LatviaPersonal Data Processing Law (Fizisko personu datu apstrādes likums)
Fizisko personu datu apstrades likums, Latvijas Vestnesis No. 132 (2018), in force
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Latvia, including data collected by crawling.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which 'attiecīgo jomu regulējošos normatīvajos aktos' (acts governing the relevant fields) lay down the requirements of GDPR Article 6(2) and (3) for processing needed for a legal obligation or a public-interest task, as Article 25(1) of the Personal Data Processing Law provides?
- Which cases in 'citos normatīvajos aktos' (other normative acts) may limit data subject rights under Article 26(1) of the Personal Data Processing Law, in addition to the settings listed in Articles 27 to 32, 34 and 36?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Access record
Log retention
Where a controller is obliged to keep system audit records, it keeps them no longer than one year after the entry is made, unless other normative acts or the nature of the processing provide otherwise.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 1
Logging duty
Article 37 defines audit records as registered data on events in an information system (access to the system, entry, change, deletion and transmission of data) and governs how long a controller that is obliged to keep them holds them. The duty to keep audit records comes from the rules that apply to the controller, not from Article 37, which states the one-year limit and that the controller need not keep data in them only to answer a data subject request. The contents list names access, entry, change, deletion and transmission events.
- Kind
- Explicit
- As of
- Provision
- Article 37, paragraphs 1 and 2
- Trigger
- personal_data_processing
What this law does
Latvia's national supplement to the directly applicable General Data Protection Regulation (GDPR), establishing the Data State Inspectorate (DVI) as supervisory authority with GDPR Article 57-58 powers, national procedure for decisions, disputes and appeals, and data protection officer regulation. Beyond that institutional layer it also makes national choices on substance. Article 25(1) of the Law permits processing where at least one ground in GDPR Article 6(1) applies.
Articles 27 to 32 limit data subject rights in specific settings, such as scientific or historical research under Article 31. The Law has no transfer rules of its own, so the transfer rules of GDPR Chapter V apply directly.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .