persónuupplýsingalögum

Persónuupplýsingalög refer to the Icelandic legislation governing the processing of personal data, with the aim of protecting privacy and the fundamental rights of individuals. The rules operate in harmony with the European Union’s General Data Protection Regulation (GDPR), reflecting Iceland’s participation in the European Economic Area. The main provisions cover the collection, storage, use, disclosure and transfer of personal data, as well as the conditions under which data may be processed.

Key concepts in the laws include data controllers and data processors, who are responsible for ensuring that processing is lawful, fair and transparent. Processing must have a legal basis, such as consent, contract, legal obligation, vital interests, official authority, or legitimate interests balanced against individuals’ rights. Data subjects have rights including access to their data, rectification, erasure, restriction of processing, objection and data portability. Special protections may apply to the processing of children’s data.

The legislation emphasizes transparency through privacy notices, and requires data protection by design and by default, along with impact assessments for high-risk processing. Security measures appropriate to the risk level must be implemented, and data breaches must be reported to the Icelandic Data Protection Authority, Persónuvernd, and, where applicable, to affected individuals.

Transfers of personal data to third countries are restricted unless the recipient provides adequate protections or appropriate safeguards, such as standard contractual clauses or an adequacy decision. Enforcement and penalties for non-compliance fall under Persónuvernd, which can investigate, issue corrective orders, and impose sanctions. The persónuupplýsingalög are periodically updated to reflect GDPR developments and national considerations.