The data may include:

• Names and contact details

• Workplace or relationship with a public body, company or other party

• The subject of a request

• Information in letters, emails or attachments

• Information generated when answering calls or handling requests

• Visitor information, such as name and workplace

• Communication history and information about how a request was handled

In some cases, requests or attachments may contain sensitive personal data. The Authority processes only the information needed to direct or handle the request.

The data is processed to:

• Receive requests

• Answer calls and inquiries

• Direct letters and requests to the appropriate recipient

• Register and retain requests where required

• Receive visitors and keep records of visits

• Ensure security and traceability in communications with the Authority

• Carry out general administration and provide services

The data comes mainly from individuals themselves, letters, calls, emails, the visitor registration system, the case management system, the state’s human resources and payroll systems, or other communication systems.

Access is given to Authority staff who need to receive, register, forward or handle requests. Service providers that operate or support the Authority’s case management, call handling, visitor registration or communication systems may also have access.

The data may include:

• Name, Icelandic identification number (kennitala) and contact details

• Information in a CV and application

• Education, work experience, qualifications and professional credentials

• References or information from referees, where applicable

• Results of assessments and interviews

• Communications with the applicant

• Documents needed to complete the hiring process if the applicant is appointed

The purposes are to:

• Receive and manage applications

• Assess applicants’ qualifications

• Select a person for the position

• Register and retain recruitment records

• Respond to requests for information or reasons for a decision, where applicable

• Complete the hiring process if an applicant is appointed

The data comes mainly from applicants, the recruitment system and referees named by applicants. Where permitted, it may also come from public registers or other sources.

Access is given to Authority staff involved in recruitment, such as human resources staff, managers and others who need to assess an application for the position. Providers of recruitment, document management or communication systems may have technical access under contract.

The Authority mainly processes the following data, as needed in each case:

• Identifying information, such as name and Icelandic identification number

• Contact details, such as address, email address and telephone number

• Bank details

• Information about invoices, claims, payments, credit balances and refunds

• Information about outstanding debts, arrears, collection and payment arrangements

• Information relating to the assessment of public charges and associated reporting obligations, or to other claims

• Information from communications with individuals, representatives, public bodies or others

• Records needed for statutory oversight, auditing or reconciliation

Sensitive personal data is not generally processed for these purposes. In individual cases, however, information may relate to the type of service or claim established by the relevant public body—for example, a claim connected with health, education or social services. The Authority then processes only the information needed for payment, assessment or collection of the claim.

The data is processed so that the Authority can carry out its statutory and contractual duties, including to:

• Pay invoices and other obligations of the State Treasury or state bodies

• Handle refunds, credit balances, advance payments and corrections

• Make grants, subsidies and other payments under agreements

• Remit statutory payments and deductions

• Establish, register and collect public charges and other claims

• Allocate payments correctly and carry out reconciliations

• Handle initial collection, collection of arrears, write-offs and payment plans

• Answer inquiries and communicate as needed with individuals, representatives, public bodies and others

• Verify information when needed for payment, assessment or collection

• Provide records for statutory oversight or auditing, including to the Icelandic National Audit Office.

The data may come from:

• The individual or their representative

• State bodies or other public bodies that establish claims or provide information to the Authority

• The tax authorities, where applicable

• Employers or others involved in statutory reporting and remittances

• Payment and collection systems

• Public registers, such as the National Registry and Statistics Iceland

• Other data sources where access is permitted

Access is given to Authority staff who need the data for their work, such as payment management, accounting, collection, assessment, reconciliation or oversight.

The data may also be shared with others when necessary or required by law, including:

• The public bodies to which a claim or payment relates

• Payment processors and banks

• Debt collection providers

• Municipalities, pension funds or other statutory recipients

• District commissioners, Statistics Iceland or other authorities, where applicable

• The Icelandic National Audit Office for statutory oversight and auditing

• Data processors that provide the Authority with technical or operational services

The Authority mainly processes the following data, as needed in each case:

• Name, Icelandic identification number and user ID

• Email address, telephone number, public body, organisational unit and job role

• Access permissions, roles and changes to access

• Support requests, communications, error descriptions and attachments

• System and activity logs, such as records of logins, changes, system jobs and errors

• Information appearing in testing, development or operational data

• Information from financial, payroll or human resources systems when needed for operations, support, testing or troubleshooting

In exceptional cases, this processing may involve sensitive personal data or confidential records, particularly if real data from payroll, human resources or financial systems is used for support, testing or troubleshooting. The Authority seeks to minimise the data used and restrict access.

Support requests and operational records may contain information supplied by users, including attachments or descriptions of issues. The Authority seeks to limit this information to what is needed to resolve the request, error or operational issue.

The data is processed to:

• Operate and maintain the state’s financial, payroll and human resources systems

• Provide system users with support and technical assistance

• Create, change and close user accounts

• Ensure appropriate roles and access controls

• Identify and resolve errors or operational issues

• Test changes and new features before they go into use

• Ensure that actions in systems can be traced

• Support information security and stable operations

• Carry out the Authority’s statutory and contractual duties for the State Treasury and state bodies

The data is also processed to manage access to systems and file areas, receive and handle support requests, run technical processes, test changes, identify errors and keep the systems that the Authority operates or supports for state bodies running securely.

The data may come from:

• The individual

• System users

• State bodies that use the Authority’s systems or services

• Underlying financial, payroll and human resources systems

• Support requests, work order systems and communications

• System and activity logs

• Service providers involved in operating or maintaining systems

Access is given to Authority staff who need the data for operations, support, development, testing, access management or security monitoring.

Service providers working for the Authority, such as operations, system or hosting providers, may also have access to the extent needed to provide their services. They must act under a contract and in accordance with the instructions of the Authority or another data controller, as applicable.

The data depends on the task. It may include:

• Name, Icelandic identification number or other identifiers

• Public body, position, employment percentage, trade union membership and workplace

• Financial information, such as account details, amounts and payments

• Payroll or human resources information when needed for the analysis

• Information from data warehouses, financial systems, human resources systems or reporting systems

• Information about bidders or contracting parties in public procurement

• Information from contracts or procurement documents

• Aggregated or derived information in dashboards

• Technical information generated by automated processes

For data analysis, dashboards and data warehouses, the Authority may process information about state employees, including pay, position, public body, employment percentage, workplace, job title, education, trade union membership and pension fund information. It may also process other information needed to give public bodies an overview, support management, produce reports and improve services.

When financial information is published, the Authority seeks to remove or limit personal data so that unnecessary or sensitive information is not disclosed.

The data is processed to:

• Prepare reports and dashboards for management, oversight and review

• Analyse financial, operational, payroll and human resources information

• Support planning, financial reporting and administration

• Improve oversight and decision-making in public procurement

• Automate recurring processes

• Publish financial information where permitted

• Ensure transparency in the use of public funds

• Reduce manual processing and the risk of errors

The data is also processed to produce human resources analyses, dashboards and summaries for state bodies, including to provide an overview of the state workforce, support planning and help public bodies carry out their statutory and administrative duties.

The data may come from:

• State financial systems

• Payroll and human resources systems

• Data warehouses

• Accounting and financial reporting records

• The Authority’s procurement, contract, financial and reporting systems

• State bodies that provide or review data

• Automated processes and reporting systems

Access is given to Authority staff who need the data for analysis, reporting, dashboards, publication or oversight. Access to dashboards and analyses is restricted according to roles and need.

When aggregated information is shared, the Authority seeks to reduce the possibility of identifying individuals through access controls, aggregation and data minimisation.

If information is published—for example, in open accounting records—it may become available to the public. Before publication, the information is reviewed and cleaned to reduce the risk of disclosing personal data that should not be published.

The Authority mainly processes the following data, where applicable:

• Name, Icelandic identification number and contact details

• Public body, trade union, position, employment percentage, job title and organisational unit

• Hiring information, employment contracts and changes to a position or employment terms

• Pay, pay grades, types of pay, deductions and wages paid

• Bank details

• Information about deductions made by the state and municipal collection authority

• Tax card information, withholding tax, pension funds, supplementary pension savings, payroll tax and other payroll-related charges

• Annual leave, length of service, entitlements and accrued leave obligations

• Time records, attendance, leave and absences

• Information relating to illness or other absences when it affects pay, entitlements or records

• Payslips, annual wage statements, remittance reports and other statutory filings

• Information needed for certificates, confirmations and employment history

• Communications, support requests and records relating to inquiries from public bodies or employees

This processing includes sensitive personal data, such as information about trade union membership, illness and absences. The Authority processes it only to the extent needed for the task.

The data is processed to:

• Manage human resources information for state bodies

• Ensure that employment history, length of service and entitlements are recorded correctly

• Calculate and pay wages

• Issue payslips and ensure employees receive accurate information about their pay

• Manage annual leave, attendance, time records, other leave and absences

• Make payroll corrections and changes arising from collective agreements

• Record payroll costs and carry out reconciliations

• Submit annual wage statements, remittance reports, withholding tax information and other statutory information to the relevant recipients

• Provide services to state bodies and answer inquiries

• Issue employment certificates and confirmations where permitted

• Develop, test and maintain the state’s human resources and payroll systems as needed

• Settle pay, annual leave and other types of leave when employment ends

• Provide or support a digital platform for state bodies to advertise jobs and conduct recruitment

• Answer inquiries and provide confirmations relating to employment, pay, pension entitlements or other rights where permitted

If sensitive personal data, such as information about illness or absences, is processed, the conditions in Article 11 of Act No. 90/2018 must also be met. If information about criminal conduct is processed, the conditions in Article 12 of the Act must be met.

The data may come from:

• The relevant state body

• A manager or payroll officer at that body

• Human resources, payroll, attendance and time recording systems

• Public registers, such as the National Registry

• The tax authorities, pension funds, supplementary pension funds, banks, trade unions and others, as applicable

• Support requests, emails and other communications

Access is given to Authority staff who need the data for human resources, payroll, system, support or financial reporting tasks.

The data may also be available or shared with:

• The state body where the individual works or has applied for a job

• The employee

• Managers and payroll officers at the relevant body, according to their roles and permissions

• Banks, to make wage payments

• The tax authorities, for withholding tax, annual wage statements and other statutory filings

• Pension funds and supplementary pension funds

• The Icelandic National Audit Office and other oversight bodies, where applicable

• Service providers that operate or support human resources, payroll, attendance or document management systems

• The tax authorities and the Icelandic National Audit Office for statutory filings, financial reporting, oversight or auditing

The data may include:

• Identifying information and contact details

• Position, public body, manager and employment percentage

• Information employees enter or update themselves, such as education, contact details and other employment-related information

• Time records, attendance, absences, leave and annual leave

• Requests, approvals, comments and communications

• Activity logs and records of changes in systems

The purposes are to:

• Allow employees to view and update their own information

• Allow managers to approve and review information within their roles

• Manage working hours, absences, annual leave and entitlements

• Ensure that information affecting pay and entitlements is correct

• Provide support and resolve inquiries or errors

The data comes from employees, managers, the relevant state body and the human resources, payroll and attendance systems used.

Access is given to the employee, relevant managers, payroll officers, the relevant state body and Authority staff who need the information for support, payroll processing, corrections or system operations.

The data may include:

• Name and Icelandic identification number

• Position, employment history, public body and employment percentage

• Pay information

• Information about the end of employment or entitlements

• The content of the request and related communications

• Records needed to verify the information

The data is processed to:

• Answer inquiries

• Issue certificates or confirmations

• Provide information to authorised recipients

• Serve state bodies and their employees

• Meet legal obligations or respond to lawful requests

The data comes from human resources and payroll systems, the relevant state body, the employee, or earlier communications and records.

Access is given to Authority staff and staff at the relevant state body who need the data to handle the request. Information is shared only with a party authorised to receive it, such as the employee, the relevant state body or another authorised recipient.

The Authority mainly processes the following data, where applicable:

• Name, Icelandic identification number and contact details

• An individual’s position, role or relationship with a bidder, purchaser or contracting party

• Information in bids, tender documents, contracts and communications

• Qualifications, experience, education, certifications or professional credentials of a bidder’s staff when these form part of a bid evaluation

• Information about subcontractors and their contacts

• Information about the status of public charges when relevant to an evaluation or eligibility requirements

• Minutes, communications and other records relating to the preparation, conduct or follow-up of tenders and contracts

In limited cases, documents may contain more sensitive information or information subject to special protection—for example, criminal record information or details of specialised credentials or individual qualifications included in tender documents. Such data is processed only to the extent needed for the tender, contract or statutory process.

The data is processed to:

• Prepare and conduct tenders

• Provide tender services to state bodies and other public bodies

• Receive, review and evaluate bids

• Assess the eligibility of bidders and, where applicable, their employees or subcontractors

• Ensure that tenders and contracts are handled correctly

• Manage central purchasing agreements and framework agreements

• Analyse the shared purchasing needs of public bodies

• Respond to requests and support inquiries about procurement and contracts

• Retain records for traceability, oversight and records management

The data may come from:

• Bidders

• Contacts at bidders or contracting parties

• Subcontractors

• Public purchasers

• Tender and contract management systems

• Work order and communication systems

• Public registers or other sources where collecting the information is permitted

Access is given to Authority staff involved in procurement, tenders, contracting, support, analysis or oversight.

The data may also be shared with:

• The public purchaser concerned by the tender or contract

• Bidders or contracting parties to the extent provided for by tender and procedural rules

• The Public Procurement Complaints Committee if it considers the matter

• Other authorities or oversight bodies where permitted by law

• Data processors that operate or support tender, contract, document management or communication systems