Persónuverndarskyldur

Persónuverndarskyldur, a term in Icelandic law and data protection, translates to data protection obligations or responsibilities. These refer to the duties placed upon individuals and organizations that process personal data. The primary legal framework governing these obligations in Iceland is the Personal Data Protection Act, which is largely aligned with the European Union's General Data Protection Regulation (GDPR).

These obligations encompass a range of principles and requirements designed to safeguard individuals' privacy. Key among them is the principle of lawfulness, fairness, and transparency, meaning data must be processed legally, fairly, and with clear information provided to the data subject. Data minimization is another crucial obligation, requiring that only data necessary for a specific purpose is collected and processed. Accountability is also central, obligating data controllers to demonstrate compliance with data protection rules.

Furthermore, persónuverndarskyldur include the duty to ensure data accuracy, purpose limitation, and storage limitation. Organizations must implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. They also have obligations regarding data subject rights, such as the right to access, rectification, erasure, and restriction of processing. Reporting data breaches to the supervisory authority and affected individuals is another significant responsibility. Failure to adhere to these obligations can result in substantial fines and reputational damage.