persónuverndarskrár

Persónuverndarskrár are internal documents used in Iceland to describe how an organization processes personal data. The term, meaning roughly “privacy processing records,” refers to comprehensive descriptions of an entity’s data processing activities and is part of the country’s data protection framework, aligned with the EU General Data Protection Regulation (GDPR) and Icelandic data protection law.

A persónuverndarskrá typically includes details such as the categories of personal data processed, the purposes of processing, the legal basis for processing, and the recipients or categories of recipients of the data. It also covers transfers to third countries or international organizations, retention periods or criteria for determining retention, and the security measures implemented to protect data. In addition, the document should describe data subject rights and how individuals can exercise them, as well as contact information for the controller or data protection officer.

The purpose of persónuverndarskrár is to provide an overall, up-to-date account of how personal data is handled within an organization. They support accountability, risk assessment, and compliance with data protection requirements. Where processing is extensive or poses high risks to individuals, the records may be used in conjunction with data protection impact assessments (DPIAs) and other compliance activities.

Persónuverndarskrár are distinct from privacy notices given to data subjects. The former are internal records for the organisation and supervisory authorities, while the latter are communications to individuals about how their data is processed. Persónuverndarskrár are typically maintained by controllers or processors and updated whenever processing activities change. They may be reviewed by the Icelandic Data Protection Authority (Persónuvernd) in audits or inquiries.