persónuverndarlaga

The **persónuverndarlaga** (Personal Data Protection Act) is an Icelandic law designed to regulate the processing of personal data and protect individuals' privacy rights. Enacted in 2018, it aligns Icelandic legislation with the European Union’s General Data Protection Regulation (GDPR), ensuring consistent data protection standards across the European Economic Area. The law applies to both public and private entities that collect, store, or process personal information, including names, contact details, financial data, and digital identifiers.

Key provisions of the **persónuverndarlaga** include the requirement for explicit consent before data collection, the right of individuals to access their personal data, and the obligation to report data breaches promptly. Organizations must implement measures to safeguard data from unauthorized access or misuse, and individuals have the right to request corrections or deletions of inaccurate or irrelevant information. The law also establishes the **Alþingis neðanmeðferðarráðuneyti** (Ministry of Justice) as the supervisory authority, though enforcement is primarily handled by the **Alþingis neðanmeðferðarráðuneytis starfsembætti** (Office of the Data Protection Authority).

Non-compliance with the **persónuverndarlaga** can result in fines, particularly for violations involving large-scale data breaches or systemic neglect of privacy rights. The law emphasizes transparency, accountability, and individual empowerment, reinforcing Iceland’s commitment to digital privacy and modern data governance practices. It reflects broader trends in global data protection, balancing innovation with the protection of fundamental rights.