Lithuania

Territorial reach comes from Article 3 of the General Data Protection Regulation, which applies directly in Lithuania. The Lithuanian Law on the Legal Protection of Personal Data (Asmens duomenu teisines apsaugos istatymas, Law No. I-1374 as restated in 2018) adds national detail on top; its Article 1(4) sets out when the Lithuanian law itself applies, covering controllers established in Lithuania, controllers outside the Union that have a representative in Lithuania, and processing of data about people in the Union. The representative duty is Article 27 of the Regulation. Separately, the Lithuanian Cybersecurity Law (Kibernetinio saugumo istatymas) catches entities by sector and size rather than by nationality; the National Cyber Security Centre identifies and registers who is in scope.

Sector by sector, checked 18 August 2026. GOVERNMENT AND PUBLIC SECTOR — the real wall. The Ministry of the Economy and Innovation states that resources graded 'ypatingos svarbos' (critical) and 'svarbus' (important) must be held in state data centres, except where the Government by resolution sets a different regime for a named institution under Articles 45(3) and 45(4) of the Law on the Management of State Information Resources. Resources graded 'vidutines svarbos' (medium) and 'mazos svarbos' (low) may be held in state, foreign or private data centres, but if they are held in a foreign or private data centre their copies must be kept in state data centres. A Government resolution (No. 349) sets the list of state data centres; a Minister of the Economy and Innovation order (No. 4-249) sets the technical and organisational requirements for data centres in European Union, European Economic Area and NATO states. Rating: closed for the top two grades, mirror for the bottom two. DIGITAL EMBASSY — the reverse of localisation. Amendments to the same law in May 2022 and a Government decree of 12 July 2022 made diversification of state data mandatory: some data sits in public data centres, 'but copies will be compulsorily stored outside the territory of Lithuania'. HEALTH — no separate location rule found. Almost all Lithuanian health records pass through the state e-health system (ESPBI IS), controlled by the Ministry of Health with the state enterprise Centre of Registers as principal processor. That is a state information resource, so the government wall above is what actually governs it. Rating: conditional, with the government wall behind it. BANKING, PAYMENTS, INSURANCE, SECURITIES — no localisation rule found. We searched the Bank of Lithuania's own catalogue of positions and guidelines (239 documents) and found digital operational resilience incident reporting and outsourcing-adjacent risk guidance, but no instrument requiring data to be stored in Lithuania. European rules on digital operational resilience for financial entities require you to disclose where processing happens, not to keep it local. Rating: conditional. ONLINE GAMBLING — no server-location rule found in the regulator's own technical requirements for remote gambling devices. Those requirements do impose 90-day minimum log retention. Rating: open, medium confidence. TELECOMS — not verified. The Law on Electronic Communications has a consolidated version dated 1 July 2026, but we could not read the retention articles from an official source in this run. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE — not checked in this run. See the unconfirmed list. Across all of this sits Regulation (EU) 2018/1807, which forbids a member state from imposing localisation on non-personal data except on genuine public-security grounds. Lithuania's state data centre rule is a public-sector procurement and security rule, which is the space that Regulation leaves open.

Model: allowlist. The list is populated — Andorra, Argentina, Brazil (mutual, 26 January 2026), Canada (commercial bodies only), Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for entities self-certified under the Data Privacy Framework, and the European Patent Organisation. No adequacy decision has been withdrawn or suspended as at 18 August 2026. Mechanisms: the 2021 Standard Contractual Clauses (Decision (EU) 2021/914) remain the operative set and are unamended. The promised new clauses for importers already directly subject to the Regulation under Article 3(2) are still not adopted. Binding Corporate Rules remain available. Article 49 derogations are narrow and not for systematic or large-scale transfers. A transfer impact assessment is still expected following Schrems II. EDPB Guidelines 02/2024 confirm that a third-country authority's order is not by itself a lawful basis to disclose. The Lithuanian addition is Article 15 of the Law on the Legal Protection of Personal Data. It applies only to Article 46(3) of the Regulation — that is, ad hoc contractual clauses agreed between the parties, and administrative arrangements between public bodies. The State Data Protection Inspectorate must grant permission or give a reasoned written refusal within 20 working days of receiving a complete file, extendable once by up to 10 working days. Using the standard published clauses needs no permission. Most time-sensitive item: the European Union–United States Data Privacy Framework is still in force and legally valid on 18 August 2026, but is under pressure. The General Court dismissed the Latombe challenge on 3 September 2025 and an appeal to the Court of Justice was lodged on 31 October 2025 and is pending. On 31 July 2026 the European Data Protection Board wrote formally to the Commissioner asking the Commission to examine whether United States institutional changes affect the decision's validity. The Commission has not suspended or revoked it. Practical advice: usable today, never as a single-mechanism architecture.

Is it operational? Yes, on its own evidence. From the Inspectorate's 2025 annual review, published 1 July 2026: 2,081 complaints received (1,408 in 2024); 16 scheduled and 10 unscheduled inspections; 132 monitoring actions; 223 personal data breach notifications received, covering 1,249,409 people in Lithuania, of which only 63 percent arrived within 72 hours; 34 cross-border complaints handled as lead authority and 28 decisions coordinated internationally; 54 established posts, up from 46; a budget of 2,198,000 euros (about 2.4 million US dollars). Its published decisions register for 2026 lists 122 decisions between 3 January and 31 July 2026, split between 'violations found' and 'no violations found', with Vinted UAB appearing seven times. Rating: active, not aggressive. The Inspectorate issues a steady flow of binding decisions and orders, but very few fines and small ones — five fines in 2025 ranging from 3,529 euros to 9,000 euros. Part of the reason is structural: Article 33 of the national law caps fines on Lithuanian public institutions at 0.5 percent of the current year's budget and never more than 30,000 euros for one class of breach, or 1 percent and never more than 60,000 euros for another. Private companies remain exposed to the full European ceilings. Second regulator: Article 7 of the national law names the Inspector of Journalist Ethics as the supervisory authority for personal data processed for journalistic, academic, artistic and literary purposes. A complaint against a news organisation goes there, not to the Inspectorate. Cyber regulator: the National Cyber Security Centre, under the Ministry of National Defence, is the competent authority under the Cybersecurity Law. It can impose fines of up to 10 million euros or 2 percent of worldwide annual turnover, whichever is lower. Sectoral regulators: the Bank of Lithuania supervises financial firms, the Communications Regulatory Authority supervises telecoms, and the Gaming Control Authority supervises gambling. Appeals against Inspectorate decisions go to the administrative courts — Vilnius Regional Administrative Court first, then the Supreme Administrative Court.

CEILING. Article 5(1)(e) of the General Data Protection Regulation — storage limitation. Data must be kept in a form allowing identification no longer than necessary for the purposes. There is no separate national ceiling in the Lithuanian law. FLOORS verified in this run: - Health: the state e-health system (ESPBI IS) keeps patient data for the patient's lifetime plus three years, then transfers it to archive for 75 years, after which it is deleted or passed to the state archives. The Chief Archivist sets the archiving procedure. - Online gambling: remote gambling devices must store authenticity check results, authorised change logs and gaming records for at least 90 calendar days, and video records of live table games for 90 days. - General business documents: the Office of the Chief Archivist publishes a general retention index plus 19 sector-specific indexes (courts, health care, customs, police, notaries and others). Where a sector index sets a different period from the general index for the same administrative function, the sector index is the one to check. CONFLICT RULE. Lithuania does not have a special tie-break provision. In practice the legal obligation to retain gives you the lawful basis under Article 6(1)(c) of the Regulation, so you keep the data for the statutory floor, minimise access to it, and delete at the end of the floor rather than at the end of the business need. ONE MORE CLOCK, in your favour. Article 32(3) of the Lithuanian law says a decision imposing an administrative fine may only be adopted if no more than two years have passed since the infringement was carried out. Not verified in this run: the widely repeated claim that Lithuanian accounting records must be kept for ten years. See the unconfirmed list.

Clock 1 — personal data breach. Article 33 of the General Data Protection Regulation: notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware. Article 34: tell the affected people without undue delay where the risk to them is high. In 2025 the Inspectorate received 223 breach notifications affecting 1,249,409 people in Lithuania; 29 percent were caused by cyber incidents, 58 percent by human error; only 63 percent were reported within 72 hours. Clock 2 — cyber incident. Under the Lithuanian Cybersecurity Law, in force since 18 October 2024 and implementing the European network and information security directive known as NIS 2: a major cyber incident must be reported immediately and no later than 24 hours; a detailed assessment including severity and evidence within 72 hours; other incidents within 72 hours; a final report within one month of the incident being registered. The National Cyber Security Centre is the recipient. Its stated wording: 'Apie dideli kiberneti incidenta organizacijos privalo pranesti nedelsiant, bet ne veliau kaip per 24 val.' Clock 3 — financial entities. Regulation (EU) 2022/2554 on digital operational resilience has applied since 17 January 2025 and requires major information and communication technology incidents to be reported to the Bank of Lithuania on its own timetable. The Bank of Lithuania publishes guidance on digital resilience incident reporting. The overlap is the failure mode. A ransomware attack on a Lithuanian hospital or utility triggers all of clock 1 and clock 2, with the earlier deadline being the cyber one, and the two reports go to different institutions with different content requirements.

1. AGE 14, NOT 16. Article 6 of the national law: 'When information society services are directly offered to a child, the processing of the child's personal data is legal if consent is given by a child older than 14 years of age.' Lithuania took the lowest age the Regulation allows. A pan-European age gate set at 16 is over-restrictive in Lithuania; one set at 13 for United States parity is illegal here. 2. THE PERSONAL IDENTIFICATION NUMBER IS SPECIAL. Article 3 of the national law: the personal identification number ('asmens kodas') may be processed where any Article 6(1) condition applies, BUT 'it is prohibited to publish the personal identification number' and 'it is prohibited to process personal identification number for purposes of direct marketing'. These are flat prohibitions with no consent override. Publishing a supplier list, a court list or a shareholder register that includes personal codes is a breach on its face. 3. PUBLIC BODIES ARE CHEAP TO BREACH. Article 33 caps fines on a public institution at 0.5 percent of its current-year budget and never more than 30,000 euros for infringements of Article 83(4)(a) to (c) of the Regulation, and at 1 percent and never more than 60,000 euros for the more serious class. This is why Lithuania's fine numbers look tiny next to its complaint numbers. 4. TWO REGULATORS. Article 7 names the State Data Protection Inspectorate and, separately, the Inspector of Journalist Ethics for journalistic, academic, artistic and literary processing. Filing with the wrong one loses you time. 5. THE GOVERNMENT DATA CENTRE WALL IS A PROCUREMENT KILLER. If a Lithuanian public body's system is graded critical or important, it must sit in a state data centre. If it is graded medium or low and you host it, a copy still has to be kept in a state data centre, and the Minister's order sets technical and organisational requirements for data centres in European Union, European Economic Area and NATO states. A hyperscale region outside that footprint is not a candidate. 6. THE TWO-YEAR CLOCK CUTS BOTH WAYS. Article 32(3): no administrative fine may be imposed more than two years after the infringement was carried out. Good news for a company that self-reports late; bad news for a complainant with an old grievance.

DATED AND COMING: - 12 January 2027: the European Data Act requires all cloud switching charges and data egress fees to be zero. Applies in Lithuania directly. - Roughly 17 April 2026 onwards, and 17 April 2027: under the Lithuanian Cybersecurity Law, an entity has 12 months from registration to meet the general cybersecurity requirements and 24 months to meet the technical requirements. The National Cyber Security Centre had to identify and register entities by 17 April 2025, so the technical requirements bite for the first cohort around 17 April 2027. This is why the law is recorded as partly in force, not fully in force. - 1 January 2026: amendments to the Law on the Management of State Information Resources (Law No. XV-565, adopted 20 November 2025, published 28 November 2025) took effect, touching 17 articles including Article 45 on where resources are held. Secondary rules under it are still settling. DORMANT SWITCHES — powers already held that can change the picture without notice: - The Government can, by resolution, set a different legal regime for the state information resources of a named institution under Articles 45(3) and 45(4) of the Law on the Management of State Information Resources. That is a per-institution carve-out or carve-in decided by cabinet. - The list of state data centres is itself a Government resolution (No. 349). Adding or removing a data centre changes who can legally host state systems, overnight. - The technical and organisational requirements for data centres in European Union, European Economic Area and NATO states are a Minister of the Economy and Innovation order (No. 4-249). A minister can tighten them by signature. - The importance grading of any state information system can be revised. Moving a system from 'medium' to 'important' moves it behind the wall with no legislative step at all. EUROPEAN ITEMS TO WATCH, none of them settled: - The European Union–United States Data Privacy Framework remains valid, but the Latombe appeal is pending before the Court of Justice and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine the decision's validity. - The Digital Omnibus proposal of 19 November 2025 is not adopted and has no legal effect. It would, among other things, extend breach notification from 72 to 96 hours. - The European cloud certification scheme is still not adopted, so national schemes and national procurement rules like Lithuania's continue to govern. - Artificial Intelligence Act transparency obligations started on 2 August 2026.