Act No. 90/2018 on Data Protection and the Processing of Personal Data (Log um personuvernd og vinnslu personuupplysinga nr. 90/2018) is the foundational Icelandic data protection law administered by Personuvernd (Icelandic Data Protection Authority). Enacted 27 June 2018; effective 15 July 2018. Implements GDPR (Regulation (EU) 2016/679) into Icelandic law via the EEA Agreement (European Economic Area) - Iceland is EEA Member State + applies EU acquis on data protection but is NOT a full EU Member State. EEA Joint Committee Decision 154/2018 incorporated GDPR into EEA Agreement on 6 July 2018 (with effect 20 July 2018). The Act + GDPR apply directly in Iceland; Iceland-specific provisions augment GDPR rather than replicate it. Chapter I (Articles 1-7) General Provisions: Article 1 Purpose (protect privacy + personal data + fundamental rights and freedoms); Article 2 Scope and Material Application (applies to all processing of personal data in Iceland + processing by Iceland-established controllers outside EEA + GDPR territorial scope per Article 3 GDPR); Article 3 Definitions (personal data + controller + processor + processing + consent + data subject + third party + recipient + supervisory authority + biometric data + genetic data + special categories + national identification number); Article 4 Protection of Personal Data of the Deceased (Iceland-specific - deceased persons protected for 5 years after death); Article 5 Acceptance of GDPR Standards; Article 6 Authority + Personuvernd (Icelandic DPA - independent statutory regulator + represented in EDPB EEA Member State + EDPS + Visegrad-Nordic privacy authorities); Article 7 Cooperation. Coordinates with GDPR + EEA Agreement + Icelandic Constitution Article 71 (privacy) + Penal Code Section 228 (privacy crimes). Iceland Act 90/2018 + Chapter I + Scope + EEA + Personuvernd applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.