LithuaniaLaw on Legal Protection of Personal Data
Republic of Lithuania Law No. XIII-1426, in force (as amended)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Lithuania, including data collected by crawling.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which 'other important objective circumstances', beyond the complexity of the circumstances and the volume of information, let the State Data Protection Inspectorate extend once the period for issuing an Article 46(3) authorization under Article 15(2) of the Law on Legal Protection of Personal Data?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Where an employer processes a candidate's or employee's data on criminal convictions and offenses on the legitimate-interests ground, it assesses its legitimate interests and prepares a written report of that assessment. Article 5(4) separately has the employer inform employees of workplace monitoring in a way that proves they were informed. Neither provision fixes a list of fields, and neither states how long the written report is kept.
- Kind
- Explicit
- As of
- Provision
- Article 5, paragraph 2, point 1
- Trigger
- personal_data_processing
What this law does
The Law on Legal Protection of Personal Data gives the General Data Protection Regulation (GDPR) domestic effect in Lithuania and is enforced by the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI). Article 6 sets the age at which a child can consent to information society services at 14, below the GDPR default of 16.
Under Article 15, VDAI must give a controller the authorization for an Article 46(3) cross-border transfer, or a reasoned written refusal, within 20 working days of receiving all the documents it needs. Where the case is complex, that period can be extended once by up to 10 working days.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .