Jurisdiction Guides / Europe
Iceland Privacy & Data Protection Laws
Every regime below can apply to a business handling Iceland residents' data, depending on whether you have an established presence there, actively offer goods or services to residents, or monitor their behavior. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
Like Norway, Iceland applies the GDPR as national law through the EEA Agreement, implemented by Act No. 90/2018. Same Article 3 territorial test — established presence, offering goods/services, or monitoring behavior — with national derogations on matters the GDPR devolves to states (the age of digital consent is 13). Supervised by Persónuvernd (the Icelandic Data Protection Authority). Practically relevant to businesses that assume 'EU coverage' is enough: Iceland requires its own supervisory contact and, for controllers without an EEA establishment, an EEA representative under Article 27.
Cross-Border Data Transfer · 1
As in Norway: Iceland is in the EEA, transfers within the EEA are unrestricted, and exports outside it follow GDPR Chapter V unchanged, supervised by Personuvernd. Marked 'check' for the same reason — the incorporation is well established but the national text was not read in the Icelandic original.
Data Security & Breach Notification · 1
As in Norway, the GDPR breach articles apply in Iceland as national law through the EEA Agreement, with the same 72-hour authority deadline and the same high-risk trigger for notifying individuals. The supervisory authority is Personuvernd. Marked 'check' for the same reason as the Norwegian entry: the incorporation is well established, but the national procedural detail was not read in the Icelandic original.
Other Europe jurisdictions