What Is Act No. 90/2018, Act on Data Protection and the Processing of Personal Data?
Iceland is an EEA/EFTA country rather than an EU member state. Act No. 90/2018 entered into force on 15 July 2018, and its §2 gives the GDPR force of law in Iceland through incorporation into the EEA Agreement, subject to EEA adaptations. The current Althingi law-collection edition is 158a, dated 1 October 2026, reflecting amendments through Act No. 16/2023. GDPR Chapter III rights apply with Icelandic qualifications. Act §6 permits derogation for processing solely for journalism or artistic/literary expression, while no separate academic-expression exception was located. Section 18 permits limited disapplication of specified rights for qualifying research, statistical, and archival processing. Persónuvernd is the ordinary national supervisory authority. Complaints must be handled within a reasonable time, but no fixed statutory resolution deadline expressed in days or months was located; the 12-month figure is an administrative estimate, not a statutory deadline. No general Iceland-specific data-broker or public-record deletion route was located, although licensed financial-information bureaus have a narrow public-acts deletion duty under Regulation No. 606/2023.
At a glance
- Full name
- Act No. 90/2018, Act on Data Protection and the Processing of Personal Data
- Short code
- Act No. 90/2018 + GDPR
- Jurisdiction
- Iceland
- Enacted
- 2018
- Last major update
- Current Althingi law-collection edition 158a dated 1 October 2026, reflecting amendments through Act No. 16/2023; GDPR incorporated through EEA Joint Committee Decision No. 154/2018
- Regulator
- Persónuvernd
- Private right of action
- Limited
Scope, who Act No. 90/2018 + GDPR covers
Protected data
Data subject rights
Transparency and access rights under GDPR Articles 12-15, subject to §17 restrictions
Rectification under Article 16, subject to §17 and §18 exceptions
Erasure under Article 17, subject to GDPR exceptions and limited §18 research and archival disapplication
Restriction of processing under Article 18
Data portability under Article 20 in structured, machine-readable form
Objection under Article 21, including objection to direct marketing
Human-intervention and contest rights concerning automated decisions under Article 22
Right to complain to Persónuvernd; anonymous complaints are not accepted
Notable features
Iceland incorporates GDPR through the EEA Agreement rather than through direct EU-law application. Its distinctive qualifications include a narrow journalism and artistic/literary-expression rule, research and archival exceptions under §18, kennitala controls under §13, and a credit-information regime whose listed provisions notably exclude §46 administrative fines.
Enforcement & penalties
Regulator: Persónuvernd
Penalties: A daily non-compliance fine may reach ISK 200,000 for each day an order is not followed. Lower-tier administrative fines under §46 range from ISK 100,000 to ISK 1.2 billion, or 2% of worldwide turnover for a company, whichever is higher. Higher-tier fines for principles, consent, rights, transfer, or order non-compliance range from ISK 100,000 to ISK 2.4 billion, or 4% of worldwide turnover, whichever is higher. Particularly serious intentional conduct may carry up to three years imprisonment. Section 15’s narrower financial-information regime includes §45 but not §46 among its applicable provisions.
Private right of action: The Persónuvernd complaint and supervisory-enforcement route is the identified mechanism; no general private damages action under Act No. 90/2018 was identified.
Relevance to data brokers
No Iceland-specific general data-broker opt-out portal, broker-directory complaint route, or general public-record deletion route was located. Regulation No. 606/2023 provides a narrow mechanism for licensed financial-information bureaus, including access, rectification, erasure, restriction, and objection rights and a requirement to delete public-acts information once it no longer satisfies the regulation’s conditions.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does GDPR apply directly in Iceland?+
No. Act No. 90/2018 gives the GDPR force of law in Iceland through incorporation into the EEA Agreement, subject to EEA adaptations, via EEA Joint Committee Decision No. 154/2018.
Is there a fixed deadline for Persónuvernd to resolve a complaint?+
No fixed statutory resolution deadline expressed in days or months was located. The statutory standard is a reasonable time; the 12-month period described in government guidance is an administrative estimate and may be longer for complex cases.
Does Iceland have a data-broker deletion route?+
No general Iceland-specific data-broker or public-record deletion route was located. A narrow licensed-credit-information mechanism requires deletion of public-acts information when it no longer satisfies Regulation No. 606/2023’s conditions.
Official sources & citations
Other international privacy regimes
Act No. 90/2018 + GDPR sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: