A new act on Data Protection and the Processing of Personal Data came into effect in 2018. The nature of Reykjavik Energy Group's operations means, that business and communication involves a large number of people. Thus, it is imperative that procedures are in place and conform with increased requirements, regarding data storage and processing. The Group began its preparations for the implementation of the new law in 2016. The procedure was completed in 2018, when Data Protection Policy was approved by all subsidiaries within the Group. This was preceded by extensive revision of work procedures. Courses, attended by the majority of employees, were also held on the topic.

Since the new law took effect, no verdict has fallen against any subsidiary of Reykjavik Energy Group by the Data Protection Authority (DPA). One complaint from 2020 is pending.

In 2020, one issue regarding processing of personal data needed resolution. Veitur Utilities was planning to empty the reservoir at Árbaer, and if the residents were to be informed about the decision, their emails, stored at Veitur Utilities, would have to be used. For data protection purposes, it was decided not to send the emails.