The Icelandic data protection authority ('Persónuvernd') announced, on 27 October 2022, the publication, on 4 October 2022, in the Official Gazette, of a new notification regarding the transfer of personal data to third countries. In particular, the notification provides that the laws of the following countries are considered to provide adequate protection for personal data according to the decisions of the European Commission pursuant to Article 45 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), which apply in Iceland in accordance with the decisions of the EEA Joint Committee, as provided by Article 16 of Act 90/2018 on Privacy and Processing of Personal Data ('the Act'). In this regard, the notification states that it is permitted to transfer personal data to the following countries, subject to the conditions of the GDPR being met:

• Japan;
• UK; and
• South Korea.

Moreover, the notification establishes that the laws of the following countries are considered to provide adequate protection for personal data according to the decisions of the Commission that were adopted before the entry into force of the GDPR, subject to the conditions of the same being met:

• Andorra;
• Argentina;
• Canada;
• Faroe Islands;
• Guernsey;
• Israel;
• Isle of Man;
• Jersey;
• New Zealand;
• Switzerland; and
• Uruguay.

Lastly, the notification provides that it is effective as of its publication in the Official Gazette.

You can read the announcement here and the notification here, both only available in Icelandic.