Authorisation System

Mandate is either granted by an individual or arises from a relationship between people. Mandates arising from connections are retrieved from the databases of the government agencies responsible for this registration at the time of registration. For example, information regarding authorised signatories of companies are securely retrieved from Iceland Revenue and Customs.

When an individual intends to login on behalf of others, he/she begins by logging in with his/her own electronic ID. After login, his/her mandates are retrieved from the authorisation system. To have individuals login is to ensure security and traceability.

How does the Access control work?

Benefits for government agencies

The Authentication and Authorisation systems are available to government agencies free of charge.

One of the goals of Digital Iceland is to create reusable core services for government agencies and thereby increase the synergistic effect in the operation of the government's IT.

A centralised authorisation system is operated, maintained, and developed within a single agency.

Safety and traceability

The individual's identification is important for security and traceability.

When a user performs an action or retrieves data on behalf of another company or individual, it is traceable to who is performing the action.

Agencies will therefore be able to control access to individual parts of their websites and verify the user and his/her access against their web services.

This gives government agencies an opportunity to ensure that no one retrieves data except those permitted.

Similarly, this gives institutions an opportunity to audit an action so that it can be traced down to the individual who carried it out, when appropriate.

What does an agency have to do?

To utilise the authorisation system an agency must first implement the authentication system.

The Digital Iceland Authentication System is operated as a subscription service (SaaS) at no cost to government agencies.

• Agency submits application for the Digital Iceland Authentication System

• After that, the agency must provide technical information on the website to which the login is to be linked and access a test area in order to connect its website.

• Digital Iceland provides technical advice for the implementation of the login service.

Government agencies intending to make use of the authorisations system decide what kind of authorisations they intend to grant to their websites. An agency may therefore decide that web-based systems only support logging on behalf of companies and not on behalf of children. Each agency then decides what is visible to the user and what they may do when logged in on behalf of others. Both systems ensure that the user is who he/she claims to be and specify the permissions he/she has and their validity period.

The role of Digital Iceland

Digital Iceland operates and maintains an authentication service and an authorisation system with 24/7 monitoring of implementations by our operators. Digital Iceland also provides technical assistance to government agencies implementing the authentication and authorisation systems.

The system retrieves data electronically and securely from the following government agencies:

• Registers Iceland for information regarding custody relations. Registers Iceland is responsible for ensuring proper registration of custody.

• Iceland Revenue and Customs for information regarding authorised signatories of companies. Iceland Revenue and Customs is responsible for ensuring proper registration of authorised signatories.

• Digital Iceland for mandates an individual gives to others. Digital Iceland retains a log of mandates that individuals give to others.

• Rights protection agency for disabled persons for information for personal spokesmen. The rights protection agency shall be responsible for ensuring that the registration of personal spokespersons is correct.

Technical information

For further technical information, please consult the Digital Iceland's development.