A new act on Data Protection and the Processing of Personal Data came into effect in 2018. The nature of Reykjavik Energy Group's operations means, that business and communication involves a large number of people. Thus, it is imperative that procedures are in place and conform with increased requirements, regarding data storage and processing. The Group began its preparations for the implementation of the new law in 2016. The procedure was completed in 2018, when Data Protection Policy was approved by all subsidiaries within the Group. This was preceded by extensive revision of work procedures. Courses, attended by the majority of employees, were also held on the topic.

Since the new law took effect, no verdict has fallen against any subsidiary of Reykjavik Energy Group by the Data Protection Authority (DPA). One complaint from 2020 is still pending.

In 2021, Veitur Utilities sought an opinion by DPA regarding a data request from Statistics Iceland relating to a census. The data was delivered following DPA's decision.