Act on Data Protection and the Processing of Personal Data No. 90/2018

Like Norway, Iceland applies the GDPR as national law through the EEA Agreement, implemented by Act No. 90/2018. Same Article 3 territorial test — established presence, offering goods/services, or monitoring behavior — with national derogations on matters the GDPR devolves to states (the age of digital consent is 13). Supervised by Persónuvernd (the Icelandic Data Protection Authority). Practically relevant to businesses that assume 'EU coverage' is enough: Iceland requires its own supervisory contact and, for controllers without an EEA establishment, an EEA representative under Article 27.