Operates a social platform, in Latvia

Elektronisko plašsaziņas līdzekļu likums, 23.6 pants, pievienots ar 2020. gada 5. novembra likumu, stājas spēkā 01.12.2020. · Read the law's page

• Applies to video-sharing platform providers: providers of a service, or a separable part of one, that carries no editorial responsibility, whose essential functionality is mainly to offer the general public programmes and user-generated videos, and which the provider organizes, including by automatic means or algorithms.
• Take appropriate measures to protect the public from content and user-generated video or audio commercial communications that could harm minors' physical, mental or moral development, that could incite violence or hatred, or that constitute a listed criminal offence.
• Publish your own publicly accessible code of conduct addressing commercial communications aimed at, or capable of negatively affecting, the psychological or physical development of minors, including in children's programming.

Copyright Act (Autortiesību likums), VIII 1 nodaļa, 56. 1 pants to 56. 5 pants, in force from 05.04.2023 · Read the law's page

• Obtain the rights holder's authorization for giving the public access to works your users upload, or be able to prove the conditions that avoid liability: utmost efforts to obtain authorization, utmost efforts to keep unavailable the works for which rights holders gave you relevant and necessary information, and prompt action on a substantiated notice, with utmost efforts to prevent re-upload.
• If your service has been available in the European Union for under three years and your annual turnover is under EUR 10 million, show only utmost efforts to obtain authorization and prompt action on a substantiated notice; once your average monthly unique visitors exceed five million, also show utmost efforts to prevent re-upload of works for which rights holders gave you the information.
• Do not deny access to user uploads whose use does not infringe copyright, and tell users in your terms of service about their options to use works under the limitations on rights.
• Handle users' complaints about disabled access or removal at once and free of charge, tell the rights holder involved, let the parties give reasons, and have a person review each decision to disable access or remove a work.
• On a rights holder's request, give information about your cooperation measures and tools and about the use of works covered by licences.

20. pants and 21. pants, Information Society Services Act (Informācijas sabiedrības pakalpojumu likums), in force from 29.05.2023 · Read the law's page

• If you are a hosting service provider, restore content or access to it at once when Article 4(7) of Regulation (EU) 2021/784 requires it, where restoration is still possible.
• Preserve terrorist content you removed or disabled, and the related data, for the period Article 6 of Regulation (EU) 2021/784 sets, and keep the technical and organizational safeguards that article requires.
• Give the investigating authority or prosecutor, the contact point, or Europol, in good time, the information on terrorist content linked to an imminent threat to life that Article 14(5) of Regulation (EU) 2021/784 requires.
• Remove terrorist content or disable access to it in all Member States within the time the Regulation sets, because systematic or persistent failure is fined up to 4 percent of total turnover.

Information Society Services Act (Informācijas sabiedrības pakalpojumu likums), VIII 1 nodaļa, 19. 1 pants to 19. 8 pants, in force from 21.06.2024 · Read the law's page

• If the coordinator proposes it, bring your service into line with the Digital Services Act by the deadline it sets, and tell the coordinator at once, and within three working days of the deadline, that you have done so, with supporting evidence.
• Where you give the coordinator a written commitment to end a breach, carry it out by the date it sets, normally within three months, and tell the coordinator within three working days of the deadline, with evidence.
• Give the coordinator correct, complete and non-misleading information when it investigates your compliance, answer its questions, and submit to an inspection.

Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024), 39.-40. panti · Read the law's page

• This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider among the medium-or-large digital providers it reaches expressly, for the reason given on this jurisdiction's companion risk-management row; the reporting duty in Article 39 itself binds any person who discovers the vulnerability, not only a covered subject.
• Once the competent cyber incident prevention institution relays a substantiated report that a vulnerability exists in a system or network you operate, remediate it within the deadline the institution sets, no later than 90 days from when you received the information.
• Report your remediation progress to the institution as you go, and, if you cannot remediate within 90 days for objective reasons, request an extension, which the institution may grant up to a total of 180 days from the report's submission.
• Where you discover a vulnerability in a subject's information system or electronic communications network, report it to the competent institution within five working days; you may report anonymously and ask that your identity be kept confidential.

Nacionālās kiberdrošības likums (adopted 20.06.2024, in force 01.09.2024, amended by the law of 04.06.2026, in force 18.06.2026; redakcija no 01.10.2026), 25.-28. panti · Read the law's page

• Take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems you use, and to prevent or minimise to the greatest extent possible the impact of a cyber incident on your service recipients and on other services.
• Draft a cyber-risk-management and ICT-business-continuity plan and give your staff regular training on carrying it out; the Cabinet sets the plan's required content (Article 28(2)), and Cabinet Regulation No. 397 of 25 June 2025, 'Minimālās kiberdrošības prasības', sets the minimum cybersecurity requirements your systems must meet.
• Have your head or governing body appoint a cybersecurity manager within three months of notifying your essential- or important-provider status or of the National Cybersecurity Centre's decision on it, and notify the National Cybersecurity Centre and the Constitution Protection Bureau of the appointment within five working days.
• Since 18 June 2026, do not give privileged access to your ICT systems to a staff member convicted of an intentional crime linked to terrorism, against the state, the administrative order or property, or in the economy, unless they are rehabilitated or the conviction has been cleared; if such a person is convicted and not cleared, decide individually on their employment after weighing the security risk (Article 26.1).
• This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider (Article 21(1)(2)(l)-(n)) among the medium-or-large digital providers it reaches expressly; the wider sector classes both Articles also reach (energy, transport, health, finance, drinking water, a large or medium cloud-computing, data-centre, content-delivery-network, or ICT-management or cybersecurity service provider, a domain-name-system service provider of any size, and direct and indirect public administration) are reached too, by declaring that you are an essential or important entity.
• This Law applies to a financial entity covered by Regulation (EU) 2022/2554 (DORA) only insofar as that Regulation or other law sets no other requirements, and its requirements and supervision do not apply to a subject covered by a sector-specific EU regime that is at least equivalent in effect (Article 3(3)-(4)).

XI 1 nodaļa, 71. 1 pants to 71. 6 pants, Copyright Act (Autortiesību likums), in force from 11.01.2025 · Read the law's page

• When the National Electronic Mass Media Council asks you, as a content provider or hosting service provider, to prove your right to make works public on a website, submit the documents within seven days or stop making the works public.
• If the Council decides that you must stop making works public, stop within seven days, because the Council may otherwise restrict access to the website in Latvia.

Nacionālās kiberdrošības likums (adopted 20.06.2024, notification clock applying from 01.07.2025), 34. pants · Read the law's page

• This binds an essential service provider (Article 20) or an important service provider (Article 21), which names an online marketplace, an online search engine and a social media platform service provider among the medium-or-large digital providers it reaches expressly, for the reason given on this jurisdiction's companion risk-management row.
• Immediately take all action necessary to contain a detected cyber incident, immediately inform the competent cyber incident prevention institution (for most private-sector and civilian public-sector subjects, the Institute of Mathematics and Computer Science of the University of Latvia), and follow its instructions.
• For a significant cyber incident, electronically submit an early warning to the competent institution without delay and no later than within 24 hours.
• Follow with an initial report without delay and no later than within 72 hours (within 24 hours instead, if you are a trust service provider).
• Within one month of the initial report, submit a final report on the incident's resolution, or, if it is still unresolved at that point, a progress report followed by a final report once you have resolved it; submit an intermediate report if the competent institution requests one.
• Where relevant, immediately inform your service recipients, including affected network or system users, of protective measures they can take, and, after coordinating with the competent institution, inform them of the significant incident or threat itself, unless disclosure would create a new significant-incident risk or conflict with national security.

Ministru kabineta noteikumi Nr. 397, Minimālās kiberdrošības prasības (2025. gada 25. jūnijs) · Read the law's page

• If you are an essential or important service provider, or an owner or lawful possessor of ICT critical infrastructure, under the National Cybersecurity Law, these minimum requirements bind the networks and information systems you own or hold, other than those that process state secret, NATO, European Union or foreign-institution classified information (points 1 and 3).
• Keep a cybersecurity governance document set made up of a cybersecurity policy, a catalogue of your ICT resources and information systems, a cyber-risk-management and ICT-business-continuity plan and a cyber incident log (point 21), and review the policy at least once in three years (point 28).
• Update the catalogue of ICT resources and information systems within one month of a change, and assign each information system a confidentiality, integrity and availability security class of A, B or C (points 31 and 32).
• Review and update the cyber-risk-management and ICT-business-continuity plan at least once a year if you are an ICT critical infrastructure owner or an essential service provider holding a class A system, at least once in two years if you are another essential service provider, and at least once in three years if you are an important service provider (point 40).
• Enter each cyber incident in the cyber incident log within 24 hours of detecting it, assess its significance at once, and report a significant incident to the competent cyber incident prevention institution on the early warning, initial report, progress report, intermediate report and final report forms within the clocks of Article 34 of the Law (points 47, 117 and 119).
• Give every employee and official who uses your ICT resources an initial cybersecurity briefing within one month of registering their user account and a routine briefing at least once a calendar year, and train your ICT staff at least once a year (point 76).
• If you are an ICT critical infrastructure owner or lawful possessor, buy technical resources for a class A information system only from a supplier and manufacturer that meet the registration, board, beneficial-owner and shareholder conditions of point 94, unless point 95 lifts them, and obtain the Constitution Protection Bureau's opinion before contracting for services to a class A system (points 93 and 94).