Persónuverndarskrá

Persónuverndarskrá, or the Personal Data Protection Act, is a foundational Icelandic law governing the collection, storage, and processing of personal data. Enacted to align with the European Union’s General Data Protection Regulation (GDPR) and ensure robust privacy protections, it applies to both public and private entities handling personal information. The law establishes strict rules on data collection, requiring explicit consent from individuals before processing their data, and mandates transparency in how data is used.

Key principles of the act include data minimization, meaning only necessary information should be collected, and purpose limitation, ensuring data is processed for specified, explicit, and legitimate reasons. Individuals have the right to access their personal data, request corrections, and, under certain conditions, request its deletion. The law also grants the right to object to data processing and to restrict how data is used.

The Icelandic Data Protection Authority (Persónuvernd) oversees compliance with the act, investigating violations and imposing penalties for non-compliance. Organizations found breaching data protection rules may face fines, particularly if they fail to notify authorities or affected individuals of data breaches in a timely manner. The act also emphasizes international data transfers, requiring adequate safeguards to protect personal data when shared with entities outside Iceland or the EU.

Persónuverndarskrá reflects Iceland’s commitment to safeguarding individual privacy in an increasingly digital world, balancing innovation with the protection of fundamental rights. It applies to all entities operating within Iceland, including businesses, government agencies, and public institutions, ensuring consistent protection across sectors.