The Icelandic Data Protection Authority (Persoonuvernd) applies GDPR-equivalent rules through the EEA agreement. There is no blanket telecom data retention requirement for non-licensed operators. For a small FreePBX install serving an organisation, this means you set your own CDR retention policy with no externally mandated minimum.
The IMMI parliamentary resolution (2010) committed Iceland to a model law package on source protection and intermediary liability. Implementation has been partial but the political direction is clear.