Digital Iceland, on behalf of the Ministry of Finance and Economic Affairs, is the service provider of My Pages. My Pages is an access-controlled area within Ísland.is where users can access information from service recipients.

These terms, together with any agreements and annexes, form an agreement between the service provider and the service recipient on publishing information on My Pages. The terms define the responsibilities of each party for the operation, maintenance and information on My Pages. They are based on Digital Iceland’s data processing terms.

These terms of service do not apply to the Digital Mailbox or the Ísland.is login and authorisation system. Separate terms apply to those services.

1. Definitions

In these terms, where the context allows, the following terms have the meanings set out below:

• The service: The basic operation of My Pages.

• My Pages: An access-controlled area within Ísland.is.

• Parties: The service provider and the service recipient.

• Service provider: Digital Iceland, on behalf of the Ministry of Finance and Economic Affairs.

• Service recipient: An organisation that publishes information on My Pages.

• User: An individual, or a representative of a legal entity, who has access to My Pages.

• Service recipient contact: An employee of the service recipient who oversees the publication of the service recipient’s information on My Pages.

• Digital Mailbox: The digital mailbox in the government’s central service portal. The Digital Mailbox has its own terms of service: Terms of service for the Digital Mailbox (in Icelandic).

• Ísland.is login and authorisation system: Separate terms of service apply to the login service and the authorisation system: Terms of service for login and authorisation (in Icelandic).

• Content policy: The service provider’s policy on content quality and the navigation of Ísland.is: Ísland.is content policy (in Icelandic).

• Design system: A collection of guidelines, rules and requirements for the design of Ísland.is projects. It plays an important role in accessibility.

• Data processing terms: Digital Iceland’s terms for processing personal data on behalf of public bodies, and related obligations.

2. Service requests

Before submitting a request to publish information on My Pages, the service recipient must learn how My Pages works. This includes its functionality, access control and how information is presented.

The service provider receives requests from service recipients to publish information on My Pages. The request must include the necessary details about the cooperation, including the types of information to be published. The service recipient may withdraw the request without giving a reason.

The service provider may refuse a request. This may happen, for example, if the information requires extensive custom work. It may also happen if the information does not fit the content policy or the role of My Pages.

3. General

The service provider sets up the service recipient’s connection to My Pages. The service provider gives expert help with general adaptation and setup of the information. The service recipient appoints a contact person for the presentation and content of its information on My Pages.

The service provider is responsible for the basic operation of My Pages. Basic operation includes:

• running the components that retrieve information from service recipients

• web management

• regular software updates

• minor changes to the website’s design

• security audits

• fault monitoring

The service recipient is responsible for the accuracy and content of the information that the service provider publishes on its behalf on My Pages. The service recipient receives and handles all user enquiries about information that comes from it.

The service recipient ensures that information on My Pages is accessible. If information is not accessible or is incorrect, the service recipient must correct the error and inform users about it.

4. Types of information

The parties must document which types of information are published on My Pages. This is done in a project agreement or an annex to it. If the service recipient wants to publish a new type of information, section 2 of these terms applies.

If a connection for sharing information requires special programming work, the parties must make a separate agreement about it. This includes how costs and responsibilities are divided.

5. Security

The service provider is responsible for having appropriate technical and organisational measures in place to keep the service secure. These measures must take into account:

• the latest technology

• implementation costs

• the scope, context and purpose of the processing

• the risk of a security breach

The service recipient and the service provider must notify each other as soon as possible if they suspect either of the following:

• accidental, unauthorised or unlawful processing of information

• any kind of security breach involving information on My Pages

The notification must be sent to the general email address of the party concerned (in the case of the service recipient, island@island.is). The notification must describe the nature of the breach. This includes the estimated number of data subjects affected and how widely the information has been shared. The notifying party must also describe the likely consequences of the breach and the measures it has taken or plans to take.

6. Liability and indemnity

The service provider is never liable for damage caused by using the service or the information published on My Pages. This also applies to references and links to content outside My Pages.

The service provider is also never liable for damage caused when My Pages cannot be used, for any length of time. This applies to faults in the service provider’s software or hardware, or in connected third-party software or hardware.

If errors, interruptions or delays occur in the service provider’s service, its liability is limited to correcting them as soon as possible.

The service recipient shall indemnify and hold the service provider harmless against the following, including legal costs:

• any loss or damage

• claims and proceedings

• liabilities, fines and penalties

• other costs

This applies to anything the service provider may incur as a result of, or in connection with, the actions or omissions of the service recipient. This indemnity does not limit any other contractual or statutory rights the service provider may have against the service recipient. Paying compensation or an indemnity does not justify a breach of the service recipient’s duties and obligations.

The service provider is only liable for damage suffered by the service recipient if it is caused by gross negligence or wilful misconduct by the service provider’s employees. In such cases, the service provider’s liability covers only direct damage. It never covers indirect or consequential damage, such as business interruption, loss of business or reputational damage.

7. Costs

The service is free of charge for the service recipient.

If fees change, the service recipient will be informed 90 days before the changes take effect.

8. Operational security

The parties undertake to support the secure operation of the service. They will also work together on repairs if operational disruptions occur.

If the service recipient becomes aware that the service is not working properly in any way, it must notify the service provider without delay. In such cases, the service recipient may generally not use the service until the service provider has finished checking it.

The service may need to be closed temporarily for system maintenance, data updates or other technical work. If so, the service provider will notify the service recipient as soon as possible, and at least 24 hours in advance.

The service provider may suspend access to the service without warning if this is necessary because of a suspected security breach.

Circumstances beyond a party’s control may prevent the service recipient or the service provider from fulfilling its obligations under the agreement. If this happens, those obligations are suspended. They remain suspended until the circumstances have ended and the parties can fulfil their agreed obligations.

9. Termination

The service provider and the service recipient may terminate the service. Notice of termination must be in writing. The service will end twelve (12) months after the notice is received. All contractual obligations of the parties remain in force during the notice period.

However, the service provider may stop providing the service to the service recipient without notice if the law or government regulations require it.

Neither the service provider nor the service recipient needs to give a reason for deciding to end the service. Neither party bears any costs for using this right.

10. Data protection

The service recipient is the controller for the personal data that it publishes on My Pages. The service provider is a processor that processes personal data on behalf of the controller.

The service provider’s privacy policy on Ísland.is complies with the Data Protection Act No. 90/2018. It also complies with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on providing information to users.

When personal data is processed on My Pages, the service recipient is the controller of that processing within the meaning of the law. It therefore ensures the security of the information, as described in the service recipient’s privacy policy. The service provider is the processor. It processes data under the data processing terms, which the parties must have agreed to before processing begins.

11. Transfer of rights and obligations

The service recipient may not transfer any of its rights or obligations under these terms, in whole or in part, without the service provider’s written consent.

The service provider may use agents or subcontractors to carry out its obligations under these terms. The service provider always remains responsible to the service recipient for this work. The use of sub-processors is governed by the service provider’s data protection terms.

12. Changes to the terms

The service provider reserves the right to change these terms. The service recipient will be notified electronically at the email address it has provided, or by another verifiable method. Notice will be given at least two weeks before the new or changed provisions take effect. New or updated terms are also announced on Ísland.is before they take effect.

The service provider may make changes at shorter notice if the law requires them. In such cases, the service provider will try to give notice of the changes as soon as possible.

These terms were last updated: 24 August 2026.

This text was translated from Icelandic using a machine translation. Be advised that content generated by machine translation can be inaccurate or flawed.