Recruit
Iceland applies the GDPR to recruitment within a very small labour market where informal reference checking carries unusual weight. Formal criminal record screening is the exception rather than the norm.
Criminal record checks
The candidate requests a sakavottord, the criminal record certificate, from the district commissioner and provides it to the employer. Employers cannot access the record themselves. There are different versions depending on purpose, with the general certificate showing a narrower set of convictions. A check is justified where the role warrants it, covering financial services, private security, education, childcare, healthcare, and positions with access to significant assets. Legislation restricts people with certain convictions from working with children, which makes the check a genuine requirement in those settings.
What employers can check
Identity, right to work, employment history, and academic qualifications are all legitimate. Many professions are legally protected and require licensing, which is a real condition of practice and easy to verify. Because the market is small, informal reference checking is common, and employers should be careful that it does not drift into collecting information they could not lawfully ask for directly.
Data protection
The GDPR applies through Icelandic implementing legislation, supervised by the Data Protection Authority. Conviction data attracts additional protection and cannot be processed simply because a candidate agrees, since consent is a weak basis in employment. Collect the minimum, be transparent about purpose, and delete unsuccessful applicants’ data once recruitment closes.
Practical guidance
Decide which roles genuinely justify a certificate and record the reasoning, view rather than retain where possible, and be deliberate about informal reference conversations. An employer of record can manage screening and payroll if you have no Icelandic entity.
