Cybersecurity lawsuits in Iceland do not look like the mass data-breach class actions familiar from the United States. Instead, Iceland’s legal activity in this area runs along three tracks: administrative fines issued by the national data protection authority Persónuvernd, criminal prosecutions for cyber-enabled theft and fraud, and court challenges that test the limits of regulatory power. A fourth track is coming: the transposition of the EU’s NIS2 Directive will multiply both the number of regulated entities and the size of the penalties they face.
Who Enforces Cybersecurity Law in Iceland
Persónuvernd enforces the GDPR through Iceland’s Act No. 90/2018 on Data Protection and the Processing of Personal Data. Between May 2018 and December 2021, the authority imposed roughly €200,000 in total fines, a modest figure that reflects Iceland’s small population rather than light enforcement.1USITC. Changing Tides of GDPR Enforcement Trends Fines have grown since.
The dedicated cybersecurity statute is Act No. 78/2019 on the Cyber and Data Security of Critical Infrastructure, which covers around 350 entities and underpins the National Cybersecurity Strategy 2022–2037.2Government of Iceland. Iceland’s National Cybersecurity Strategy 2022-2037 Released in English CERT-IS is the national point of contact for cyber vulnerability information, and the Central Bank of Iceland oversees cybersecurity for financial institutions.3Central Bank of Iceland. Financial Supervision Many of the headline enforcement actions, however, have come under data protection law rather than the critical infrastructure act.
Major Persónuvernd Enforcement Cases
Creditinfo Lánstraust hf. (2023)
The largest Persónuvernd fine to date targeted Iceland’s dominant credit bureau, Creditinfo Lánstraust hf., which was penalized 37.85 million ISK (approximately €257,000) in mid-2023. The matter began with a 2020 complaint by the Consumers’ Association of Iceland alleging that Creditinfo was unlawfully registering payday loan borrowers on its default registry. Persónuvernd agreed, finding that the company had registered defaults for claims below required minimum thresholds, processed data from loan agreements that violated consumer protection laws, and failed to promptly delete or correct erroneous entries.4Neytendasamtökin. Persónuvernd Sektar Creditinfo The authority described the violations as “extensive and very serious.” The fine represented 2.5 percent of Creditinfo’s 2021 turnover.5RÚV. Sektar Creditinfo Um 38 Milljónir Vegna Skráninga á Smálánaskuldum The case concerned data-processing compliance, not a cyberattack.
Capital Region Health Care (2025)
In February 2025, Persónuvernd fined the Capital Region Health Care System (Heilsugæslu höfuðborgarsvæðisins) 5 million ISK for merging its electronic health records with those of a dozen external parties without obtaining legally required ministerial permits or Persónuvernd confirmation. The unauthorized sharing, which took place between 2016 and 2023, exposed records of approximately 195,000 individuals out of 517,429 in the system to organizations that should not have had access, including the Road and Coastal Administration, the Football Association of Iceland, and a flight medical center.6DV. Heilsugæsla Höfuðborgarsvæðisins Sektuð Um Fimm Milljónir Fyrir Að Brjóta Lög The health authority also failed to produce written risk assessments or security documentation when asked. Persónuvernd characterized the violation as procedural rather than the result of a cyberattack. Unauthorized access points were closed and permit applications for legitimate data-sharing arrangements were submitted.7DataGuidance. Iceland: Persónuvernd Fines Heilsugæslu
The Covid Gift Card App (2021)
A government digital gift card app launched in 2020 as pandemic economic stimulus produced one of the earliest substantial fines. Persónuvernd found that the rushed deployment led to “inadequate adjustment of settings,” resulting in unlawful collection of large amounts of personal data and excessive access to users’ mobile devices. The Ministry of Industries and Innovation, acting as data controller, was fined 7.5 million ISK (roughly €50,800); the app developer YAY ehf. was fined 4 million ISK (about €27,100).8European Data Protection Board. Icelandic DPA Issues Fine to Ministry of Industries and Innovation and YAY ehf The violations included failure to implement data protection by design and by default under GDPR Article 25 and failure to ensure appropriate security of processing under Article 32. The focus was excessive data collection, not a breach where data was stolen.
Reykjanesbær Municipality (2023)
In December 2023, Persónuvernd fined the municipality of Reykjanesbær €16,600 for its handling of student data processed through Google Education. The authority found that the municipality had failed to select an adequate data processor, lacked a compliant processing agreement with Google, and did not adequately address the risks of transferring student data to the United States. The retention period for student records was also found excessive.9GDPR Enforcement Tracker. Reykjanesbær Municipality Enforcement Decision The municipality cooperated with the investigation and revised its practices.
Court Challenges to Enforcement Decisions
Persónuvernd decisions have been contested in Iceland’s courts, with mixed results. In December 2024, the Supreme Court of Iceland partially annulled a Persónuvernd decision against the City of Reykjavík concerning its use of the educational platform Seesaw in schools. Persónuvernd had found GDPR violations and successfully petitioned for leave to appeal a lower court’s judgment, but on appeal the Supreme Court sided partly with the city.10DataGuidance. Iceland – Data Protection Overview
A month earlier, in November 2024, the National Court upheld a separate Persónuvernd decision regarding the unlawful use of blood samples, affirming that data protection requirements apply even when organizations face pressure from pandemic-related circumstances. Together, the rulings suggest that courts broadly respect Persónuvernd’s enforcement powers while remaining willing to push back on individual decisions.
Criminal Cybercrime Prosecutions
The Big Bitcoin Heist
Iceland’s most internationally famous cybercrime case involved the theft of roughly 600 cryptocurrency mining rigs from three data centers across four separate burglaries. The stolen equipment was valued at about 200 million ISK, approximately £1.45 million at the time.11The Guardian. Big Bitcoin Heist Suspect Escapes Prison and Flees Iceland
Sindri Þór Stefánsson was identified as the ringleader. Twenty-two people were arrested during the investigation and seven were charged. Stefánsson escaped from the low-security Sogn prison in April 2018, made his way to Keflavík airport, and boarded a flight to Sweden that also carried Prime Minister Katrín Jakobsdóttir. He was captured in Amsterdam, returned to Iceland, and sentenced to four years in prison in January 2019.12CoinGeek. Iceland’s Crypto Mining Rig Heist Leader Handed 4 Year Jail Term The mining rigs were never recovered.
Siggi the Hacker
In December 2014, Sigurður Ingi Þórðarson, a former WikiLeaks volunteer and FBI informant known as “Siggi the Hacker,” was sentenced to two years in prison by the Reykjanes District Court for fraud, embezzlement, and theft totaling approximately 30 million ISK. Þórðarson admitted guilt.13Iceland Monitor. Siggi the Hacker Gets Two Years Prison The crimes were financially motivated rather than purely technical hacking offenses.
What’s Changing: NIS2 and Bigger Penalties
The most significant change on the horizon is Iceland’s transposition of the EU’s NIS2 Directive. The directive is expected to be incorporated into the EEA Agreement by autumn 2025, with a government bill tabled in the Althingi around mid-2026 and the new law entering force on July 1, 2027. Compliance deadlines then follow: July 1, 2028 for essential entities and October 1, 2028 for important entities.14Copla. NIS2 Directive Regulations and Implementation in Iceland
Penalties would rise sharply. Essential entities would face fines of up to €10 million or two percent of global turnover, along with daily penalties of up to 10 million ISK and potential bans on directors. Important entities could be fined up to €7 million or 1.4 percent of global turnover and subjected to public naming. Public-sector bodies would face corrective orders but not monetary fines. The regulated population is expected to grow from about 350 entities to between 3,000 and 4,000, drawing in medium-sized manufacturers and larger municipalities for the first time.14Copla. NIS2 Directive Regulations and Implementation in Iceland
A separate bill on the digital resilience of the financial market was submitted for parliamentary committee consideration in July 2025, with its own fines and sanctions and enforcement beginning January 1, 2026.10DataGuidance. Iceland – Data Protection Overview
The Threat Picture Driving Enforcement
Recent incidents help explain the regulatory sharpening. In 2024, the Árvakur media group suffered a significant attack, and Reykjavík University was hit by the Russian ransomware group Akira, which stole what the university described as “basic information.” A wave of distributed denial-of-service attacks in 2023 temporarily knocked several official and commercial websites offline. In the first half of 2025, online fraud losses in Iceland exceeded 200 million ISK. In 2023, the Minister for Higher Education, Industry and Innovation stated publicly that Iceland “trails some of its peers in cybersecurity resilience, readiness, and investment.”15Diesec. Cyber Threat Landscape in Iceland
Persónuvernd has signaled it intends to be more assertive. In its 2025 annual report, published in May 2026, the authority described taking an “increasingly proactive approach to cybersecurity failings, AI oversight, and organizations handling sensitive data.”16Global Relay. Iceland’s DPA Signals Continued Focus on Cybersecurity, Health Data, and AI Governance Health information security is identified as a top priority for 2026 alongside AI oversight.10DataGuidance. Iceland – Data Protection Overview For organizations that handle personal data in Iceland, the practical lesson from the enforcement record so far is that procedural failures (missing permits, inadequate processor agreements, overcollection) have driven the biggest fines, not spectacular breaches. Under NIS2, both procedural and technical failures will carry much steeper consequences.