Iceland

Article 7 of Act No. 90/2018 sets the territorial reach: the Act applies to processing by a controller or processor established in Iceland regardless of where the processing physically happens, and to processing relating to people in Iceland by organisations with no establishment in the European Economic Area where they offer goods or services to those people or monitor their behaviour. The General Data Protection Regulation itself was incorporated into the EEA Agreement by EEA Joint Committee Decision No. 154/2018 of 6 July 2018 and entered into force in the EEA on 20 July 2018; Act No. 90/2018 gives it effect in Iceland from 15 July 2018. The in-Europe representative duty comes from Article 27 of the Regulation, not from a separate Icelandic rule.

Sector by sector, checked 18 August 2026. ACCOUNTING AND TAX RECORDS (every registered company, all industries): Article 20 of the Bookkeeping Act No. 145/1994 says all books, accounting data and vouchers shall be preserved 'hér á landi' — here in the country — securely for seven years from the end of the financial year, with a narrow permission to keep them abroad for up to six months, and the authorities may demand them back in Iceland within a reasonable time. Rated mirror. HEALTH: Regulation No. 550/2015 on health records allows third-party hosting only with a provider holding ISO 27001 certification or equivalent, and allows foreign hosting only where the conditions for transferring personal data out of the country under the data protection law are met. Rated conditional. FINANCE (banking, payments, insurance, securities): the European operational resilience regulation known as DORA has applied in Iceland since 1 July 2025 and imposes no localisation — but it does force you to state in the contract where data will be processed, keep a register of arrangements and hold exit plans. Rated conditional. TELECOM: we could not verify whether a traffic-data retention duty survives in the Electronic Communications Act No. 70/2022 (see the unconfirmed list); the old Act No. 81/2003 was repealed by Article 109 of the 2022 Act. GOVERNMENT CLOUD, EDUCATION, GAMING, MAPPING AND GEOSPATIAL, DEFENCE: no localisation rule found, checked 18 August 2026, medium confidence.

Article 16 of Act No. 90/2018 makes European Commission adequacy decisions operative in Iceland, but requires the minister to confirm the decision and publish notice of it in Stjórnartíðindi, the official gazette. In practice this has been done, so the destinations Europe has approved are available from Iceland — but the confirmation step is a real dependency and a naive reading of the European list alone is wrong. The model is best described as an allowlist with safeguards: approved destinations need nothing extra, everything else needs an instrument. The 2021 Standard Contractual Clauses remain the operative set. There is also an Icelandic instrument specifically on transfers abroad, rules No. 1155/2022 on the transfer of personal data to other countries, listed on the regulator's own page of laws; we could not retrieve its text (the gazette site refused automated access), so its detailed conditions are unverified.

Evidence of live enforcement in the 2025 annual report: a 5 million króna fine (about $36,000) on the Capital Area Primary Health Care service for unlawful sharing inside a health records system, and a 12 million króna fine (about $88,000) reduced to 8 million (about $58,000) after a court challenge. In June 2026 the authority completed own-initiative audits of the National Prosecutor, district prosecutors and police commissioners, found that security measures had not been fully implemented, closed the audits with formal guidance rather than orders, and said it will re-examine compliance a year later. Sector regulators enforce alongside it: the Central Bank of Iceland supervises financial firms including under the European operational resilience regulation, the Directorate of Health oversees health records, the Electronic Communications Office of Iceland and its national cyber team CERT-IS handle cyber incidents, and — importantly — bookkeeping offences are investigated by the district prosecutor and the tax investigation authority, not by the privacy regulator.

Bookkeeping Act No. 145/1994, Article 20: seven years from the end of the financial year, preserved in Iceland, with only a six-month tolerance for holding the records abroad. Cash register records run three years. There is no general statutory maximum retention period in Icelandic law; the ceiling comes from the storage limitation principle in the European Regulation, applied case by case, plus the individual's right to erasure. The right to erasure does not apply where processing is necessary to comply with a legal obligation, which is how the conflict resolves. Health records have their own preservation regime under the Health Records Act No. 55/2009, which requires records to be kept securely in a health record system and passed to the Director of Health if a system closes. Telecom traffic-data retention could not be verified — see the unconfirmed list.

The 72-hour clock is the standard European one, applied in Iceland through Act No. 90/2018. Act No. 78/2019 on the security of network and information systems of critical infrastructure entered into force on 1 September 2020 and requires operators to notify the cyber security unit 'svo fljótt sem verða má' — as quickly as possible — about serious incidents or risks. It sets no fixed hour count, which is unusual and means the practical deadline is judged after the fact. That Act carries daily penalties up to 500,000 krónur (about $3,600), administrative fines up to 10 million krónur (about $73,000) or 3% of annual turnover, and imprisonment of up to two years for intentional breaches. The financial-sector clock comes from Regulation (EU) 2022/2554, in force in Iceland since 1 July 2025; we did not verify its exact Icelandic reporting hours in this run. Any telecom-specific breach notification duty in the Electronic Communications Act No. 70/2022 is unverified.

The 13-year threshold is in Article 10 of Act No. 90/2018: 'Sé barnið undir 13 ára aldri telst vinnslan aðeins lögmæt að því marki sem forsjáraðili þess heimilar samþykki.' Fines on public authorities are expressly authorised by Article 46(4): 'Heimilt er að leggja sektir á einstaklinga og lögaðila, þar á meðal stjórnvöld og stofnanir sem falla undir gildissvið stjórnsýslulaga.' Licensed processing is governed by rules No. 811/2019 on processing subject to authorisation, and Persónuvernd runs an application route for it. Bookkeeping penalties sit in Articles 36 to 41 of the Bookkeeping Act: fines for ordinary breaches, imprisonment of up to six years for serious ones, corporate liability regardless of individual fault, and investigation by the district prosecutor and the tax investigation authority. The practical consequence of trap 5 is concrete: the European right to switch cloud provider with no egress charges from 12 January 2027 is not an Icelandic right today, because the Data Act is not part of Icelandic law.

Dormant switches, which matter more than pending bills. (1) The EEA Joint Committee can incorporate any of the three pending acts at a single meeting; the effect in Iceland then follows quickly, and the Data Act in particular would switch on cloud-switching and egress-fee rights that do not exist here today. (2) Under Article 16 of Act No. 90/2018 the minister controls whether and when a European approval of a foreign country is confirmed and published in the Icelandic gazette — a lever that operates without legislation. (3) Persónuvernd's authorisation rules let it decide which categories of processing need a licence before you start. (4) The six-month tolerance for holding accounting records abroad is a statutory allowance, not a right, and the authorities can demand the records back in Iceland at any time. At European level the pressure on the EU-US Data Privacy Framework carries through to Iceland: the framework remains in force and valid on 18 August 2026, but the European Data Protection Board wrote to the Commission on 31 July 2026 asking it to examine whether recent US changes affect the decision's validity. Do not build a single-mechanism transfer architecture on it.