Law note · Iceland
Act No. 90/2018, Data Subject Rights in Iceland
cite Log nr. 90/2018 (data subject rights provisions)
stage In effect
since 2018-07-15
reviewed 2026-08-24
Act No. 90/2018 carries the General Data Protection Regulation (GDPR) data subject rights, access, rectification, erasure, restriction, portability, and objection, into Icelandic law, including the qualified Article 22-equivalent right against a decision based solely on automated processing. Rights are exercisable against the controller, with Personuvernd as the escalation path for a complaint. No Icelandic-specific timeline departure from GDPR's one-month response window was found.
What it asks of an app
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Iceland within one month of receipt, under Act No. 90/2018.
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Iceland.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: Althingi official consolidated-law database