Cybersecurity law & regulation in Iceland (2026)

Iceland logged 5,240 cybersecurity reports in 2025 (a 26% year-on-year rise), with ransomware incidents doubling for the fourth straight year and payment-fraud losses totalling ~ISK 2 billion across 2023-2025. The trend intensified parliamentary pressure to accelerate NIS2 transposition.

The Russian-linked Akira group encrypted Árvakur's systems, taking mbl.is offline and halting radio station K100; it was Iceland's largest known ransomware attack on a media organisation and prompted parliamentary debate on reclassifying media as critical infrastructure.

Following the EDPB's 2022 coordinated cloud-services enforcement action, Iceland's DPA fined Garðabær (€16,590), Hafnarfjörður (€18,580), and Reykjanesbær (€16,590) for transferring pupils' data to the US without adequate safeguards, establishing a precedent on public-sector cloud security compliance.

Iceland launched the Eyvör NCC-IS project, its official node in the EU's European Cybersecurity Competence Centre (ECCC) network, to coordinate cyber research, education and strategic capability-building across academia, industry and government.

Iceland's data protection authority issued its largest-ever GDPR fine against credit bureau Creditinfo Lánstraust hf. for processing personal financial data without a sufficient legal basis, following a complaint from the Consumers' Association of Iceland.

The Ministry of Higher Education, Science and Innovation published a new 15-year strategy centred on digital trust, human-rights protection, and a strong security culture, designating Fjarskiptastofa (ECOI) as the principal coordination body and replacing the 2015 strategy.

Iceland enacted Act No. 70/2022, transposing the EU European Electronic Communications Code, consolidating network-security and incident-reporting obligations for telecom operators under Fjarskiptastofa's expanded supervisory mandate.

Issued under Act 78/2019, this regulation imposed technical and organisational security requirements and mandatory incident-reporting procedures on approximately 350 critical-infrastructure operators across energy, transport, banking, and health sectors.

Following the EEA Joint Committee Decision of 6 July 2018, Iceland enacted Act No. 90/2018 to implement the GDPR, empowering Persónuvernd as the independent supervisory authority and imposing GDPR-equivalent data-security, breach-notification, and data-subject rights obligations on all controllers.

The Ministry of the Interior published Iceland's inaugural cybersecurity strategy with a 2015-2018 action plan targeting resilience, capacity-building, strengthened legislation, and cybercrime reduction, laying the political and institutional groundwork for the statutory framework enacted from 2018 onward.

CERT-IS was formally established under the Electronic Communications Office of Iceland as the national CERT/CSIRT, mandated to monitor threats, coordinate incident response with police, and serve as the government's single point of contact for cybersecurity incidents affecting critical infrastructure and registered telecoms operators.