Latvia

Who is covered is set by Article 3 of Regulation (EU) 2016/679, the General Data Protection Regulation. It is not set by Latvian law. Latvia's Personal Data Processing Law (Fizisko personu datu apstrādes likums) was adopted on 21 June 2018 and came into force on 5 July 2018. It says its job is to build the national parts of the data protection system and to name the regulator. It does not widen or narrow the European rules. The duty to name a representative in Article 27 is European, not a Latvian addition. Some Latvian industry laws work differently. They reach any company registered in Latvia, including a branch of a foreign company and a permanent base of a non-resident. The Accounting Law names those in Section 3. So a foreign group's Latvian branch is caught by the accounting storage rule, even if the group's systems sit in New York.

Industry by industry, checked 18 August 2026. ALL BUSINESSES - accounting records. This is a firm wall. Accounting Law Section 27(1) says paper accounting documents must be stored in the Republic of Latvia. Electronic accounting documents must be stored in Latvia or another European Union member state. The section ties itself to Regulation (EU) 2018/1807 on the free flow of non-personal data. So it is written as freedom inside the European Union and a ban outside it. This is the Latvian storage rule people miss most often. A Latvian company, or the Latvian branch of a foreign group, cannot lawfully keep its ledgers only on a United States or United Kingdom cloud. Closed at the European Union border. TELECOMS. The keep-it duty is in the Electronic Communications Law of 14 July 2022, Section 99(4). A telecoms company must keep the data listed in Sections 100 and 101 for 18 months. There is no express rule that the data sits in Latvia. But Section 99(6) bans the operator from telling anyone that data was requested or handed over. Section 99(7) limits who can handle it to authorised staff. So an offshore support desk cannot be given routine access. Paperwork works here, with a long keep-it period. BANKING. Credit Institutions Law Section 10.1(7)-(10). Before taking a significant outsourced service, a bank must file a written application with reasons to Latvijas Banka. It must wait 30 working days. It may go ahead only if no ban arrives. Latvijas Banka may ban the arrangement if it would limit the regulator's ability to do its job. It may also inspect the supplier at the supplier's own premises. That is a location veto in all but name. Government permission is the gate. INSURANCE, INVESTMENT FIRMS, PAYMENTS, CRYPTO. Same supervisor, Latvijas Banka, which took over the Financial and Capital Market Commission. We found no separate Latvian rule that data must stay in the country for these, checked 18 August 2026. Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied since 17 January 2025 and covers their technology outsourcing. It makes the contract name the countries where data will be handled. It does not make the data stay at home. STATE AND CRITICAL COMPUTER SYSTEMS. Cabinet Regulation No. 397 of 25 June 2025 sets minimum cyber security requirements and came into force on 2 July 2025. Points 94 and 101 limit who may supply and make Class A information system resources for owners of critical technology infrastructure. The supplier, its board, its shareholders and its true owner must be from a NATO, European Union, European Free Trade Association or NATO Indo-Pacific partner country. Point 129.2 goes further. An auditor checking compliance may handle audit information only inside NATO, European Union and European Free Trade Association territory. Closed at the allied-country border. HEALTH. We found no rule that health data must stay in Latvia, checked 18 August 2026. Medical records must be gathered electronically in the single national health information system, which the state runs in Latvia. Paper records must be kept for between one year and forty years, depending on the document. MAPPING AND LOCATION DATA. We found no export restriction, checked 18 August 2026. The Geospatial Information Law of 2009 puts the European INSPIRE directive into Latvian law. It is about sharing and licensing, not about keeping data in the country. EDUCATION, GAMING, DEFENCE BUYING, GOVERNMENT CLOUD. We found no separate storage-location rule in statute beyond the cyber security supplier rules above, checked 18 August 2026. The State Information Systems Law contains no storage-location requirement.

The transfer rules are entirely European and apply unchanged in Latvia. Chapter V of Regulation (EU) 2016/679 sets them out. We checked the approved-destination list against the European Commission's own page on 18 August 2026. It contains Andorra, Argentina, Brazil (new, 26 January 2026, both ways), Canada (commercial bodies only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the European Patent Organisation, and the United States for companies signed up to the European Union-United States Data Privacy Framework. None has been withdrawn or suspended. The 2021 standard contract clauses in Decision (EU) 2021/914 are still the current set and have not been changed. New clauses were promised for companies abroad that the regulation already catches directly. They are still not adopted as of 18 August 2026. Company-wide rules approved by a regulator remain available. The narrow one-off exceptions in Article 49 are not for routine or bulk flows. You are still expected to write down why the destination country is safe. European Data Protection Board Guidelines 02/2024 were made final in June 2025. They confirm that an order from a non-European authority is not on its own a legal reason to hand data over. The most time-sensitive item is the European Union-United States Data Privacy Framework. It is still in force and legally valid on 18 August 2026, but it is under pressure. The General Court threw out the Latombe challenge on 3 September 2025. It was appealed to the Court of Justice on 31 October 2025. On 31 July 2026 the European Data Protection Board formally asked the Commission to look at whether recent United States developments affect the decision. The Commission has not suspended or cancelled it. Do not make it your only route. Regulation (EU) 2018/1807 stops member states forcing non-personal data to stay on their own soil, except on public security grounds. That is why the Accounting Law rule is written as freedom inside the European Union rather than as a Latvia-only rule.

Datu valsts inspekcija, the State Data Inspectorate, was created on 1 January 2001. It is a government body under Cabinet supervision but independent in its work. The Cabinet appoints its director for five years. Its 2025 public report records 1,034 complaints from members of the public, 96 breach reports from companies, 194 other submissions, and 1,396 checks on how data is used. It applied corrective measures in 62 cases. Fines ran from 150 euros to 300,000 euros and totalled 326,400 euros. It had 32 officials and employees on average. Its first-half 2026 update records 832 complaints, 36 violations found, corrective measures in 9 cases, 73 checks on its own initiative, 898 telephone consultations and 96 opinions on draft laws. On this evidence it is an active regulator of moderate size, not an aggressive one. It publishes far more guidance than penalties. Other enforcers, all working. Latvijas Banka, the central bank, took over the Financial and Capital Market Commission. It now supervises banks, insurers, investment firms, payment and electronic money institutions and crypto-asset service providers, and issues licensing and supervisory decisions. The National Cyber Security Centre (Nacionālais kiberdrošības centrs) started work on 1 September 2024 under the Ministry of Defence. It works with CERT.LV at the University of Latvia's Institute of Mathematics and Computer Science. The Constitution Protection Bureau (Satversmes aizsardzības birojs) supervises owners of critical technology infrastructure and can impose its own penalties of up to 10 million euros. One odd feature. For public bodies, Section 38 of the Personal Data Processing Law sends unlawful data handling into the administrative-offence system. The penalty targets the official personally and is capped at 200 fine units. At five euros a unit that is 1,000 euros (about 1,090 US dollars). That is a very different lever from a company fine.

MINIMUMS. Accounting Law Section 28: annual reports until the company is reorganised or wound up; inventory lists, accounting registers and accounting organisation documents 10 years; payroll supporting documents dated before 1 January 1999, 75 years; payroll documents dated 1 January 1999 or later, 10 years, with holiday pay records 10 years from the end of the job; all other supporting documents at least five years, and for as long as you need to trace the transaction. Electronic Communications Law Section 99(4): 18 months for stored traffic, location and subscriber-identifying data. Section 99(8) then requires deletion. The exceptions are where an authority asked for the data before the deadline, or the operator still needs it for billing, claims or interconnection. Cabinet Regulation No. 265 on medical documentation: keep-it periods by document type of 1, 3, 5, 10, 15, 25 and 40 years after the last entry, and 10 years for radiology images. Destruction after that is governed by the Archives Law. MAXIMUM. Personal Data Processing Law Section 37(2). Where you have a duty to keep system audit trails, you may keep them no longer than one year after the entry was made. Other laws, or the nature of the work, can change that. Section 37(3) then lets you refuse a person's request for information you no longer hold because the audit trail has expired. This is the reverse of the usual problem. Most organisations worry about keeping logs long enough. Latvia caps them. WHICH ONE WINS. Latvia settles clashes by which rule is more specific, not by a general rule. The one-year audit-trail cap says expressly that other laws, or the nature of the work, can override it. So a longer industry keep-it duty wins. The accounting minimum has no such escape, and it is the harder limit.

DEADLINE ONE, privacy. Article 33 of Regulation (EU) 2016/679: 72 hours to the State Data Inspectorate. Article 34: tell the people affected without undue delay where the risk is high. The Inspectorate received 96 breach reports in 2025, of which 83 involved data being seen by the wrong people. DEADLINE TWO, cyber security. National Cyber Security Law Section 33. On a significant cyber incident you must send an electronic early warning to the cyber incident response body. It is due without delay and no later than 24 hours. An initial report follows without delay and no later than 72 hours. A trust service provider must file that initial report within 24 hours. On any cyber incident, an owner of critical technology infrastructure must also inform the state security body immediately. You must also tell your own customers without delay where a significant incident or threat affects them. DEADLINE THREE, finance. Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied to Latvian financial companies since 17 January 2025. It adds its own timetable for reporting major incidents to Latvijas Banka. The overlap is where things go wrong. A ransomware attack on a Latvian hospital or bank starts all three deadlines at once. The 24-hour cyber early warning lands well before the 72-hour privacy report is ready.

1. AGE 13. Section 33 of the Personal Data Processing Law sets the age at which a child can agree to online services at 13. That is the lowest the European regulation allows. A product built for 16 is not wrong in Latvia. But a product that assumes 16 across Europe will collect parental consent it does not need. A product built to the United States rule of 13 happens to fit. 2. YOU CAN GO TO PRISON. Section 145 of the Criminal Law has been in its current form since 4 July 2024. It covers unlawful acts with personal data done out of revenge, greed or blackmail. The basic penalty is up to one year in prison. It is up to two years where substantial harm is caused. It is up to four years where a public official, or a responsible employee of a company or organisation, does it. It is up to five years for forcing or tricking a company, a supplier or a person into carrying out unlawful acts. This applies to individuals, and it is a prosecution, not a fine. 3. ACCOUNTING STORAGE AND LANGUAGE. Accounting Law Section 27(1) is the geographic wall described above. Section 9(1) adds that entries in accounting registers must be made in Latvian. A second language is allowed alongside. A group standardising on an English-only, United States-hosted resource planning system fails both tests at once. 4. THE ONE-YEAR LOG CAP. Section 37(2) of the Personal Data Processing Law caps audit trails at one year where a keep-it duty applies. Most global security teams keep sign-in and access logs for two years or more by default. 5. LOCAL PEOPLE AND SUPPLIER NATIONALITY. Cabinet Regulation No. 397 of 25 June 2025 makes an essential or important service provider appoint a named cyber security manager. That person must be a citizen of a NATO, European Union or European Free Trade Association state, with set qualifications. For critical infrastructure owners, the Constitution Protection Bureau must find no security risk in that person. For Class A information systems, the supplier, its board, its shareholders and its true owner must all be from an allied country. This is an ownership and nationality screen, not a data rule. Standard supplier checks will not catch it. 6. A SIXTH, QUIETER ONE. Latvia runs an official register of qualified data protection specialists at the Inspectorate, with a state qualification exam. Appointing someone from the list is optional, not required. But tenders and public-sector customers increasingly ask for one.

DATED. 12 January 2027 - Regulation (EU) 2023/2854, the Data Act, has applied since 12 September 2025 and reaches its hard deadline. All cloud switching charges and data export fees must be zero. Chapter VII of the same regulation limits when a non-European government can get non-personal data held in the European Union. 14 October 2026 - the State Data Inspectorate's next data protection specialist qualification exam, announced on 7 August 2026. 18 June 2026 - changes to the National Cyber Security Law already took effect. They move designation decisions from the Digital Security Supervisory Committee to the National Cyber Security Centre. They let the Centre remove a company from the essential and important services list. They delete the article on early warning sensors. And they widen the group of nationally significant private bodies. If you mapped your duties before June 2026, check them again. POWERS ALREADY IN SOMEONE'S HAND. These matter more than pending bills. 1. Section 30 of the National Cyber Security Law gives the Cabinet three powers. It can set data centre security requirements, rules on where information systems must sit inside data centres, and rules on security operations centres. We could not find those rules issued. Until they are, hosting placement for essential and important service providers follows only the general minimum requirements. When they land, they will be a placement rule made by the Cabinet, with no new act of parliament needed. 2. The European Commission decided the United States is safe enough under the European Union-United States Data Privacy Framework. That decision is under appeal at the Court of Justice. On 31 July 2026 the European Data Protection Board asked the Commission to review it. If it falls, every Latvian company relying on it for United States transfers needs a replacement route overnight. 3. The European Union cloud certification scheme is still not adopted. It has been stuck over sovereignty since 2020. So national and industry rules like Latvia's allied-supplier screen keep applying. Two more are proposals only, with no legal effect. They are the Cloud and AI Development Act of 3 June 2026 and the Digital Omnibus of 19 November 2025.