Iceland

Article 7 of Act No. 90/2018 sets out who the law covers. It covers any company established in Iceland that uses or stores personal data, wherever the work physically happens. It also covers companies with no office in the European Economic Area that handle data about people in Iceland. That applies where they offer those people goods or services, or watch what they do. The General Data Protection Regulation was brought into the EEA Agreement by EEA Joint Committee Decision No. 154/2018 of 6 July 2018. It entered into force in the EEA on 20 July 2018. Act No. 90/2018 gives it effect in Iceland from 15 July 2018. The duty to name a representative in Europe comes from Article 27 of the Regulation. It is not a separate Icelandic rule.

Here is each industry, checked 18 August 2026. ACCOUNTING AND TAX RECORDS, for every registered company in every industry. Article 20 of the Bookkeeping Act No. 145/1994 says all books, accounting data and vouchers must be kept 'hér á landi', meaning here in the country. You must keep them securely for seven years from the end of the financial year. There is a narrow permission to keep them abroad for up to six months. The authorities may demand them back in Iceland within a reasonable time. We rate this a mirror rule. HEALTH. Regulation No. 550/2015 on health records allows an outside host only if it holds ISO 27001 certification or equivalent. It allows a host abroad only where you meet the conditions for sending personal data out of the country under the data protection law. We rate this conditional. FINANCE, covering banking, payments, insurance and securities. The European operational resilience regulation known as DORA has applied in Iceland since 1 July 2025. It does not require data to stay in the country. It does make you state in the contract where data will be held and used, keep a register of your arrangements, and hold exit plans. We rate this conditional. TELECOM. We could not confirm whether a duty to keep traffic data survives in the Electronic Communications Act No. 70/2022. See the unconfirmed list. Article 109 of the 2022 Act repealed the old Act No. 81/2003. GOVERNMENT CLOUD, EDUCATION, GAMING, MAPPING AND GEOSPATIAL, DEFENCE. We found no rule requiring data to stay in the country, checked 18 August 2026, medium confidence.

Article 16 of Act No. 90/2018 makes European Commission approvals of foreign countries work in Iceland. But the minister must confirm each decision and publish notice of it in Stjórnartíðindi, the official gazette. This has been done, so the destinations Europe has approved are available from Iceland. Still, the confirmation step is a real dependency. Reading the European list alone is not enough. The model is this: you may only send data to approved countries, and everything else needs paperwork. Approved destinations need nothing extra. The 2021 Standard Contractual Clauses are still the ones to use. There is also an Icelandic rule specifically on sending data abroad, rules No. 1155/2022 on the transfer of personal data to other countries. It is listed on the regulator's own page of laws. We could not retrieve its text, because the gazette site refused automated access. So we could not confirm its detailed conditions.

The 2025 annual report shows live enforcement. It fined the Capital Area Primary Health Care service 5 million krónur (about 36,000 US dollars) for unlawful sharing inside a health records system. It also issued a 12 million króna fine (about 88,000 US dollars), reduced to 8 million (about 58,000 US dollars) after a court challenge. In June 2026 the authority finished audits it started itself, of the National Prosecutor, district prosecutors and police commissioners. It found security measures had not been fully put in place. It closed the audits with formal guidance rather than orders, and said it will check again a year later. Industry regulators enforce alongside it. The Central Bank of Iceland supervises financial firms, including under the European operational resilience regulation. The Directorate of Health oversees health records. The Electronic Communications Office of Iceland and its national cyber team CERT-IS handle cyber incidents. Bookkeeping crimes are investigated by the district prosecutor and the tax investigation authority, not by the privacy regulator.

Bookkeeping Act No. 145/1994, Article 20, sets seven years from the end of the financial year, kept in Iceland. It allows only six months' tolerance for holding the records abroad. Cash register records run three years. Icelandic law sets no general maximum keeping period. The limit comes from the storage limitation rule in the European Regulation, applied case by case, plus each person's right to erasure. The right to erasure does not apply where you need the data to meet a legal duty. That is how the conflict resolves. Health records have their own rules under the Health Records Act No. 55/2009. Records must be kept securely in a health record system. If a system closes, they pass to the Director of Health. We could not confirm the rules on keeping telecom traffic data. See the unconfirmed list.

The 72-hour deadline is the standard European one. Iceland applies it through Act No. 90/2018. Act No. 78/2019 covers the security of network and information systems in critical infrastructure. It entered into force on 1 September 2020. It requires operators to notify the cyber security unit 'svo fljótt sem verða má', meaning as quickly as possible, about serious incidents or risks. It sets no fixed hour count. That is unusual, and it means the real deadline is judged after the fact. That Act carries daily penalties up to 500,000 krónur (about 3,600 US dollars). It also carries fines up to 10 million krónur (about 73,000 US dollars), or 3 percent of annual turnover. Deliberate breaches carry up to two years in prison. The financial-sector deadline comes from Regulation (EU) 2022/2554, in force in Iceland since 1 July 2025. We did not confirm its exact Icelandic reporting hours. We could not confirm any telecom-specific breach notification duty in the Electronic Communications Act No. 70/2022.

The 13-year threshold is in Article 10 of Act No. 90/2018. Fines on public authorities are directly allowed by Article 46(4). Uses of data that need a licence are governed by rules No. 811/2019, and Persónuvernd runs an application route for them. Bookkeeping penalties sit in Articles 36 to 41 of the Bookkeeping Act. Ordinary breaches carry fines. Serious ones carry up to six years in prison. The company is liable whether or not any individual was at fault. The district prosecutor and the tax investigation authority investigate. Trap 5 has a concrete result. From 12 January 2027 Europe gives you the right to switch cloud provider with no charges for moving your data out. That is not an Icelandic right today, because the Data Act is not part of Icelandic law.

Four changes can happen without new legislation, and they matter more than pending bills. (1) The EEA Joint Committee can bring in any of the three pending acts at a single meeting. The effect in Iceland then follows quickly. The Data Act in particular would switch on rights to move cloud provider and to move your data out free of charge. Those rights do not exist here today. (2) Under Article 16 of Act No. 90/2018 the minister controls whether and when a European approval of a foreign country is confirmed and published in the Icelandic gazette. That works without legislation. (3) Persónuvernd's licensing rules let it decide which uses of data need a licence before you start. (4) The six-month tolerance for holding accounting records abroad is an allowance, not a right. The authorities can demand the records back in Iceland at any time. At European level, pressure on the EU-US Data Privacy Framework carries through to Iceland. It remained in force and valid on 18 August 2026. But the European Data Protection Board wrote to the Commission on 31 July 2026. It asked the Commission to examine whether recent United States changes affect the decision's validity. Do not build your transfers on that one route alone.