In 2010 the Althingi — the Icelandic parliament — passed a resolution to direct the country toward the strongest combined regime for freedom of expression, source protection and host immunity in any single jurisdiction. That resolution is the Icelandic Modern Media Initiative, IMMI. Several of its pillars are now written into ordinary law; the rest of the doctrine shapes how Icelandic courts and regulators read communications cases.
On top of IMMI sits Section 73 of the Icelandic Constitution, which guarantees freedom of expression and forbids prior restraint. Iceland is an EEA member but not in the EU — GDPR applies through the EEA agreement and is enforced by Persónuvernd as the national regulator, but the Court of Justice of the European Union has no direct authority over an Icelandic operator.
Iceland has no statutory mandate for mass data retention. National security legislation is comparatively narrow. The country is small, the rule of law is strong, and the political consensus around protecting communications infrastructure is unusually durable across the political spectrum.
A Reykjavík VPS therefore sits inside a jurisdiction that combines a constitutional free-expression guarantee, an explicit parliamentary doctrine of privacy and source protection, an independent EEA-aligned data-protection regime, and the operational reality of being on an island connected to the rest of the world by two private submarine cables. For privacy-conscious workloads it is, quite literally, an outlier — both legally and geographically.