Latvia

Territorial scope is set by Article 3 of Regulation (EU) 2016/679 (the General Data Protection Regulation), not by Latvian law. The Personal Data Processing Law (Fizisko personu datu apstrādes likums, adopted 21 June 2018, in force 5 July 2018) opens by saying its purpose is to create the national-level building blocks of the data protection system and to designate the supervisory authority; it does not narrow or widen GDPR's reach. The Article 27 representative duty is the GDPR's, not a Latvian add-on. Separately, several Latvian sectoral statutes reach any company registered in Latvia, including a branch of a foreign company and a permanent establishment of a non-resident: the Accounting Law names those entities expressly in Section 3, so a foreign group's Latvian branch is inside the accounting storage rule even if the group's systems sit in New York.

Sector by sector, checked 18 August 2026. ALL BUSINESSES — accounting records: hard wall. Accounting Law Section 27(1) says paper accounting documents must be stored in the territory of the Republic of Latvia, and electronic accounting documents must be stored in Latvia or another European Union member state. The section expressly ties itself to Regulation (EU) 2018/1807 on the free flow of non-personal data, so it is drafted as an EU-internal freedom and an external prohibition. This is the single most commonly missed Latvian storage rule: a Latvian company or a Latvian branch of a foreign group cannot lawfully keep its ledgers only on a United States or United Kingdom cloud. Rating: data must stay in the country at the European Union boundary. TELECOMS: Electronic Communications Law (14 July 2022) Section 99(4) requires an electronic communications merchant to retain the data listed in Sections 100 and 101 for 18 months. There is no express requirement to hold it in Latvia, but Section 99(6) bans the operator from telling anyone that data was requested or handed over, and Section 99(7) limits processing to authorised staff. Practical effect: an offshore support desk cannot be given routine access. Rating: data can leave with the right paperwork with a heavy retention floor. BANKING: Credit Institutions Law Section 10.1(7)-(10). Before receiving a significant outsourced service a bank must file a reasoned written application with Latvijas Banka, wait 30 working days, and may proceed only if no prohibition arrives. Latvijas Banka may prohibit the arrangement if it would restrict the regulator's ability to perform its statutory functions, and may inspect the supplier at the supplier's own premises. That is a location veto in all but name. Rating: data can leave with the right paperwork, with government permission as the gate. INSURANCE, INVESTMENT FIRMS, PAYMENTS, CRYPTO: same supervisor, Latvijas Banka, which absorbed the Financial and Capital Market Commission. No separate Latvian localisation rule found for these, checked 18 August 2026. Regulation (EU) 2022/2554 (the Digital Operational Resilience Act) has applied since 17 January 2025 and governs their information and communication technology outsourcing; it requires the contract to name the countries where data will be processed but imposes no localisation. STATE AND CRITICAL COMPUTER SYSTEMS: Cabinet Regulation No. 397 of 25 June 2025 on minimum cyber security requirements, in force 2 July 2025, points 94 and 101, restricts who may supply and manufacture Class A information system resources for owners of critical information and communication technology infrastructure — the supplier, its board, its shareholders and its beneficial owner must be from a NATO, European Union, European Free Trade Association or NATO Indo-Pacific partner country. Point 129.2 goes further and requires a compliance auditor to process audit information solely within NATO, European Union and European Free Trade Association territory. Rating: data must stay in the country at the allied-country boundary. HEALTH: no localisation rule found, checked 18 August 2026. Medical records are, however, required to be accumulated electronically in the single national health-sector information system, which the state runs in Latvia, and paper-record retention runs from one year to forty years depending on the document. MAPPING AND LOCATION DATA: no export restriction found, checked 18 August 2026. The Geospatial Information Law of 2009 is an implementation of the European INSPIRE directive and is about sharing and licensing, not about keeping data in the country. EDUCATION, GAMING, DEFENCE PROCUREMENT, GOVERNMENT CLOUD as such: no separate statutory localisation rule found beyond the cyber security supplier rules above, checked 18 August 2026. The State Information Systems Law contains no storage-location requirement.

The transfer regime is entirely the European Union's, applied unchanged in Latvia. Chapter V of Regulation (EU) 2016/679 sets it out. The approved-destination list, verified against the European Commission's own page on 18 August 2026, contains Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada (commercial bodies only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for entities self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. None has been withdrawn or suspended. The 2021 standard contractual clauses in Decision (EU) 2021/914 remain the operative set and are unamended; the promised new clauses for importers already directly caught by the regulation are still not adopted as of 18 August 2026. Binding corporate rules remain available. The narrow one-off exceptions in Article 49 are not for routine or bulk flows. A transfer impact assessment is still expected. The European Data Protection Board's Guidelines 02/2024, final in June 2025, confirm that an order from a non-European authority is not by itself a lawful basis to hand data over. The most time-sensitive item is the EU-US Data Privacy Framework. It is still in force and legally valid on 18 August 2026, but it is under pressure: the Latombe challenge was dismissed by the General Court on 3 September 2025 and appealed to the Court of Justice on 31 October 2025, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent United States developments affect the decision's validity. The Commission has not suspended or revoked it. Do not build a single-mechanism architecture on it. Regulation (EU) 2018/1807 forbids member states from imposing localisation on non-personal data except on public-security grounds — which is why the Accounting Law rule is drafted as an EU-internal freedom rather than a Latvia-only rule.

Datu valsts inspekcija (the State Data Inspectorate) was created on 1 January 2001 and is a direct administration institution under Cabinet supervision, independent in its work, with a director appointed by the Cabinet for five years. Its 2025 public report records 1,034 data subject complaints, 96 controller breach notifications, 194 other submissions, 1,396 personal data processing checks, corrective measures in 62 cases, fines from 150 euros to 300,000 euros totalling 326,400 euros, and an average of 32 officials and employees. Its first-half 2026 update records 832 complaints, 36 violations found, corrective measures in 9 cases, 73 own-initiative checks, 898 telephone consultations and 96 opinions on draft legislation. On the evidence this is an active regulator of moderate size, not an aggressive one: it publishes far more guidance than it does penalties. Other enforcers, all operational: Latvijas Banka (the central bank), which absorbed the Financial and Capital Market Commission and now supervises banks, insurers, investment firms, payment and electronic money institutions and crypto-asset service providers, and issues licensing and supervisory decisions; the National Cyber Security Centre (Nacionālais kiberdrošības centrs), which started work on 1 September 2024 under the Ministry of Defence, working with CERT.LV at the University of Latvia's Institute of Mathematics and Computer Science; and the Constitution Protection Bureau (Satversmes aizsardzības birojs), which supervises owners of critical information and communication technology infrastructure and can impose its own penalties of up to 10 million euros. One structural quirk: for public bodies, Section 38 of the Personal Data Processing Law routes unlawful data handling into the administrative-offence system with a penalty aimed at the official personally, capped at 200 fine units, which at five euros a unit is 1,000 euros (about $1,090). That is a very different lever from a corporate fine.

FLOORS. Accounting Law Section 28: annual reports until the company is reorganised or wound up; inventory lists, accounting registers and accounting organisation documents 10 years; payroll supporting documents dated before 1 January 1999, 75 years; payroll documents dated 1 January 1999 or later, 10 years (holiday pay records 10 years from the end of the employment relationship); all other supporting documents at least five years and for as long as needed to trace the transaction. Electronic Communications Law Section 99(4): 18 months for retained traffic, location and subscriber-identifying data, after which Section 99(8) requires deletion unless an authority asked for the data before the deadline or the operator still needs it for billing, claims or interconnection. Cabinet Regulation No. 265 on medical documentation: retention by document type of 1, 3, 5, 10, 15, 25 and 40 years after the last entry, and 10 years for radiology images, with destruction then governed by the Archives Law. CEILING. Personal Data Processing Law Section 37(2): where a controller is under a duty to keep system audit trails, they may be kept no longer than one year after the entry was made, unless other law or the nature of the processing says otherwise. Section 37(3) then lets the controller refuse a subject access request for information it no longer holds because the audit trail has expired. This is the mirror image of the usual problem: most organisations worry about keeping logs long enough, and Latvia caps them. CONFLICT RESOLUTION. Latvia resolves clashes by specificity, not by a general rule: the audit-trail ceiling itself carries an express 'unless other laws or the nature of processing provide otherwise' escape, so a longer sector-specific retention duty wins. The accounting floor has no such escape and is the harder constraint.

Clock one, privacy: Article 33 of Regulation (EU) 2016/679, 72 hours to the State Data Inspectorate, and Article 34 notification to individuals without undue delay where the risk is high. The Inspectorate received 96 breach notifications in 2025, of which 83 were confidentiality breaches. Clock two, cyber security: National Cyber Security Law Section 33. On a significant cyber incident the subject must, without delay and no later than 24 hours, submit an electronic early warning to the competent cyber incident response body; then, without delay and no later than 72 hours, an initial report — but a trust service provider must file the initial report within 24 hours. On any cyber incident, an owner of critical information and communication technology infrastructure must also inform the competent state security institution immediately. The subject must also inform its own service recipients without delay where a significant incident or threat affects them. Clock three, finance: Regulation (EU) 2022/2554 (the Digital Operational Resilience Act) has applied to Latvian financial entities since 17 January 2025 and adds its own major incident reporting timetable to Latvijas Banka. The overlap is the failure point. A ransomware attack on a Latvian hospital or bank starts all three clocks at once, with the 24-hour cyber early warning biting well before the 72-hour privacy report is ready.

1. AGE 13. Section 33 of the Personal Data Processing Law sets the information-society-services consent age at 13, the lowest the European regulation permits. A product built to a 16-year threshold is not wrong in Latvia, but a product built to assume 16 across Europe will over-collect parental consent, and a product built to a United States 13-year rule happens to fit. 2. CRIMINAL LIABILITY. Section 145 of the Criminal Law, in its version in force since 4 July 2024, punishes unlawful acts with personal data committed out of revenge, greed or blackmail with up to one year's deprivation of liberty; up to two years where substantial harm is caused; up to four years where committed by a public official or a responsible employee of a company or organisation; and up to five years for coercing or deceiving a controller, a processor or a data subject in order to carry out unlawful acts. This attaches to individuals and it is prosecution, not an administrative penalty. 3. ACCOUNTING STORAGE AND LANGUAGE. Accounting Law Section 27(1) is the geographic wall described above. Section 9(1) adds that entries in accounting registers must be made in Latvian, with a second language permitted alongside. A group standardising on an English-only United States-hosted resource planning system fails both tests at once. 4. THE ONE-YEAR LOG CEILING. Section 37(2) of the Personal Data Processing Law caps audit trails at one year where a retention duty applies. Most global security teams keep authentication and access logs for two years or more by default. 5. IN-COUNTRY PEOPLE AND SUPPLIER NATIONALITY. Cabinet Regulation No. 397 of 25 June 2025 requires an essential or important service provider to appoint a named cyber security manager who must be a citizen of a NATO, European Union or European Free Trade Association state, with defined qualifications, and for critical infrastructure owners the Constitution Protection Bureau must find no security risk in that person. For Class A information systems the supplier, its board, its shareholders and its beneficial owner must all be from an allied country. This is an ownership and nationality screen, not a data rule, and standard vendor due diligence will not catch it. 6. A SIXTH, QUIETER ONE. Latvia runs an official register of qualified data protection specialists at the Inspectorate, with a state qualification examination. Appointing a listed specialist is optional, not mandatory, but tenders and public-sector counterparties increasingly ask for one.

DATED. 12 January 2027 — Regulation (EU) 2023/2854 (the Data Act), which has applied since 12 September 2025, reaches its hard deadline: all cloud switching charges and data egress fees must be zero. Chapter VII of the same regulation restricts non-European government access to non-personal data held in the European Union. 14 October 2026 — the State Data Inspectorate's next data protection specialist qualification examination, announced 7 August 2026. 18 June 2026 — amendments to the National Cyber Security Law already took effect. They move designation decisions from the Digital Security Supervisory Committee to the National Cyber Security Centre, let the Centre remove an entity from the essential and important services list, delete the early warning sensors article, and widen the class of nationally significant private bodies. Anyone who mapped their obligations before June 2026 should re-check. DORMANT SWITCHES — these matter more than pending bills. 1. Section 30 of the National Cyber Security Law empowers the Cabinet to set data centre security requirements, rules on where information systems must be placed in data centres, and rules on security operations centres. We could not find those regulations issued. Until they are, hosting placement for essential and important service providers is governed only by the general minimum requirements. When they land, they will be a placement rule made by the Cabinet with no primary legislation needed. 2. The European Commission's adequacy decision for the EU-US Data Privacy Framework is under appeal at the Court of Justice, and on 31 July 2026 the European Data Protection Board asked the Commission to review its validity. If it falls, every Latvian company relying on it for United States transfers needs a replacement mechanism overnight. 3. The European Union cloud certification scheme is still not adopted, deadlocked over sovereignty since 2020, so national and sectoral rules like Latvia's allied-supplier screen continue to govern. The proposed Cloud and AI Development Act of 3 June 2026 and the Digital Omnibus of 19 November 2025 are proposals only and have no legal effect.