Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)
Iceland Act 90/2018 Chap 4 - Controller Obligations + DPO
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) ICELAND-Act90-Chap4-ControllerObligations-PrivacyByDesign-Processor-RoPA-DPO: Iceland Act 90/2018 - Chapter IV Controller Obligations + Privacy by Design + Processor + RoPA + DPO (Articles 24-26 + 35)
Chapter IV (Articles 24-26 + 35) Obligations of Controllers. Article 24 Controller Responsibility + Privacy by Design - GDPR Article 25 transposition: technical + organisational measures + integration of data protection by design + by default into processing activities + lifecycle; default settings respect data minimisation + purpose limitation + retention + accessibility limitation. Article 25 Processor and Sub-Processor Arrangements - GDPR Article 28 transposition: written contract with processor (Article 28(3) mandatory clauses) + sufficient guarantees + audit right + breach notification + return/destruction + sub-processor approval + Iceland-specific contract template; flow-down to sub-processors. Article 26 Records of Processing Activities (RoPA) - GDPR Article 30 transposition: controller maintains records per processing activity including name + contact + DPO + purposes + categories + recipients + transfers + retention + technical and organisational measures; processor maintains processor RoPA; Iceland-specific exemption for SME under 250 employees (with conditions). Article 35 Designation of Data Protection Officer (DPO) - GDPR Article 37 transposition: mandatory for public authorities; mandatory for systematic monitoring of data subjects on large scale; mandatory for processing on large scale of special categories or criminal data; DPO tasks (Article 39 GDPR + Iceland-specific reporting to Personuvernd); DPO independence + protection + reporting line to highest management. Personuvernd registration of DPO + contact details. Iceland Act 90/2018 + Chapter IV + Controller Obligations + Privacy by Design + Processor + RoPA + DPO applies.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 98 controls across 36 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ItalyCodice-Garante-Enforcement-AdministrativeSanctions-Criminal-Art166-167-170-20MEUR-Coord-EDPB Italy Codice Garante Authority + Article 140-bis + Article 144 Complaints + Article 166 Administrative Sanctions up to EUR 20M/4% + Article 167 Criminal Offences + Article 170 Failure to Comply with Garante Orders + EDPB Coordination
ItalyCodice-ePrivacy-Cookies-ElectronicCommunications-Telemarketing-PublicOpposition-TrafficDataRetention-Art121-122-130-132 Italy Codice ePrivacy - Article 121 Electronic Communications + Article 122 Cookies and Tracking + Article 130 Unsolicited Direct Marketing + Article 132 Traffic Data Retention + Italian Public Opposition Register (Registro delle Opposizioni)