LatviaGDPR Articles 82-83 and DVI Enforcement in Latvia
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Kriminallikums (Criminal Law) Section 145, Illegal Activities Involving Personal Data of Natural Persons, criminalizes unlawful activity involving a natural person's personal data in three escalating tiers: up to two years' deprivation of liberty where substantial harm is caused (para. 1); up to four years where committed by a personal data processing controller or processor for vengeance, gain, or blackmail (para. 2); and up to five years where committed by using violence, threats, bad-faith abuse of trust, or deceit against the controller, processor, or data subject (para. 3), each alternatively punishable by temporary deprivation of liberty, probationary supervision, community service, or a fine. This is a dedicated personal-data criminal offense in the Criminal Law, distinct from DVI's administrative fining power under GDPR Article 83.
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements including the Article 9 special category rules, the Article 12 to 22 data subject rights, and the Chapter V transfer rules. The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25 to 39 controller and processor obligations. For public-law legal persons, Article 38 of the Personal Data Processing Law provides a separate, lower sanction: a warning or a fine on the official of up to 200 fine units.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data State Inspectorate (Datu valsts inspekcija, DVI), Latvia's independent supervisory authority under the GDPR.
Enforcement record
Counts the 62 inspection cases in calendar year 2025 in which the Data State Inspectorate applied corrective measures, per its 2025 activity report. Seven decisions in administrative violation cases were also taken that year, five of them imposing a fine for infringements of the Regulation; those are not added to the count. The report gives the year's fines as EUR 326,400 in total, from EUR 150 to EUR 300,000 each. The 1,396 inspections and the 1,034 data subject complaints received are not counted as actions. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dvi.gov.lv/lv/media/4634/download?attachment
- Fines per year
- 326,400
- Actions per year
- 62
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Latvian rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation, and Article 83 sets the administrative fines. Neither states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation. Article 38 of the Personal Data Processing Law sets warnings and fines for public-law bodies and names no record.
- Kind
- None
- As of
What this law does
The Data State Inspectorate (DVI) holds the General Data Protection Regulation (GDPR) Article 57-58 toolkit, investigative powers, corrective powers, and administrative fine authority up to the Article 83 tiers. DVI has issued fines under this authority: in the five years from 2018 to 2022 they ranged from EUR 200 to EUR 1.2 million and came to almost EUR 1.6 million in total.
For unlawful acts with personal data by a public-law legal person, and for its failure to meet controller or processor duties, Article 38 of the Personal Data Processing Law provides a warning or a fine on the official of up to 200 fine units. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .