Personal Data Protection Policy of deCODE Genetics

1. About deCODE’s Personal Data Protection Policy 

Since deCODE Genetics ehf. (“deCODE”) was established, the security of personal data processing has been a key element of its operations. “Personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name or identification number, or to one or more factors specific to that person’s physical, physiological, genetic, mental, social or cultural identity. 

deCODE processes personal data in accordance with the Icelandic Act No 90/2018 on Data Protection and the Processing of Personal Data (the “Data Protection Act”), Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), Act No 44/2014 on Scientific Research in the Health Sector, Act No. 110/2000 on Biobanks and Health Databanks, and other applicable Icelandic and international rules and standards governing the conduct of scientific research. deCODE has also adopted code of ethics and code of conduct that apply, among other things, to researchers employed by deCODE.  

In many ways, the processing of personal data for scientific research differs from other kinds of personal data processing, for example, regarding the registered individuals’ interests. Thus, many specific provisions in the Data Protection Act focus on the special nature of such processing, as well as the special Act on Scientific Research in the Health Sector, applying to carrying out scientific research, and the activities of the National Bioethics Committee that safeguard participants’ interests. 

deCODE’s Personal Data Protection Policy is based on this unique position. It explains the categories of personal data that deCODE collects and processes, the purposes of the processing, the anticipated retention periods, the measures used to protect the data, and the rights of individuals as data subjects. 

Further information about the processing of personal data in each scientific research project conducted by deCODE is provided in the introductory letter for the research project and participants’ informed consent in the research project. That information supplements this Personal Data Protection Policy. 

2. About deCODE Genetics and the Participant Recruitment Center 

deCODE has conducted scientific research authorised by the National Bioethics Committee for more than two decades. Its research is in the field of human genetics and is carried out with the participation of individuals and a range of collaborators, including employees of Landspítali – The National University Hospital of Iceland, other healthcare institutions and self-employed healthcare professionals. The Participant Recruitment Center (Þjónustumiðstöð rannsóknarverkefna, “PRC”) is an independent non-profit institution that carries out the clinical part of deCODE’s genetic research for collaborators within the Icelandic healthcare system who request its services. Acting on behalf of the controller for each research project, PRC personnel collect biological samples and information concerning disease symptoms, risk factors, diagnoses and treatment. PRC therefore acts as a processor for deCODE. Further information about deCODE is available at www.decode.is, and further information about PRC is available at www.rannsokn.is. 

deCODE Genetics ehf., Sturlugata 8, 101 Reykjavík, Iceland, company registration number 691295-3549, is the controller for the processing of personal data described in this Privacy Policy, including processing carried out for deCODE’s scientific research. Daníel F. Guðbjartsson, scientist and statistician with extensive experience in genetic research, is the person responsible for the scientific research under the Act on Scientific Research in the Health Sector. deCODE’s research depends on the participation of numerous individuals who have provided biological samples and given informed consent for data concerning their health and other factors affecting health and quality of life to be used in human genetics research. deCODE processes biological samples and personal data using pseudonyms generated by deCODE’s pseudonymisation system. The system has been in use for more than 20 years, has been approved by, and is subject to the supervision of, the Icelandic Data Protection Authority. The GDPR expressly recognises pseudonymisation as an important safeguard. Biological samples and research data are also protected in secure storage facilities and information systems through robust technical and organisational measures designed to ensure internal and external security. 

Research findings that meet the applicable scientific standards are published in leading peer-reviewed scientific journals. Research data and findings are published only in a form that does not identify individuals. 

3. Categories of personal data collected and processed

deCODE collects and processes personal data to conduct research on the genetics of the Icelandic population and thereby investigate the causes of many serious diseases, including cancer, cardiovascular disease and diabetes. Identifying genetic variants associated with disease may create opportunities to improve health and quality of life. 

The categories of personal data that deCODE works with includes information on people’s state of health that is obtained from clinical collaborators, information from databases in conformity with a research permit from the National Bioethics Committee and participants’ answers to questionnaires in scientific research projects that store general personal data in addition to data on their state of health and lifestyle. In terms of research involving the use of health data from international health data collections1, it is based on permits from science ethics committees in the relevant country.deCODE also processes genetic information obtained by isolating and analysing DNA from biosamples that participants provided or were obtained from biological specimen banks in addition to data about the expression of genes and the proteins formed from them. This, therefore, involves personal data that is deemed to be sensitive. deCODE likewise processes genealogical information obtained from the Book of Icelanders. 

deCODE processes personal data relating to job applicants. Information needed to assess applications may include contact details, curricula vitae, cover letters, information about education and qualifications, and references or other information provided by third parties. deCODE also processes personal data in connection with communications with its suppliers. Video recordings is collected at deCODE’s premises. In addition, deCODE is subject to legal obligations applicable to Icelandic businesses that require the processing of personal data unrelated to scientific research, including in relation to employment, accounting and taxation. deCODE receives general population-register information from Registers Iceland to update genealogical information. The website islendingabok.is collects and processes personal data for genealogical research; further information is available on that website. In a substantial number of international scientific collaborations, deCODE acts as a processor. In that capacity, deCODE processes genetic data derived from biological samples collected by foreign collaborators whose research has been authorised by the relevant ethics committee and, where applicable, for which participant consent has been obtained. In all cases, the samples are received in encrypted form and then put into deCODE’s pseudonymization system.  

In specific cases, deCODE performs clinical work for the Icelandic healthcare system. In those cases, deCODE acts as a processor or sub-processor, processing personal data on the documented instructions and under the responsibility of the relevant healthcare institution or public authority, pursuant to a data processing agreement or sub-processing agreement. Examples include sampling and measurements carried out under agreements with the Chief Epidemiologist and Landspítali in connection with the COVID-19 pandemic. When acting as a processor or sub-processor, deCODE may contact data subjects only in accordance with the controller’s instructions. 

4. Purposes and lawful bases for processing personal data

deCODE processes personal data for the purpose of conducting scientific research in the health sector. This includes analysing genetic data relating to characteristics of groups and their association with health information and other factors relevant to human diversity. The research seeks to generate new knowledge by linking variation in the human genome with phenotypes such as disease. That knowledge may in turn contribute to the development of new methods for diagnosing and treating disease. deCODE’s research is deemed to be basic research. 

The processing of personal data for scientific research is based on the legal authorisations provided for in applicable legislation, including the Act on Biobanks and Health Databanks and the Act on Scientific Research in the Health Sector, and on research permits issued by the National Bioethics Committee under that legislation. Where applicable, processing is also based on the informed consent of participants. A participant may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal, and results of research already completed are retained. If information is acquired from people other than the participant, this is done under the authority of the act and the research permit. Examples of such research are desk analysis, which is covered in the laws on scientific research within the health sector, which builds on existing data, and the participation of individuals is not required. In terms of research involving the use of health data from international health data collections, the authority for the processing is from the participant’s consent, and the legitimate interests of deCODE, whereas the processing is necessary for scientific research. In terms of research involving the use of health data from international health data collections, the lawful base relied upon are the participant’s consent and deCODE’s legitimate interests in carrying out scientific research.   

The use of genealogical information from Íslendingabók (Book of Icelanders) for scientific research in the health sector is based on the same legal base as the processing of other personal data for such research, namely a permit from the National Bioethics Committee. In addition, all research data must be handled in accordance with the Icelandic Data Protection Authority’s specific instructions to deCODE concerning procedures for ensuring the security of personal data processed for scientific research in the health sector. 

The processing of job applicants’ personal data is based on consent and on steps taken at the applicant’s request prior to entering into a contract. The processing of personal data in connection with communications with supplier is based on the performance of a contract. Processing necessary for compliance with a legal obligation is based on the relevant legislation. Recordings from video cameras at and around deCODE’s premises is based on deCODE’s legitimate interests. deCODE’s websites store cookies on the computer or smart device used to access them.  

When deCODE acts as a processor in an international scientific collaboration and processes genetic data derived from biological samples received from a foreign collaborator, it processes the personal data on the controller’s documented instructions and pursuant to a valid data processing agreement between deCODE and the controller. The controller is responsible for compliance with the laws and regulations applicable to the research, including obtaining a permit from the relevant ethics committee and, where applicable, the informed consent of participants. 

In specific instances, deCODE performs clinical work for the Icelandic healthcare system as a processor acting on the instructions and under the responsibility of the relevant healthcare institution or public authority, pursuant to a data processing agreement. Examples include sampling and measurements carried out under agreements with the Chief Epidemiologist and Landspítali in connection with the COVID-19 pandemic. 

5. How long do weretainpersonal data? 

Data is retained for the duration of the research and for as long as necessary to achieve the objectives of the relevant research project, in accordance with applicable law, the relevant research permit and, where applicable, the conditions imposed by international health data collections. Any longer-term retention of research data is based on the authorisations provided for in Act No 110/2000 on Biobanks and Health Databanks. 

Personal data unrelated to scientific research are retained for as long as necessary in light of the purposes of the processing, contractual requirements, applicable legal obligations – including accounting and tax requirements – and other objective and legitimate reasons. deCODE has adopted a data retention policy. 

6. Disclosure and transfer of personal data

deCODE does not disclose personal data or personal identifiable data from its scientific research projects to third parties. 

In exceptional cases, deCODE engages service providers within or outside the European Economic Area (EEA) to perform additional analyses or measurements of biological samples using specialised equipment or technology not available to deCODE. In all such cases, the samples are sent without direct identifiers and under pseudonyms. Any transfer to a third country or international organisation is carried out in accordance with Chapter V of the GDPR. 

PRC is deCODE’s processor for personal data containing direct identifiers, such as names and Icelandic identification numbers, and is responsible, among other things, for communications with research participants. Where necessary, deCODE provides PRC with personal data under pseudonyms so that PRC can perform its tasks in accordance with the relevant research permit issued by the National Bioethics Committee. Further information about PRC is available at www.rannsokn.is. 

deCODE does not engage processors to carry out further processing of health data received from international health data collections. 

When acting as a processor for a foreign collaborator, deCODE provides the results of analyses carried out on foreign biological samples to the controller in accordance with the controller’s instructions, as set out in the applicable data processing agreement. 

7. How do we ensure the security of personal data?

Information security has been a key element of deCODE’s operations since the company was established. The secure handling of personal data is fundamental to maintaining the trust of the public and research participants. deCODE’s Information Security Policy provides the foundation for its information security management system. 

deCODE continually assesses risks to the security of personal data and implements appropriate technical and organisational measures. These include encrypting direct identifiers and replacing them with pseudonyms, segregating data in closed systems without internet access, access controls, and a range of other measures designed to protect information systems and support operational resilience throughout deCODE’s activities. deCODE also maintains internal oversight and regularly reviews its risk assessments and incident response and contingency plans. 

8. Rights of individuals

The Act on Data protection provides individuals with a number of rights in relation to the processing of their personal data. These rights are subject to the conditions and limitations set out in applicable law, including specific limitations relating to scientific research. 

8.1 Right of access 

As a main rule, a data subject has the right to obtain confirmation from the controller as to whether personal data concerning them are being processed and, where that is the case, access to those personal data. Under section 18(2) of the Data Protection Act, read together with Article 89(2) GDPR, this right may be restricted in the context of scientific research where its exercise is likely to render impossible or seriously impair the achievement of the research objectives and the restriction is necessary for the fulfilment of those objectives. Here, personal data are, therefore, excempted that are not being used to support the dispositions or decisions of the individual involved. In its research, deCODE is not taking decisions or making arrangements for participating individuals. All of deCODE’s research effort focuses on seeking new knowledge about groups of people, not individuals, even though the basic research data are data about individuals. Consequently, there will be unprocessed basic data about individual participants in deCODE’s research, like data on the sequences of nitrogenous base in DNA according to its genotyping, but not specific findings applying to particular participants and in connection with the relation of the data to particular phenotypes like a disease. There will therefore be no accessible files at deCODE describing relations between specific variables in individuals’ genomes and phenotypes like diseases. Instead, there will only be group files describing such relations for bigger groups. It is therefore not possible to provide participants with information about an individual’s risk linked to genetic traits related to specific diseases in the project that the individual participated in except by carrying out special processing calling for enormous effort, and entailing great cost, and would not further deCODE’s research goals. Consequently, deCODE does not foresee that providing genetic information on an individual basis will be in its purview. The only exception testing this has been mutations in the “BRCA2” gene that unequivocally has medical value for individuals and deCODE decided to devote a great deal of work, effort, and expenditure to make this information accessible through the website  www.arfgerd.is.  

deCODE will therefore provide participants in scientific research requesting information about i) which research projects contain information about them, ii) which genotypes (e.g. disease diagnoses and observed numerical values) are being researched in the relevant project, and iii) which genotypic data are utilised in the relevant project. However, this does not apply to participants in international health data collections; those participants will be referred to the appropriate channels within the data collections to complete their request. 

Upon completion of participation in specific research projects under deCODE’s auspices, the participants get summarised findings of the measurements of clinical factors they have undergone (such as blood pressure and blood value). Such findings are accessible to participants in scientific research project while it is ongoing. 

8.2 Right to rectification 

A data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them, in accordance with Article 16 GDPR. This right may be restricted for scientific research under section 18(2) of the Data Protection Act, read together with Article 89(2) GDPR, where the applicable conditions are met. 

If an individual thinks that information that the data controller for personal data will preserve about him is unreliable, he has the right to have the responsible party correct it immediately, cf. Art. 16 of the General Personal Data Protection Regulation. An exemption to this main rule in instances of scientific research appears in par. 2 of Art. 18 of the Act on the Protection of Privacy as Regards the Processing of Personal Data, cf. par. 2 of Art. 89 of the Personal Data Protection Regulation.  

8.3 Withdrawal of consent 

A research participant who has given informed consent and provided a biological sample has the right under the Act on Scientific Research in the Health Sector to withdraw their consent at any time without giving reasons. The same applies to consent for the preservation of biological samples and health data for use in future research. Where consent is withdrawn, research involving the participant’s biological samples and/or health data will cease. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. 

8.4 Right to erasure 

Under the Act on Data Protection, a data subject has the right to obtain from the data controller the erasure of personal data concerning them where the applicable conditions are met. This right is subject to limitations where processing is necessary for scientific or historical research purposes and erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing, in accordance with Article 17(3)(d) GDPR. Accordingly, the rights are not available regarding the processing of personal data in deCODE’s scientific research. However, the Act on Scientific Research in the Health Sector and the Act on Biobanks and Health Databanks give research participants the right to withdraw consent and to have their biological samples and health data destroyed or erased, as applicable. A participant cannot require destruction or erasure where the biological sample or information has been rendered non-identifiable, the sample has become part of other materials, or the information has already become part of research findings. In such circumstances, the research results can no longer be linked to the participant. Where a participant has withdrawn consent in relation to health data held by an international health data collection, or has requested erasure of those data, deCODE will act on instructions received from the relevant health data collection’s management on how to execute the request. 

8.5 Right to restriction of processing and right to object 

Data protection law gives data subjects the right, in certain circumstances, to obtain from the controller restriction of processing and to object to processing. An objection may require the controller to cease processing. Under section 18(2) of the Data Protection Act, read together with Article 89(2) GDPR, these rights may be restricted in relation to scientific research where the applicable conditions are met. Research participants nevertheless retain the rights to withdraw consent and to request destruction or erasure under Icelandic research and biobank legislation, as described in sections 8.3 and 8.4 above. 

8.6 Complaint to the Data Protection Authority  

Individuals have the right to complain to the Data Protection Authority if they think that the provisions of The Act on Personal Data Security have not been followed, or that deCODE has not responded to a complaint regarding the unsatisfactory processing of their data. The complaint shall be sent to postur@personuvernd.is or the address of The Data Protection Authority, Rauðarárstígur 10 105 Reykjavik. The Data Protection Authority oversees the monitoring of carrying out of the Act on Personal Data Security and the processing of personal data and ruling on disputes in the field of personal data security.  

9. How can you contactdeCODE 

Individuals may contact the Participant Recruitment Center (PRC), Sturlugata 8, Reykjavík, telephone +354 520 2800, for general information about the conduct of scientific research or the processing of personal data. Individuals should also contact PRC to request information about the processing of their personal data in deCODE’s scientific research, on the basis of this Personal Data Protection Policy, the Act on Data Protection and the Act on Scientific Research in the Health Sector. Request forms are available from PRC. To ensure secure identification, an individual submitting a request must present a valid personal ID with a photo.   

Requests by telephone or email for information on the processing of personal data are not accepted at deCODE because such communications media do not fulfil personal data security requirements. Findings containing personal data are also not delivered that way. 

If an individual considers that PRC has not responded adequately to a request concerning the processing of personal data, they may contact deCODE’s Data Protection Officer by email at personuvernd@decode.is. The Data Protection Officer monitors deCODE’s compliance with applicable data protection laws and regulations. deCODE’s Data Protection Officer is Erla Þuríður Pétursdóttir, lawyer. 

The latest information about deCODE’s processing of personal data is available in the information materials published on www.decode.is. 

10. How does deCODE update and change its Personal Data Protection Policy? 

deCODE may amend or supplement this Personal Data Protection Policy from time to time to ensure that it accurately reflects deCODE’s current processing activities. Amendments may take effect without prior notice, including where changes are required to align the Personal Data Protection Policy with applicable data protection laws and regulations. The current version of the Personal Data Protection Policy is always available on deCODE’s website at www.decode.is. 

This Personal Data Protection Policy first took effect on 15 July 2018 and was subsequently amended on 27 May 2020, 15 July 2022, 17 October 2023, 23 June 2025 and 8 May 2026.