Iceland is not a part of the European Union. However, it is a member of the European Economic Area (EEA) via EFTA (European Free Trade Association). EFTA established GDPR support on July 20, 2018. Thus, Iceland is now subject to GDPR. Yet, there is a 2003 law that makes the ISPs keep records for six months. The data is supposedly for criminal investigations only. Yet Iceland is cooperating with “Five Eyes” – the intelligence community that includes the US and UK. Knowing what we know about the US and UK spying on private citizens, you may have reasonable doubts about the safety of your data.