LithuaniaGDPR Articles 82-83 and VDAI Enforcement in Lithuania
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Lithuanian Criminal Code (Baudziamasis kodeksas) Article 167 criminalizes unlawful collection of information about a person's private life, punishable by community service, a fine, restriction of liberty, arrest, or imprisonment for up to three years; a legal entity is also liable for the same act. This is a general Criminal Code privacy offense, not a provision of the GDPR-implementing Act itself, and sits alongside VDAI's administrative fining power under GDPR Article 83.
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements including the Article 9 special category rules, the Article 12 to 22 data subject rights, and the Chapter V transfer rules. The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25 to 39 controller and processor obligations, including the Article 33 and 34 breach notification duties. Article 33 of the Law on Legal Protection of Personal Data sets lower ceilings for a public authority or body: 0.5 percent of its budget and income, and not more than EUR 30,000, for Article 83(4)(a) to (c) infringements, and 1 percent, and not more than EUR 60,000, for Article 83(5)(a) to (e) and 83(6) infringements. A public authority or body that carries on commercial economic activity faces the full Article 83(4), (5) and (6) ceilings under Article 33(3).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI), Lithuania's independent supervisory authority under the GDPR.
Enforcement record
Counts VDAI's own reported fines for personal data security violations in calendar year 2025 (5), per VDAI's own summary of its 2025 activity, published and updated : total fines EUR 27,029, largest EUR 9,000, smallest EUR 3,529. In the same period VDAI also issued 66 instructions, 56 reprimands, 78 recommendations, and 2 warnings as corrective measures short of a fine. Public enforcement actions only. The release does not state the two other individual fine amounts or a cumulative total since 2018.
- As of
- Currency
- EUR
- Source link
- https://vdai.lrv.lt/lt/naujienos/valstybines-duomenu-apsaugos-inspekcijos-veikla-2025-m-qeY/
- Fines per year
- 27,029
- Actions per year
- 5
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Lithuanian rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation, and Article 83 sets the administrative fines. Neither states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation. Article 33 of the Law on Legal Protection of Personal Data sets the lower fine ceilings for public bodies and names no record.
- Kind
- None
- As of
What this law does
VDAI monitors the application of the General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data and ensures that they are applied. The private-sector fine ceiling follows the standard GDPR Article 83(5) figures, up to EUR 20 million or 4 percent of global annual turnover.
Under Article 33(1) of the Law, VDAI may fine a public authority or body that infringes GDPR Article 83(4)(a) to (c) up to 0.5 percent of its current-year budget and the total annual income it received in the previous year, but not more than EUR 30,000. Under Article 33(2), the ceiling is 1 percent, and not more than EUR 60,000, for an infringement of GDPR Article 83(5)(a) to (e) or 83(6).
Under Article 33(3), a public authority or body that carries on commercial economic activity faces the full GDPR Article 83(4), (5) and (6) ceilings. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .