persónuupplýsingalög

Persónuupplýsingalög translates to Data Protection Act in English and refers to the primary legislation governing the processing of personal data in Iceland. This law is largely based on the European Union's General Data Protection Regulation (GDPR), ensuring a high standard of data privacy for individuals. The Act outlines the principles and rules for how organizations, both public and private, must collect, store, use, and share personal information.

Key aspects of the Persónuupplýsingalög include the rights afforded to individuals regarding their data. These rights typically encompass the right to access their personal data, the right to rectification if the data is inaccurate, and the right to erasure, often referred to as the "right to be forgotten." Individuals also have the right to restrict processing, object to processing, and the right to data portability.

The law places significant obligations on data controllers and processors, requiring them to implement appropriate technical and organizational measures to ensure the security and confidentiality of personal data. This includes conducting data protection impact assessments for high-risk processing activities and appointing a data protection officer in certain circumstances. The Act also establishes the Icelandic Data Protection Authority (Persónuvernd) as the supervisory authority responsible for enforcing the law and handling complaints. Persónuvernd can investigate potential breaches and impose sanctions, including fines, for non-compliance. The goal of Persónuupplýsingalög is to safeguard the privacy of individuals in an increasingly digital world by ensuring responsible and lawful data handling.