Lithuania

The reach comes from Article 3 of the General Data Protection Regulation, which applies directly in Lithuania. Lithuania's own law adds detail on top. It is the Law on the Legal Protection of Personal Data (Asmens duomenu teisines apsaugos istatymas, Law No. I-1374, restated in 2018). Its Article 1(4) says when the Lithuanian law itself applies. It covers companies based in Lithuania. It covers companies outside the European Union that have a representative in Lithuania. It also covers the use of data about people in the European Union. The duty to appoint a representative is Article 27 of the Regulation. The Lithuanian Cybersecurity Law (Kibernetinio saugumo istatymas) works differently. It picks companies by industry and size, not by nationality. The National Cyber Security Centre decides who is covered and puts them on a register.

Industry by industry, checked 18 August 2026. GOVERNMENT AND PUBLIC BODIES. This is the real wall. The Ministry of the Economy and Innovation says that systems graded 'ypatingos svarbos' (critical) and 'svarbus' (important) must be held in state data centres. The Government can set different rules for one named institution by resolution. That power sits in Articles 45(3) and 45(4) of the Law on the Management of State Information Resources. Systems graded 'vidutines svarbos' (medium) and 'mazos svarbos' (low) may be held in state, foreign or private data centres. If they sit in a foreign or private data centre, copies must be kept in state data centres. Government resolution No. 349 sets the list of state data centres. Minister of the Economy and Innovation order No. 4-249 sets the technical and organisational rules for data centres in European Union, European Economic Area and NATO states. So the top two grades are closed, and the bottom two need a copy at home. DIGITAL EMBASSY. This is the reverse. Changes to the same law in May 2022, plus a Government decree of 12 July 2022, made spreading state data compulsory. Some data sits in public data centres, 'but copies will be compulsorily stored outside the territory of Lithuania'. HEALTH. We found no separate location rule. Almost all Lithuanian health records pass through the state e-health system (ESPBI IS). The Ministry of Health runs it, and the state enterprise Centre of Registers handles the data for it. That system is a state information resource, so the government rules above are what really apply. BANKING, PAYMENTS, INSURANCE, SECURITIES. We found no rule that data must stay in Lithuania. We searched the Bank of Lithuania's own catalogue of 239 positions and guidelines. It has incident reporting rules and risk guidance close to outsourcing, but nothing requiring data to be stored in Lithuania. European digital resilience rules for financial firms make you disclose where data is used and stored. They do not make you keep it local. ONLINE GAMBLING. The regulator's technical rules for remote gambling equipment contain no server location rule. They do require logs to be kept for at least 90 days. Medium confidence. TELECOMS. Not confirmed. The Law on Electronic Communications has a version dated 1 July 2026, but we could not read the record-keeping articles from an official source. MAPPING AND LOCATION DATA, EDUCATION, DEFENCE. Not checked. See the list of things we could not confirm. Above all of this sits Regulation (EU) 2018/1807. It stops a member state from forcing non-personal data to be stored on its own soil, unless real public security needs it. Lithuania's state data centre rule is a public buying and security rule, and that is the space the Regulation leaves open.

You can only send data to approved countries, or use one of the approved routes below. The approved-country list is in use. It covers Andorra, Argentina, Brazil (both ways, 26 January 2026), Canada (commercial bodies only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the European Patent Organisation, and United States companies signed up to the Data Privacy Framework. As at 18 August 2026, no country had been taken off the list or suspended. Routes if your destination is not on the list. The 2021 Standard Contractual Clauses (Decision (EU) 2021/914) are the current version and have not been changed. New clauses were promised for companies abroad that already fall under the Regulation through Article 3(2). Those are still not adopted. You can also get company-wide rules approved, known as Binding Corporate Rules. Article 49 gives a few narrow exceptions, but you cannot use them for regular or large transfers. You are still expected to write down why the destination country is safe, after the Schrems II court ruling. European Data Protection Board Guidelines 02/2024 confirm one point. An order from a foreign government is not on its own a legal reason to hand data over. Lithuania's extra step is Article 15 of the Law on the Legal Protection of Personal Data. It only applies to Article 46(3) of the Regulation. That means contract wording the parties write themselves, and arrangements between public bodies. The State Data Protection Inspectorate must give permission, or refuse in writing with reasons, within 20 working days of getting a complete file. It can extend that once by up to 10 working days. You need no permission to use the standard published clauses. The most time-sensitive point is the European Union-United States Data Privacy Framework. It is still in force and legally valid on 18 August 2026, but it is under pressure. The General Court threw out the Latombe challenge on 3 September 2025. An appeal to the Court of Justice was filed on 31 October 2025 and is still open. On 31 July 2026 the European Data Protection Board wrote to the Commissioner. It asked the Commission to look at whether changes to United States institutions affect the decision. The Commission has not suspended or cancelled it. You can use it today. Do not build on it as your only route.

Is the regulator working? Yes, on its own numbers. From the Inspectorate's 2025 annual review, published 1 July 2026: 2,081 complaints received, against 1,408 in 2024; 16 planned and 10 unplanned inspections; 132 monitoring actions; 223 data breach reports covering 1,249,409 people in Lithuania, of which only 63 percent arrived within 72 hours; 34 cross-border complaints led by Lithuania and 28 decisions agreed with other countries; 54 staff posts, up from 46; a budget of 2,198,000 euros (about 2.4 million US dollars). Its published decisions list for 2026 shows 122 decisions between 3 January and 31 July 2026. They are split between 'violations found' and 'no violations found'. Vinted UAB appears seven times. So it is active, but not aggressive. It issues a steady flow of binding decisions and orders. It issues very few fines, and they are small. There were five fines in 2025, from 3,529 euros to 9,000 euros. Part of the reason is built into the law. Article 33 of the national law caps fines on Lithuanian public bodies. For one class of breach the cap is 0.5 percent of that year's budget, and never more than 30,000 euros. For another class it is 1 percent, and never more than 60,000 euros. Private companies still face the full European maximums. There is a second regulator. Article 7 of the national law names the Inspector of Journalist Ethics. That office handles personal data used for journalism, academic work, art and literature. A complaint against a news organisation goes there, not to the Inspectorate. The cyber regulator is the National Cyber Security Centre, under the Ministry of National Defence. It is the authority in charge under the Cybersecurity Law. It can fine you up to 10 million euros or 2 percent of worldwide yearly turnover, whichever is lower. Industry regulators: the Bank of Lithuania covers financial firms, the Communications Regulatory Authority covers telecoms, and the Gaming Control Authority covers gambling. If you want to challenge an Inspectorate decision, you go to the administrative courts. Vilnius Regional Administrative Court comes first, then the Supreme Administrative Court.

MAXIMUM. Article 5(1)(e) of the General Data Protection Regulation. You may not keep data in a form that identifies someone for longer than you need it. Lithuania sets no separate national maximum. MINIMUMS we confirmed: - Health: the state e-health system (ESPBI IS) keeps patient data for the patient's lifetime plus three years. It then goes to archive for 75 years. After that it is deleted or passed to the state archives. The Chief Archivist sets the archiving steps. - Online gambling: remote gambling equipment must store authenticity check results, approved change logs and gaming records for at least 90 calendar days. Video of live table games must be kept for 90 days. - General business papers: the Office of the Chief Archivist publishes one general keep-it table plus 19 industry tables. These cover courts, health care, customs, police, notaries and others. Where an industry table sets a different period from the general table for the same task, follow the industry table. WHICH ONE WINS. Lithuania has no special tie-break rule. A legal duty to keep data is itself your legal reason to hold it, under Article 6(1)(c) of the Regulation. So keep the data for the legal minimum. Limit who can see it. Delete it at the end of that minimum, not when the business need ends. ONE MORE CLOCK, and this one helps you. Article 32(3) of the Lithuanian law says a fine can only be imposed within two years of the breach. Not confirmed: the widely repeated claim that Lithuanian accounting records must be kept for ten years. See the list of things we could not confirm.

DEADLINE 1 - personal data breach. Article 33 of the General Data Protection Regulation. Tell the regulator without undue delay, and where you can, within 72 hours of finding out. Article 34: tell the people affected without undue delay where the risk to them is high. In 2025 the Inspectorate received 223 breach reports affecting 1,249,409 people in Lithuania. Cyber attacks caused 29 percent and human error caused 58 percent. Only 63 percent were reported within 72 hours. DEADLINE 2 - cyber incident. The Lithuanian Cybersecurity Law has been in force since 18 October 2024. It puts the European network and information security directive known as NIS 2 into Lithuanian law. A major cyber incident must be reported at once, and no later than 24 hours. A detailed assessment follows within 72 hours, covering how bad it is and what evidence exists. Other incidents get 72 hours. A final report is due within one month of the incident being logged. Reports go to the National Cyber Security Centre. Its own wording: 'Apie dideli kiberneti incidenta organizacijos privalo pranesti nedelsiant, bet ne veliau kaip per 24 val.' DEADLINE 3 - financial firms. Regulation (EU) 2022/2554 on digital operational resilience has applied since 17 January 2025. Major technology incidents must be reported to the Bank of Lithuania on its own timetable. The Bank of Lithuania publishes guidance on this. The overlap is where people get caught. A ransomware attack on a Lithuanian hospital or utility sets off deadline 1 and deadline 2. The cyber deadline comes first. The two reports go to different bodies and must contain different things.

1. AGE 14, NOT 16. Article 6 of the national law says a child over 14 can agree for themselves when online services are offered directly to them. Lithuania picked the lowest age the Regulation allows. A single European age gate set at 16 is stricter than Lithuania needs. One set at 13 to match the United States is against the law here. 2. THE PERSONAL IDENTIFICATION NUMBER IS SPECIAL. Article 3 of the national law covers the personal identification number ('asmens kodas'). You may use it where any Article 6(1) condition applies. But you may never publish it, and you may never use it for direct marketing. Both bans are absolute. Consent does not unlock them. Publishing a supplier list, a court list or a shareholder register that includes personal codes breaks the rule on its face. 3. PUBLIC BODIES ARE CHEAP TO BREACH. Article 33 caps fines on a public body for breaches of Article 83(4)(a) to (c) of the Regulation. The cap is 0.5 percent of its current-year budget, and never more than 30,000 euros. For the more serious class the cap is 1 percent, and never more than 60,000 euros. This is why Lithuania's fine numbers look tiny next to its complaint numbers. 4. TWO REGULATORS. Article 7 names the State Data Protection Inspectorate. It separately names the Inspector of Journalist Ethics for journalism, academic work, art and literature. Filing with the wrong one costs you time. 5. THE GOVERNMENT DATA CENTRE RULE KILLS DEALS. If a Lithuanian public body's system is graded critical or important, it must sit in a state data centre. If it is graded medium or low and you host it, a copy must still be kept in a state data centre. The Minister's order sets technical and organisational rules for data centres in European Union, European Economic Area and NATO states. A large cloud region outside those countries is not an option. 6. THE TWO-YEAR CLOCK CUTS BOTH WAYS. Article 32(3): no fine may be imposed more than two years after the breach. That is good news if you report late. It is bad news if your complaint is about something old.

DATED AND COMING: - 12 January 2027: the European Data Act makes all cloud switching charges and data export fees zero. It applies in Lithuania directly. - From about 17 April 2026, then 17 April 2027: under the Lithuanian Cybersecurity Law, a company has 12 months from registration to meet the general cyber security rules and 24 months to meet the technical ones. The National Cyber Security Centre had to identify and register companies by 17 April 2025. So the technical rules land on the first group around 17 April 2027. That is why the law counts as partly in force rather than fully in force. - 1 January 2026: changes to the Law on the Management of State Information Resources took effect. They came in Law No. XV-565, adopted 20 November 2025 and published 28 November 2025. They touch 17 articles, including Article 45 on where state systems are held. The detailed rules under it are still settling. POWERS THE GOVERNMENT ALREADY HAS. These can change the answer with no warning: - The Government can set different rules for one named institution's state systems by resolution. The power sits in Articles 45(3) and 45(4) of the Law on the Management of State Information Resources. The cabinet decides who is in and who is out. - The list of state data centres is itself a Government resolution (No. 349). Adding or removing a data centre changes who may legally host state systems overnight. - A Minister of the Economy and Innovation order (No. 4-249) sets the technical and organisational rules. They cover data centres in European Union, European Economic Area and NATO states. A minister can tighten them with a signature. - The importance grade of any state system can be changed. Moving a system from 'medium' to 'important' puts it behind the strict rules, with no new law needed. EUROPEAN ITEMS TO WATCH. None of these are settled: - The European Union-United States Data Privacy Framework is still valid. The Latombe appeal is waiting at the Court of Justice. On 31 July 2026 the European Data Protection Board formally asked the Commission to check whether the decision still holds. - The Digital Omnibus proposal of 19 November 2025 has not been adopted and has no legal effect. Among other things, it would extend breach reporting from 72 to 96 hours. - The European cloud certification scheme has still not been adopted. So national schemes and national buying rules like Lithuania's keep applying. - Artificial Intelligence Act transparency duties started on 2 August 2026.