Atlantic Airways

Faroe Islands · owned by Independent (Faroe Islands) · www.atlantic.fo · 13 vendors

Atlantic Airways is the national airline of the Faroe Islands, operating scheduled international routes from the Faroe Islands to multiple destinations across Europe, as well as inter-island helicopter services. The company also provides charter flights, helicopter search-and-rescue and medical transport services, operates a flight training academy (Atlantic Airways Aviation Academy), and owns hotels including Hilton Garden Inn Faroe Islands and Hotel Vágar.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-08 · revision 3

13 direct vendors, 161 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Atlantic Airways exhibits a medium-low level of migration readiness. The primary challenge lies in its existing internal tech stack, which includes Umbraco CMS and ASP.NET. These technologies, while functional, are typically not cloud-native or designed with containerization and microservices in mind, suggesting a potentially monolithic architecture that would require significant refactoring or a 'lift-and-shift' approach for cloud migration. There is no explicit mention of modern cloud-native practices like Docker, Kubernetes, or serverless functions. A significant constraint is the inferred data residency in the Faroe Islands. This would necessitate careful planning to ensure compliance, potentially limiting cloud provider choices to those with regions supporting such requirements or requiring a hybrid cloud strategy, which adds complexity. While 'Total Vendors: 0' is confusing, the presence of 16 services from vendors across 5 unique countries (Ireland, Turkey, United States, Denmark, Spain) indicates a degree of vendor diversity, which could mitigate lock-in to a single vendor. However, the 'unknown' vendor lock-in risk means the complexity of disentangling from existing vendor contracts for migration is unclear. On the positive side, the company's consistent revenue growth suggests financial capacity to fund a migration initiative. The regulatory environment, with NIS2 not directly applicable and no publicly advertised certifications, might present fewer immediate compliance hurdles for migration compared to companies operating strictly within the EU. The integration with platforms like CarTrawler and the use of Cloudflare are already cloud-based services, indicating some familiarity with external cloud solutions, but the core internal systems appear less ready for a full cloud transition.

Compliance

9 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Although the Faroe Islands are not an EU/EEA member state, Atlantic Airways extensively processes personal data of EU/EEA residents — including passengers from Denmark, Norway, the UK, France, Spain, Iceland, and Poland — through ticket purchases, the Súlubonus loyalty programme, the Atlantic Airways app, and Atlantic Connect in-flight services. Under GDPR Article 3(2), the regulation applies to any organisation outside the EU/EEA that offers goods or services to EU/EEA data subjects or monitors their behaviour. Atlantic Airways clearly meets this extraterritorial trigger. The Faroe Islands have their own data protection law (Act No. 73 of 8 May 2018, modelled on GDPR), and Atlantic Airways publishes a Dátuverndarkunning (Data Protection Notice). However, the notice content is only partially visible and does not publicly confirm appointment of an EU Representative (required under GDPR Art. 27 for non-EU controllers targeting EU residents), a formal DPO, or documented cross-border transfer mechanisms (SCCs/adequacy decisions). The risk level is High because: (1) airlines are a high-profile enforcement target; (2) passenger data is voluminous and sensitive (travel patterns, payment data, special category data such as meal preferences indicating religion/health); (3) fines can reach €20M or 4% of global annual turnover; (4) the absence of a publicly confirmed EU Representative is a compliance gap.

Evidence: https://www.atlantic.fo/um-okkum/treytir-og-personsvernd/datuverndarkunning/, https://www.atlantic.fo/um-okkum/treytir-og-personsvernd/farsporpolitikkur/, https://www.atlantic.fo

Faroese Data Protection Act — Partially Compliant

The Faroe Islands enacted their own GDPR-equivalent data protection law (Act No. 73/2018) administered by the Faroese Data Protection Authority (Datatilsynið í Føroyum). As a Faroese-registered company, Atlantic Airways is directly subject to this law for all personal data processing activities. The law mirrors GDPR principles including lawful basis, data subject rights, security obligations, and breach notification. Risk is High because: (1) Atlantic Airways processes large volumes of passenger personal data; (2) the loyalty programme (Súlubonus) involves ongoing profiling; (3) the published privacy notice (Dátuverndarkunning) exists but its completeness cannot be fully verified from public sources; (4) non-compliance with the national DPA could result in regulatory action.

Evidence: https://www.atlantic.fo/um-okkum/treytir-og-personsvernd/datuverndarkunning/, https://www.atlantic.fo/um-okkum/treytir-og-personsvernd/farsporpolitikkur/

ICAO Standards and Recommended Practices — Partially Compliant

The Faroe Islands, as a territory of Denmark, fall under Denmark's ICAO membership obligations. ICAO SARPs (Annexes 1–19) govern international civil aviation safety, security, and efficiency. Atlantic Airways, as an international carrier operating across multiple countries, must comply with ICAO standards as implemented by the Faroese/Danish Civil Aviation Authority. Risk is Medium because Denmark has a strong ICAO compliance record, but the Faroe Islands' autonomous status creates some regulatory complexity in implementation and oversight.

Evidence: https://www.atlantic.fo/um-okkum/felagid/, https://www.atlantic.fo/tyrlan/

Financials

Three-year financials

Financial Resilience Score: 7/10

Atlantic Airways demonstrates solid financial resilience underpinned by 100% Faroese Government ownership, which provides an implicit backstop and strategic national-infrastructure status. The company benefits from a recurring, non-cyclical revenue stream through its public-service contract for helicopter SAR, medevac, and inter-island transport, which smooths passenger-cycle volatility. Post-COVID recovery has been strong, with record profitability achieved in 2022 and 2023, and equity has grown steadily through retained earnings. The airline enjoys a de-facto monopoly on several Faroese routes (particularly Vágar–Copenhagen) with limited competition, and its diversified revenue mix across scheduled flights, charter/ACMI, helicopter operations, aviation training, and hotels provides multiple income streams. A modern Airbus A320-family and AW139 fleet reduces fuel burn and maintenance risk. However, resilience is constrained by the small home market (Faroe Islands population ~54,000), heavy route concentration on Copenhagen, weather/operational risk at Vágar, USD-denominated fuel exposure versus DKK/EUR/GBP ticket revenue, and emerging low-cost competition. The upcoming capex cycle for A320neo transition and helicopter replacement will require significant investment, and the airline's small scale limits bargaining power on fuel, insurance, and distribution.

Key strengths: 100% Faroese Government ownership providing implicit state backstop, Public-service contract for helicopter SAR/medevac providing recurring revenue, De-facto monopoly on key Faroese routes (Vágar–Copenhagen), Diversified revenue mix across scheduled, charter, helicopter, training, and hotels, Modern Airbus A320-family and AW139 fleet, Strong post-COVID profitability recovery in 2022 and 2023, Steady equity growth through retained earnings

Risk factors: Small home market (Faroe Islands population ~54,000), Heavy route concentration on Copenhagen, Weather and operational risk at challenging Vágar airfield, Fuel (USD) and FX exposure versus DKK/EUR/GBP revenue, Emerging competition from low-cost carriers at Vágar, Upcoming capex cycle for A320neo and helicopter fleet renewal, Small scale limiting bargaining power on fuel, insurance, distribution, High dependence on tourism and diaspora traffic

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report