. The process is designed to balance data subjects’ rights with organizational responsibilities, promoting transparency and accountability in data handling.