Frameworks / Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) / ICELAND-Act90-Chap4-Security-BreachNotification-DPIA-Personuvernd-72hr Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)
Iceland Act 90/2018 Chap 4 - Security + Breach + DPIA
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) ICELAND-Act90-Chap4-Security-BreachNotification-DPIA-Personuvernd-72hr: Iceland Act 90/2018 - Chapter IV Security of Processing + Breach Notification + DPIA (Articles 27-29) Chapter IV (Articles 27-29) Security and Risk. Article 27 Security of Processing - GDPR Article 32 transposition: appropriate technical + organisational measures considering state of the art + costs + nature + scope + context + purposes + risk; specific measures: pseudonymisation + encryption + confidentiality + integrity + availability + resilience + ability to restore + regular testing + assessment + evaluation; risk-based approach; Personuvernd 2022 Guidance on Security of Processing + 2024 supplement; coordination with Iceland Cybersecurity Act + national CSIRT (CERT-IS); financial sector + healthcare + critical infrastructure heightened expectations. Article 28 Notification of Breach to Personuvernd + Data Subjects - GDPR Articles 33 + 34 transposition: 72-hour notification to Personuvernd of personal data breach from awareness; without undue delay to data subjects if high risk; Personuvernd online notification form + post-incident assistance; details required (nature + categories + numbers + consequences + measures); breach register obligation per controller. Article 29 Data Protection Impact Assessment (DPIA) - GDPR Article 35 transposition: required for processing likely to result in high risk; Personuvernd list of processing operations requiring DPIA (Personuvernd-2018 + updates) - including Iceland-specific triggers (large-scale national ID processing + biometric + genetic + cross-border health); DPIA contents + risk assessment + measures + consultation. Article 29 also covers Prior Consultation with Personuvernd for unmitigated high residual risk. Iceland Act 90/2018 + Chapter IV + Security + 72-hour Breach + DPIA + Personuvernd applies.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 323 controls across 88 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
BSI-03 Multi-factor authentication requirements BSI-04 Remote access controls BSI-05 Wireless access restrictions BSI-08 Cryptographic protection of data BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities API1164-06 Access Control API1164-07 Remote Access API1164-09 Patch and Vulnerability Management API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface API1164-24 Vulnerability assessment for critical systems IEC62443-07 Personnel risk assessment IEC62443-08 Electronic access perimeter management IEC62443-10 Revocation of access procedures IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents IEC62443-24 Vulnerability assessment for critical systems IM8-CLD.2 Cloud Security Controls IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal IM8-DSS.3 Secure Development Practices IM8-RES.3 Incident Response IM8-SEC.2 Access Control IM8-SEC.4 Vulnerability Management 27011-5.2 Information Security Roles in Telecoms 27011-5.3 Segregation of duties 27011-6.3 Awareness and Training 27011-8.1 User Endpoint Devices 27011-8.3 Cryptography and key management 27011-8.6 Data protection and backup APPI-A26 Report of Leakage to the Commission and Notification to the Person APPI-A31 Provision of Personally Referable Information APPI-A34 Request for Correction, Addition or Deletion APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information AWWA-1.2 Risk Assessment AWWA-2.1 User Access Management AWWA-2.4 Physical Access Controls AWWA-3.2 Remote Access Security AWWA-3.4 Encryption and Data Protection FFIEC-08 Application security controls FFIEC-09 Encryption and key management FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.25_26_27_28_29 UAE Data Office establishment, powers, penalties, complaints (UAE PDPL Articles 25-29) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) UAE-PDPL-Art.6_7 Sensitive personal data and children's data (UAE PDPL Articles 6-7) 27400-6.2 Device Identity and Authentication 27400-6.3 Secure Update Mechanism 27400-6.5 Security monitoring and incident response 27400-7.1 Network Security for IoT 27400-7.4 Data retention and deletion ASD37-17 TLS encryption between email servers (Limited) ASD37-27 Outbound data loss prevention (Very Good) ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) 27010-10.1 Cryptographic Protection 27010-16.1 Continuity of Sharing 27010-9.1 Access Control to Shared Information 27010-9.2 Authentication of Sources NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing OWASPTOP10-1 A01:2025 Broken Access Control OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse) OWASPTOP10-9 A09:2025 Security Logging and Monitoring Failures AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-12 Section 62 - Administrative penalties AT-DSG-7 Section 18 - Establishment of the Data Protection Authority BB-DPA-1 Section 1 - Short Title BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-4 Section 4 - Principles Relating to Processing CJIS-17 Risk Assessment CJIS-8 Media Protection CJIS-9 System and Communications Protection CAT-D3-1 Preventative controls CAT-D4-3 Third-party access controls CAT-D5-1 Incident planning and strategy FEDRAMP-SC-13 Cryptographic Protection FEDRAMP-SC-28 Protection of Information at Rest FEDRAMP-SC-8 Transmission Confidentiality and Integrity 23837-1.2 Normative references 23837-1.5.2 Cryptographic module requirements 23837-1.5.3 Network device testing requirements 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure INCDPA-Controller-PrivacyNotice-PurposeLimitation-DataMinimisation-Transparency-LawfulBasis Indiana CDPA Controller Obligations - Privacy Notice + Purpose Limitation + Data Minimisation + Transparency + Lawful Basis + Reasonable + Adequate + Relevant + Limited to What is Necessary INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing PAKPDPB-5 Security of Processing and Personal Data Breach Notification PAKPDPB-6 Cross-Border Transfer and Data Localization PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight PSPF24-4 Physical Security D.1 Incident Response Planning D.2 Incident Reporting UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP) CPSC-CS.2 Authentication and Access Controls CPSC-CS.3 Data Protection for Safety Systems CPSC-RA.3 Lifecycle Risk Assessment CPS230-11 Identification, Assessment and Management of Operational Risk CPS230-13 Board Accountability for Operational Risk Management CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls 4.3.1 Risk Assessment and Impact Analysis 4.4.7 Emergency and Incident Response AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-6 Article 6 - State regulation in personal data protection DSO-2 Data Security DSO-3 Data Access Management LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training LOPDP-EC-Security-Processor-Breach-Notification-Articles-37-45-Encryption-72-Hour-SPDP-Notification-CSIRT Ecuador LOPDP Security + Processor + Breach Notification + Articles 37-45 + 72-Hour FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain 62351-8 Role-based access control (RBAC) 62351-9 Cyber security key management IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection IEEE7000-Operations-Lifecycle-OngoingMonitoring-Incident-Decommissioning IEEE 7000 - Operations + Lifecycle + Ongoing AI Risk Monitoring + Data Provenance + Retention + Privacy + Safe Deployment + Decommissioning + Disposal IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA IMO-MSC-FAL-Protect-AccessControl-NetworkSegmentation-MalwareDefence-Patch-Awareness-DataSecurity IMO MSC-FAL Protect Function - Access Control + Network Segmentation + Malware Defence + Patch Management + Awareness Training + Data Security + Crew BYOD + Removable Media IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team ItalyCodice-Garante-Enforcement-AdministrativeSanctions-Criminal-Art166-167-170-20MEUR-Coord-EDPB Italy Codice Garante Authority + Article 140-bis + Article 144 Complaints + Article 166 Administrative Sanctions up to EUR 20M/4% + Article 167 Criminal Offences + Article 170 Failure to Comply with Garante Orders + EDPB Coordination ItalyCodice-ePrivacy-Cookies-ElectronicCommunications-Telemarketing-PublicOpposition-TrafficDataRetention-Art121-122-130-132 Italy Codice ePrivacy - Article 121 Electronic Communications + Article 122 Cookies and Tracking + Article 130 Unsolicited Direct Marketing + Article 132 Traffic Data Retention + Italian Public Opposition Register (Registro delle Opposizioni) DOM172-Security-Measures-Article-25-Encryption-Pseudonymization-Access-Control-Incident-Handling-Breach-Notification-Article-22 Dominican Republic Law 172-13 Security Measures + Article 25 + Encryption + Breach Notification DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPAPI-6 Security Misconfiguration and Secure API Design ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency VERMONTAICDA-4 Vermont AG Enforcement and Cure VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VIETNAMCYBER-4 Incident Reporting and Cooperation AMLCTF-PartA-RiskAssess ML/TF Risk Assessment AL-DPA-14 Direct Marketing CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment 27031-7.2 Resource Requirements 29115-7.4 Level of Assurance 4 (LoA4) 29147-5.11 Researcher Safe Harbour and Legal Posture PQC-2 FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment RUSPD-4 Special Categories, Biometric Data SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 TEFCAREC-1 Common Agreement Conformance and Onboarding USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 323 it maps to, and the evidence behind each claim, over MCP and REST.