Act 2018
Lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018 (Act No. 90/2018 on Data Protection and the Processing of Personal Data)
Issued by Persónuvernd (Icelandic Data Protection Authority)
Effective: 15 Jul 2018
Plain-English summary
Gives the GDPR force of law in Iceland (Art. 2) and supplements it. Art. 27 requires breach notification to Persónuvernd, Arts. 17 to 22 cover data subject rights and Art. 46 sets administrative fines.
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful processing, notice and data subject rights | — | Persónuvernd (Icelandic Data Protection Authority) | source | |
Art. 2 gives the GDPR the force of law. Arts. 17 to 22 of the Act cover information and access, correction, erasure, restriction and portability, objection and profiling, and automated decision-making, with the exceptions set out there. |
||||
| Personal data breach notification | Deadline Without undue delay and, if possible, within 72 hours | Persónuvernd (Icelandic Data Protection Authority) | source | |
Art. 27 requires the controller to notify Persónuvernd of a personal data breach without undue delay and, where possible, within 72 hours of becoming aware, unless the breach is unlikely to pose a risk to individuals. Data subjects must also be told without undue delay when the risk is high. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.