Your Rights Under Lög nr. 90/2018 (Iceland GDPR-equivalent) — Iceland
Sourced from Icelandic Acts of the Althingi, statutory instruments, and official guidance. Written in plain language for general understanding — this is educational content, not legal advice. Our editorial standards
What is this right?
Iceland operates under Lög nr. 90/2018 — Iceland's GDPR-equivalent for EEA. Same data-subject rights as GDPR. Regulator: Persónuvernd at personuvernd.is.
When does it apply?
- A controller refuses to disclose, correct, or delete your data.
- You withdraw consent but processing continues.
- Data breach.
- Direct marketing without consent.
Using Your Rights Under Iceland Data Protection Act
- Send a written access request to the controller.
- If unsatisfied, complain to Persónuvernd.
- For damages, civil litigation.
What should you NOT do?
- Don't skip the controller's internal channel.
- Don't provide more identifying data than necessary.
About Data Privacy & Digital Rights in Iceland
Iceland's data-protection framework is Lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga — GDPR-equivalent for EEA Iceland. Regulator: Persónuvernd at personuvernd.is. For NCII, Almenn hegningarlög §229 criminalises non-consensual sharing of intimate imagery — penalties up to 4 years' imprisonment for aggravated cases.
Common Questions
Is Iceland's law the same as GDPR?
Functionally equivalent. As an EEA member, Iceland has implemented GDPR via Lög nr. 90/2018. Substantive rights and obligations mirror GDPR; small differences in administrative detail. Persónuvernd cooperates with EU DPAs under the EEA framework.
What is the your rights under lög nr. 90/2018 (iceland gdpr-equivalent) right in Iceland?
Iceland operates under Lög nr. 90/2018 — Iceland's GDPR-equivalent for EEA. Same data-subject rights as GDPR. Regulator: Persónuvernd at personuvernd.is.
When does it apply — your rights under lög nr. 90/2018 (iceland gdpr-equivalent)?
A controller refuses to disclose, correct, or delete your data.You withdraw consent but processing continues.Data breach.Direct marketing without consent.
What are my data-protection rights in Iceland?
Send a written access request to the controller.If unsatisfied, complain to Persónuvernd.For damages, civil litigation.
What should you NOT do — your rights under lög nr. 90/2018 (iceland gdpr-equivalent)?
Don't skip the controller's internal channel.Don't provide more identifying data than necessary.