Where we work · Iceland
ISO and GRC certification consulting in Iceland
Achieve ISO and GRC certification in Iceland with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Enschede office team
- Effivity and Academy included
Sectors that ask for certification in Iceland
Clients include
ISO and GRC certification in Iceland at a glance
Persónuvernd supervises the Act on Data Protection and the Processing of Personal Data, No. 90/2018, which it describes as Iceland's implementation of the GDPR within the European Economic Area. Around that sit MAST, the Icelandic Food and Veterinary Authority, which supervises fish processing, slaughter and dairy, and the municipal health inspectorates, which cover shops and restaurants. Lyfjastofnun oversees medical devices, Vinnueftirlitið the work environment, CERT-IS the national cyber security team under Act No. 78/2019, and the Central Bank of Iceland financial supervision. The Environment and Energy Agency began operations on 1 January 2025 and replaced the former National Energy Authority. Certificates come from certification bodies accredited within the international arrangements; ISAC, the accreditation service inside the Icelandic Intellectual Property Office, states that SWEDAC accredits certification bodies on its behalf, while Staðlaráð Íslands is the national standards body. Business Iceland names seafood, energy and green solutions, innovation, tourism and creative industries as key sectors. Sterling's Enschede office serves clients across Iceland on site where the work needs it and remotely otherwise, drawing on 8,100+ client engagements in 60+ countries and 20+ years, with Effivity and Sterling Academy included with the engagement. Sterling does not certify.
ISO and GRC standards Sterling delivers in Iceland
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Iceland (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Act on Data Protection and the Processing of Personal Data (lög um persónuvernd og vinnslu persónuupplýsinga) and the GDPR within the EEA Persónuvernd (the Icelandic Data Protection Authority) — a State agency that describes itself as independent and not taking instructions from government or others | Persónuvernd states that Act No. 90/2018 is Iceland's implementation of the GDPR and that its objective is to ensure personal data are handled in line with fundamental principles of data protection and privacy, with free flow of data within the internal market of the European Economic Area. The Act applies to processing of information about individuals, whether by authorities, businesses or individuals acting outside private use, when the data are processed automatically or held in a filing system. Persónuvernd explains that the main rule is that the controller is established in Iceland, and that foreign businesses are also covered when they supply goods or services to people in Iceland or monitor their behaviour. It does not apply to information about legal persons, anonymous statistics or purely private use. | |
| Persónuvernd's supporting rules, regulations and notices Persónuvernd | Persónuvernd's page on laws and regulations lists, next to the Act, rules on proceedings, electronic monitoring, security in health research, processing that needs a licence and a notice on transfers abroad. Its site also provides routes to report a personal data breach and to apply for licensable processing. Persónuvernd's duties include supervising compliance, deciding disputes, carrying out security audits and advising Alþingi and authorities on legislation. | |
| Matvælastofnun (MAST, the Icelandic Food and Veterinary Authority) and the municipal health inspectorates (heilbrigðiseftirlit sveitarfélaga) Food businesses — own-check (internal control) and food safety | Food Act No. 93/1995 (matvælalög) and regulations under it — MAST states that all food businesses must set up own-check (innra eftirlit) proportionate to the nature and size of the business, that businesses are sorted into three categories, and that MAST supervises fish processing, slaughterhouses, meat processing, dairy and cold stores for animal products, while the municipal inspectorates supervise shops, restaurants, canteens and several other producers. | HACCP |
| Matvælastofnun (MAST) Fish processing and the food chain more widely | MAST states that it is the competent authority in Iceland for food safety, animal health and welfare, feed, seed, fertilisers, plant health and water for human consumption; that it controls primary production of animal products including fish and fish products, meat processing and dairy plants and food import and export; that it issues licences and supervises fish processing; and that Iceland applies the EU legislation on veterinary matters, foodstuffs and feed through the EEA Agreement. | |
| Matvælastofnun (MAST), with ISAC and SWEDAC for accreditation Laboratories used in official food and feed control | MAST states that the main condition for a laboratory to be designated as an official laboratory or national reference laboratory is accreditation for the measurement concerned, under Regulation (EU) 2017/625 as implemented by regulation No. 234/2020, and that SWEDAC regularly visits Iceland to assess laboratories on behalf of ISAC. | ISO/IEC 17025 |
| Lyfjastofnun (the Icelandic Medicines Agency) Medical devices | Lyfjastofnun states that it supervises medical devices, their safety and correct use, through market surveillance and oversight of maintenance and use; that devices need the CE mark when placed on the Icelandic market; that importers and distributors carry the duties set in Regulation (EU) 2017/745 (MDR); and that distributors of medical devices must register with Lyfjastofnun under the Act on medical devices. | |
| CERT-IS (the national cyber security team of the Icelandic authorities) Network and information security of essential services and digital service providers | Lög nr. 78/2019 um öryggi net- og upplýsingakerfa mikilvægra innviða, with regulation No. 866/2020 for operators of essential services, regulation No. 1255/2020 for digital service providers and regulation No. 480/2021 on CERT-IS; CERT-IS runs sector groups for telecommunications, financial, transport, energy, health and digital infrastructure and receives mandatory incident notifications. | |
| Seðlabanki Íslands (the Central Bank of Iceland), which carries out financial supervision Financial services | The Central Bank's website sets out financial supervision for credit institutions, pensions, insurance, securities and funds, payment services and electronic money, and has a section on digital operational resilience in the financial market (DORA); firms confirm what applies to them with the Central Bank. | |
| Vinnueftirlitið (the Administration of Occupational Safety and Health) Occupational safety and health | Vinnueftirlitið describes the safety and health plan (áætlun um öryggi og heilbrigði) that employers prepare to give an overview of workplace risks and the preventive measures taken, with dated corrective actions, and states that an employer lacking the skills must use service providers recognised by Vinnueftirlitið; it also states that work machinery sold and used in Iceland must be CE marked. | |
| Umhverfis- og orkustofnun (the Environment and Energy Agency) Environment and energy | The National Energy Authority (Orkustofnun) states that it closed on 31 December 2024 and that the Environment and Energy Agency began operations on 1 January 2025; the Agency's website lists the European Emission Trading System among its main topics. |
Accreditation and recognition
- ISAC — Faggildingarsvið Hugverkastofunnar (the Icelandic Service for Accreditation, a division of the Icelandic Intellectual Property Office): National accreditation body — the official accreditation body in Iceland under Act No. 24/2006 on accreditation and regulation No. 566/2013, which implements Regulation (EC) 765/2008; it states that it accredits inspection bodies, testing laboratories, calibration laboratories and certification bodies, that it is a member of EA, and that it passed EA peer evaluation in April 2022 and joined the EA multilateral agreement for the accreditation of inspection bodies in October 2022.
- SWEDAC (the Swedish accreditation body), acting for ISAC: Accreditation body that, according to ISAC and MAST, assesses and accredits in Iceland on ISAC's behalf under a cooperation agreement, including laboratories and certification bodies.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- State procurement under the Act on Public Procurement No. 120/2016 and regulation No. 895/2024 on the organisation of State procurement (Fjársýsla ríkisins (the Government Financial Services Agency), the central purchasing body of the State): Regulation No. 895/2024 applies to public bodies within the scope of Act No. 120/2016, above all State bodies, and makes Fjársýsla ríkisins the central purchasing body that concludes framework agreements and runs tenders for them. The regulation does not name ISO standards; each tender sets its own qualification criteria and the documents a supplier must supply.
- Tender licences and joint purchasing (The responsible ministry and Fjársýsla ríkisins): The regulation lets the minister give other public bodies a licence to run tenders in set purchasing categories, and lets other public bodies that fall under the Act join the State's framework agreements. A supplier therefore meets different buyers' criteria depending on the category and the buyer.
Sterling in Iceland
Sterling delivers in Iceland from its Enschede office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Iceland clients ask
Which authority supervises data protection in Iceland, and under which law?
Persónuvernd, the Icelandic Data Protection Authority, supervises it. The governing law is Act No. 90/2018 on data protection and the processing of personal data, which Persónuvernd describes as Iceland's implementation of the GDPR. The authority says it is independent and takes no instructions from government. Counsel or Persónuvernd can confirm how the Act applies to a particular processing activity.
Does the GDPR apply in Iceland even though Iceland is outside the EU?
In practice, yes, through national law. Persónuvernd lists Regulation (EU) 2016/679 next to Act No. 90/2018, calls the Act Iceland's implementation of the GDPR and ties its objective to free movement of data in the EEA internal market. Foreign businesses are caught when they supply goods or services to people in Iceland or monitor their behaviour.
Who accredits certification bodies in Iceland?
ISAC, the accreditation division of the Icelandic Intellectual Property Office, is the official accreditation body. It states that SWEDAC accredits certification bodies, testing and calibration laboratories for it where ISAC lacks EA recognition. Check the scope on the accreditation certificate of any body you consider for your standard, and confirm the position with ISAC.
Who supervises food safety in Iceland, MAST or the municipalities?
Both bodies, depending on what the business does. MAST handles fish processing, freezer vessels, slaughter, meat, dairy and cold stores for animal products, and the municipal inspectorates handle retail and catering. Food Act No. 93/1995 asks every food business for own-check scaled to size and nature.
Is there an Icelandic law on the security of critical network and information systems?
Yes. CERT-IS, the national cyber security team, lists Act No. 78/2019 on the security of network and information systems of critical infrastructure, with regulations for essential-service operators and for digital service providers. It collects incident reports and organises sector groups. Whether your organisation falls inside the scope is for CERT-IS to confirm.
Must Icelandic public buyers require ISO certificates from suppliers?
No general rule says so. Regulation No. 895/2024 organises State procurement around Fjársýsla ríkisins as central purchasing body and does not name ISO standards. Each tender sets its own qualification criteria, so a certificate matters only when the tender asks for it. Read the invitation documents of the buyer concerned before investing in one.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Act on Data Protection and the Processing of Personal Data (lög um persónuvernd og vinnslu persónuupplýsinga) and the GDPR within the EEA — island.is (accessed 18 Oct 2026)
- Persónuvernd's supporting rules, regulations and notices — island.is (accessed 18 Oct 2026)
- Food Act No. 93/1995 (matvælalög) and regulations under it — mast.is (accessed 18 Oct 2026)
- MAST states that it is the competent authority in Iceland for food safety, animal health and welfare, feed, seed, fertilisers, plant health and water for human consumption; that it controls primary production of animal products including fish and fish products, meat processing and dairy plants and food import and export; that it issues licences and supervises fish processing; and that Iceland applies the EU legislation on veterinary matters, foodstuffs and feed through the EEA Agreement — mast.is (accessed 18 Oct 2026)
- MAST states that the main condition for a laboratory to be designated as an official laboratory or national reference laboratory is accreditation for the measurement concerned, under Regulation (EU) 2017/625 as implemented by regulation No. 234/2020, and that SWEDAC regularly visits Iceland to assess laboratories on behalf of ISAC — mast.is (accessed 18 Oct 2026)
- Lyfjastofnun states that it supervises medical devices, their safety and correct use, through market surveillance and oversight of maintenance and use; that devices need the CE mark when placed on the Icelandic market; that importers and distributors carry the duties set in Regulation (EU) 2017/745 (MDR); and that distributors of medical devices must register with Lyfjastofnun under the Act on medical devices — lyfjastofnun.is (accessed 18 Oct 2026)
- Lög nr. 78/2019 um öryggi net- og upplýsingakerfa mikilvægra innviða, with regulation No. 866/2020 for operators of essential services, regulation No. 1255/2020 for digital service providers and regulation No. 480/2021 on CERT-IS; CERT-IS runs sector groups for telecommunications, financial, transport, energy, health and digital infrastructure and receives mandatory incident notifications — cert.is (accessed 18 Oct 2026)
- The Central Bank's website sets out financial supervision for credit institutions, pensions, insurance, securities and funds, payment services and electronic money, and has a section on digital operational resilience in the financial market (DORA); firms confirm what applies to them with the Central Bank — sedlabanki.is (accessed 18 Oct 2026)
- Vinnueftirlitið describes the safety and health plan (áætlun um öryggi og heilbrigði) that employers prepare to give an overview of workplace risks and the preventive measures taken, with dated corrective actions, and states that an employer lacking the skills must use service providers recognised by Vinnueftirlitið; it also states that work machinery sold and used in Iceland must be CE marked — island.is (accessed 18 Oct 2026)
- The National Energy Authority (Orkustofnun) states that it closed on 31 December 2024 and that the Environment and Energy Agency began operations on 1 January 2025; the Agency's website lists the European Emission Trading System among its main topics — orkustofnun.is; uos.is (accessed 18 Oct 2026)
- ISAC — Faggildingarsvið Hugverkastofunnar (the Icelandic Service for Accreditation, a division of the Icelandic Intellectual Property Office) — island.is (accessed 18 Oct 2026)
- SWEDAC (the Swedish accreditation body), acting for ISAC — island.is; mast.is (accessed 18 Oct 2026)
- State procurement under the Act on Public Procurement No. 120/2016 and regulation No. 895/2024 on the organisation of State procurement — island.is (accessed 18 Oct 2026)
- Tender licences and joint purchasing — island.is (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice