Law / Iceland

Almenn hegningarlög nr. 19/1940, Art. 229, Unauthorized Access to Computer-Stored Data

Almenn hegningarlög nr. 19/1940 (General Penal Code), 229. gr., eins og henni var breytt með lögum nr. 8/2021

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 22 February 2021.

A computer misuse rule binding public and private bodies.

As of 6 September 2026.

What it requires

  • Do not obtain access to another's data or programs stored in computer-readable form without authorization, including by defeating a security measure, under Almenn hegningarlög Article 229.
  • Reading a public, unauthenticated page that carries no access control has not itself been held to violate this article.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Fines or imprisonment of up to one year (229. gr., 1. mgr.); the offense is publicly prosecutable rather than resting on the victim's own complaint (242. gr., 1. tölul.).

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 229 punishes whoever without authorization obtains access to data or programs of others stored in computer-readable form, with fines or imprisonment of up to one year, unless the conduct is justified by reference to public or private interests.

The provision is not limited to defeating a technical access control, but it does not by its own terms reach merely reading a page that carries no such control; no reported Icelandic decision has applied it to open-web scraping of a public, unauthenticated page.

This text replaced an earlier version of Article 229 by Act No. 8/2021, which took effect on the date of the Act's own publication; an earlier English translation of the Code (via a secondary legislation-tracking site) attributed similarly worded unauthorized-access language to Article 228, which the same 2021 amendment rewrote into a separate privacy-intrusion offense, so a citation to "Article 228" for this duty predates the current numbering.

When LexLint raises it

  • crawls_web
  • trains_models

Read the law

Althingi official consolidated-law database

Back to the example  ·  Lint your app