Law note · Iceland
Act No. 90/2018 on Data Protection and the Processing of Personal Data
Iceland is not an EU member, so the General Data Protection Regulation (GDPR) does not apply directly. GDPR reaches Iceland through EEA Joint Committee Decision No. 154/2018, incorporating it into the EEA Agreement, and Act No. 90/2018 gives that incorporation domestic legal force. The Act's own Article 2, read directly, names Decision No. 154/2018 as the incorporation mechanism, and the Act reproduces the GDPR text itself as an appendix. Persoonuvernd (the Icelandic Data Protection Authority) is the supervisory authority.
Privacy law is a settled, fully in-force regime in Iceland since 2018, distinct from Iceland's AI-law posture, where the EU AI Act's own EEA incorporation was still pending as of the derived candidate list's 2026-08-12 as-of-date.
What it asks of an app
- Establish a lawful basis under Act No. 90/2018 Article 8 (mirroring General Data Protection Regulation (GDPR) Article 6) before processing personal data of a person in Iceland, including data collected by crawling.
- Treat Act No. 90/2018, not the EU GDPR Regulation directly, as the controlling instrument for a person in Iceland, since GDPR reaches Iceland only through this Act's own EEA-incorporation mechanism.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot
Primary source: Althingi official consolidated-law database, fetched and read directly