Icelandic data protection law (Act 90/2018) and hosting: Persónuvernd, the GDPR and the EEA
A practical guide for Icelandic businesses, developers and agencies deciding where to host customer data. Status as of 30.09.2026. It is based on the authority's own publications and the EEA decision, and it is general information, not legal advice.
Short answer
- 1Iceland is in the European Economic Area, and the GDPR applies there. It was incorporated into the EEA Agreement by EEA Joint Committee Decision No 154/2018.
- 2Act 90/2018 on data protection and the processing of personal data is Iceland's implementation of the GDPR, according to the national authority, Persónuvernd.
- 3Hosting in the EU does not make your data protection duties disappear or multiply. You still need a written processor agreement (GDPR Article 28) and appropriate security (Article 32).
- 4A personal data breach must be reported to Persónuvernd without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Article 33).
- 5You stay responsible as controller. A hosting provider does not certify compliance on your behalf.
How the GDPR reaches Iceland
Iceland is not an EU member, but it is part of the EEA. EEA Joint Committee Decision No 154/2018 of 6 July 2018 replaced Directive 95/46/EC in the EEA Agreement with Regulation (EU) 2016/679. It also states that, for the purposes of the Agreement, the terms "Member State" and "supervisory authorities" include the EFTA States and their authorities. The Icelandic and Norwegian texts of the Regulation are authentic.
The national law. Persónuvernd lists Act 90/2018 on data protection and the processing of personal data (lög um persónuvernd og vinnslu persónuupplýsinga) as the main statute and says it is Iceland's implementation of the GDPR. The same list names Act 75/2019 on processing for law enforcement purposes, and a set of regulations, among them Regulation 1155/2022 on transfers of personal data to other countries and Regulation 50/2023 on electronic monitoring.
The authority. Persónuvernd is the Icelandic Data Protection Authority, a state agency based in Reykjavík. It publishes guidance and takes breach notifications through an online form on Ísland.is.
Breaches. The authority tells organisations to report a security breach without delay, preferably within three days of noticing it, and to explain the reasons if the deadline is missed. That matches the 72-hour rule in GDPR Article 33.
Transfers. Chapter V of the GDPR limits transfers to countries outside the EEA. Iceland and the EU are both inside it, so as we read the decision, moving data between a company in Iceland and a server in Germany or Romania is not a third-country transfer. If your processing involves a provider outside the EEA, check Regulation 1155/2022 and Persónuvernd's guidance.
We could not retrieve the statute text from the Althing's website when writing this page, so we do not quote individual articles of Act 90/2018. Confirm the current wording with Persónuvernd or a lawyer.
Real-world examples
These are illustrative scenarios, not case studies.
Reykjavík online shop on a VPS in Frankfurt
A shop stores customer names, addresses and order history on a rented server in Germany. It keeps a record of processing, signs a data processing agreement with the host and tests that it can restore a backup.
Tour operator taking bookings from abroad
A small operator runs a booking site whose visitors come from several countries. Its own Icelandic obligations apply, and the GDPR's territorial rules may also bring other countries' visitors into scope. It checks both with a lawyer.
Developer with a SaaS product and Icelandic customers
A software company keeps its customers' records in a PostgreSQL database in the EU. It limits who holds admin access, stores secrets outside the code and has a written procedure for reporting a breach.
Common mistakes
- Reading "our server is in Germany" as "GDPR is someone else's problem". The controller's duties follow the data, not the rack.
- Having no written agreement with the host or any other processor, although Article 28 requires a contract.
- Treating security as a one-off setup instead of keeping backups, updates and access rights under review (Article 32).
- Having no breach procedure, then discovering that the 72-hour clock has already started.
- Copying a privacy notice from another country without checking that it names the right authority and your real processors.
How 4hosting helps
Our datacenter is in the EU, in Frankfurt, not in Iceland. We say this plainly so that your privacy notice and records of processing name the real location. We offer a data processing agreement (DPA) under GDPR Article 28, which gives you the written processor contract the Regulation asks for.
Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for server hardening, backups and WAF rules. 4hosting is not a compliance certifier, does not sign legal compliance for you, and holds no NIS2, ISO or SOC 2 certification. Migration is free. See the plans for what is included.
Frequently asked questions
Does the GDPR apply in Iceland?
Yes. The GDPR was incorporated into the EEA Agreement by EEA Joint Committee Decision No 154/2018, which reads references to Member States as including Iceland, Liechtenstein and Norway. Persónuvernd describes Act 90/2018 as Iceland's implementation of it.
Where are 4hosting servers?
In the EU: Frankfurt, with points of presence in Frankfurt, London and New York. There are no 4hosting datacenters in Iceland.
Does 4hosting make me compliant with Icelandic law?
No. 4hosting does not certify legal compliance and holds no NIS2, ISO or SOC 2 certification; we describe our security practice as aligned with ISO 27001. We offer a data processing agreement (DPA) under GDPR Article 28 and can help with technical hardening through the included DevOps hours. Compliance of your processing remains your responsibility as controller.