New Board of Directors of the Data Protection Authority
12th June 2025
Minister of Justice Þorbjörg Sigríður Gunnlaugsdóttir has appointed four new board members and four new alternates to the board of directors of the Data Protection Authority for a five-year term, starting on 10 June 2025.

Minister of Justice Þorbjörg Sigríður Gunnlaugsdóttir has appointed four new board members and four new alternates to the board of directors of the Data Protection Authority for a five-year term, starting on 10 June 2025.
The new chairman of the Board is Dóra Sif Tynes, a lawyer and owner at ADVEL. She completed her law degree from the University of Iceland and her master’s degree in European law and comparative law from the European University Institute in Florence, Italy, in 2000. Previously, she has worked as the director of the EFTA Legal Office in Brussels. Dóra Sif has extensive experience of representing both the EFTA Court and the EU courts and specializes in the field of data protection rights.
The Board is composed of:
The main players:
Dóra Sif Tynes, lawyer, chairperson, appointed without a nomination until 9 June 2030
Árnína Steinunn Kristjánsdóttir, Senior Legal Officer of Nasdaq in Iceland, Vice-Chair, appointed without a nomination until 19 February 2028
Professor Thor Aspelund, nominated by the Minister of Health, until 9 June 2030
Gunnar Ingi Ágústsson, lawyer, nominated by the Minister of Infrastructure, until 9 June 2030
Jónas Sturla Sverrisson, Security Director, Appointed by the Icelandic Reporting Technology Association, until 9 June 2030
Replacements:
Sigurjón Ingvason, lawyer, appointed without a nomination until 9 June 2030
Andrés Þorleifsson, lawyer, appointed without a nomination until 9 June 2030
Guðbjörg Pálsdóttir, nurse, nominated by the Minister of Health, until 9 June 2030
Lára Herborg Ólafsdóttir, lawyer, nominated by the Minister of Universities, Industry and Innovation, until 19 December 2028
Guðrún Valdís Jónsdóttir, Security Director, Appointed by the Icelandic Reporting Technology Association, until 9 June 2030
The Data Protection Authority is appointed pursuant to Article 38 of Act No. 90/2018 on the Protection of Privacy and the Processing of Personal Data.
