Lithuania

The Seimas adopted these amendments to the Law on Technology and Innovation and the Law on Information Society Services on 14 January 2025. Per the Ministry of Economy and Innovation's own account, the amendments designate the Communications Regulatory Authority (RRT) as market-surveillance authority and single point of contact for the EU AI Act. The same amendments designate the Innovation Agency as the notifying authority.

The Innovation Agency also operates an AI regulatory sandbox where companies will receive expert advice on the compliance of their solutions with the AI Act and other relevant regulations. The Ministry's own account states only this adoption date, not a separate commencement date.

Criminal Code Art. 309(2) bans producing, acquiring, possessing, exhibiting, advertising, offering, or distributing pornographic material depicting a child, or a person presented as a child, or using information and communication technologies to acquire or provide access to such material, punishable by a fine, restriction of liberty, arrest, or imprisonment for up to four years.

The 'person presented as a child' wording reaches a simulated or artificially generated depiction and does not require the material to show a real child. Article 309(3) raises the maximum to five years' imprisonment for producing, acquiring, or distributing a large quantity of material depicting a minor. A legal entity is also liable under Article 309(5).

This is a general criminal-law prohibition rather than an AI-specific statute, and it binds any person regardless of the tool used to produce the material.

A controller must notify VDAI without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Lithuania, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Neither DLA Piper nor Linklaters reports a Lithuania-specific narrowing of this.

The Law on Legal Protection of Personal Data gives the General Data Protection Regulation (GDPR) domestic effect in Lithuania and is enforced by the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI), whose title is confirmed directly from VDAI's own legislation index.

Two independent secondary legal trackers (DLA Piper, Linklaters) agree that Lithuania sets the digital age of consent for information society services at 14, below the GDPR default of 16, and that VDAI itself issues the authorization for an Article 46(3) cross-border transfer within 20 working days, extendable to 30 in certain cases; neither figure is independently confirmed against the Act's own text, which the gazette's URL does not serve.

Transferring personal data of a person in Lithuania outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

Two independent secondary trackers (DLA Piper, Linklaters) agree that Lithuania adds a national procedural layer: VDAI itself issues the authorization for a transfer based on Article 46(3) ad hoc contractual clauses or administrative arrangements, reported as taking up to 20 working days and, in certain cases, up to 30; not independently confirmed against the Act's own text.

General Data Protection Regulation (GDPR) Articles 15 to 21 apply directly in Lithuania: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller. Article 22 gives a qualified right against a decision based solely on automated processing with legal or similarly significant effect. Neither DLA Piper nor Linklaters reports a Lithuania-specific derogation to these rights beyond the age-of-consent point recorded on the comprehensive-regime instrument.

VDAI enforces the Act with the General Data Protection Regulation (GDPR) Article 58 corrective powers and fining authority, confirmed by both DLA Piper and Linklaters. The private-sector fine ceiling follows the standard GDPR Article 83(5) figures, up to EUR 20 million or 4 percent of global annual turnover; both sources separately report a lower public-sector ceiling capped at a percentage of that body's own budget, a figure not independently confirmed against primary legislative text.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. No Lithuanian statutory enumeration, illustrative list, or VDAI guidance document text on biometric identifiers, faceprints, or voiceprints was independently confirmed.

Secondary commentary (Linklaters) describes VDAI as having issued an order naming processing of telephone-conversation recordings and use of biometric data among the situations requiring a data protection impact assessment; the order itself is not reproduced here beyond this general description.

Article 198-1 punishes unlawfully connecting to an information system or part of it by breaching that system's security measures, up to two years' imprisonment, rising to three years where the system has strategic national-security or major state-governance, economic, or financial significance; the authorization test is keyed to circumventing a technical protection measure, so a crawl of an unprotected public page is not reached by it.

Articles 196 and 197 punish unlawfully destroying, damaging, deleting, or altering electronic data, or disrupting an information system's operation, causing damage, up to two years, rising to six years for the same aggravating circumstances or a large-scale effect across multiple systems or use of another person's personal data.

Article 198 punishes unlawfully observing, recording, intercepting, acquiring, holding, disseminating, or otherwise using non-public electronic data, up to four years, rising to six years for the same aggravating circumstances. A legal entity is also liable for each offense.

Article 14 requires a cybersecurity subject entered in NKSC's Cybersecurity Subjects Register under Annex 1 or Annex 2 of the Law to adopt and keep current cybersecurity policy documents, periodically analyse and manage its cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure its supply chain, and deploy technical cybersecurity measures.

The Government's Cybersecurity Requirements Description sets out the detailed technical and organisational measures Article 14 requires, with a 12-month grace period from registration for the organisational measures and 24 months for the technical measures. Article 14(7) separately requires the subject's management-body members, head and designated representative to complete cybersecurity training at least once every two years.

A named subset of digital-service "special subjects" includes a DNS service provider, a top-level-domain registry, a cloud or data-centre service provider, a content-delivery-network, managed-service or managed-cybersecurity-service provider, an electronic-marketplace provider, and an internet-search-engine or social-networking-service-platform provider.

A special subject or trust service provider must comply only with the European Commission's directly-applicable Implementing Regulation (EU) 2024/2690 risk-management measures from the moment of its own entry into the Register, under Article 14(4) of the Law. Only an essential entity's activity or services may be temporarily suspended, and only an essential entity's head may be temporarily removed from office by a district court order on NKSC's request.

Article 18 requires an essential or important cybersecurity subject to notify NKSC of a significant cyber incident without delay and not later than within 24 hours of becoming aware of it, then follow within 72 hours with an assessment of the incident's severity and impact and any evidence of compromise.

A final report is due within one month of the incident's registration, with NKSC able to request an interim report, and a minor incident is reported within 72 hours without a separate 24-hour early warning. The Law requires an essential or important subject to notify NKSC of every cyber incident affecting it, not only a significant one. A subject with no statutory duty to report may still notify NKSC of a cyber incident, threat or near-miss voluntarily.

NKSC is developing a centralised national cyber-incident reporting and management platform, not yet launched, under a single-window principle for NKSC, the Lithuanian police and the State Data Protection Inspectorate to coordinate on.

Article 4 classifies public information causing a negative effect on minors' mental or physical health or their physical, mental, spiritual or moral development. Content of an erotic nature is one of 21 enumerated categories the article lists, alongside violence, gambling promotion, self-harm, and other harmful subject matter.

The restrictions, exceptions and prohibitions this Law sets apply to all public information, including advertising, commercial audiovisual messages, trailers, trademarks, user-generated video, and public events.

Article 7 bars disseminating such information directly to minors and confines it to places minors cannot access or times they would not be using it, unless the discloser instead uses technical measures that let a person responsible for a child's upbringing control the child's exposure, among them tools intended to verify a user's age, parental-control tools, or content-filtering systems.

Content still reaching a general audience without such technical measures must instead carry an index and observe a broadcast-time band.

Index 'S' runs from 23:00 to 06:00, index 'N-14' runs from 21:00 to 06:00 for content harmful to under-14s, and index 'N-7' applies at any time for content harmful to under-7s. A provider of public computer-network (internet) access must install and operate content-filtering measures the Communications Regulatory Authority (Ryšių reguliavimo tarnyba, RRT) approves, and RRT itself supervises that duty's implementation.

A computer game's producer or distributor must separately label the game by a user age threshold under Government-set procedure. Supervision of the Law's implementation generally rests with the Inspector (Žurnalistų etikos inspektorius, the Office of the Inspector of Journalist Ethics). The Inspector may open administrative-offense proceedings under the Code of Administrative Offenses and impose an administrative penalty against a violator.

Article 57-1 gives an electronic press publisher the exclusive right to permit or prohibit an information-society service provider from reproducing an electronic press publication or part of it, or making it publicly available online. The right does not reach an individual user's private or non-commercial use, a hyperlink, or a publication first published before 6 June 2019.

It also does not reach the use of individual words from the publication or an extract of 125 or fewer print characters, not counting the heading and spaces. An electronic press publisher must ensure that the authors of works included in the publication receive an appropriate share of the revenue the publisher earns from an information-society service provider's use. Absent another agreement between the publisher and the author, that revenue is split equally.

Article 21 permits reproducing, publishing, and communicating to the public, including online, a small part of a lawfully published or publicly disclosed work, in the original language or in translation, as a quotation for criticism or review in another work, without the author's permission or remuneration, provided the source and author's name are cited where possible and the use is fair and does not exceed what the purpose of quotation requires.

The article's current wording took effect 1 May 2022, per the INFOLEX mirror's own redaction-history field, though its quotation exception itself dates to an earlier amendment (Law No. XI-1833 of 21 December 2011).

Article 24 permits reproducing in the press and communicating to the public, including online, published or publicly disclosed articles on current economic, political, or religious topics, and analogous broadcast works, without the author's permission or remuneration. This use is permitted unless the authors or other rightsholders have prohibited such use, and provided the source and author's name are given in the copies bearing the work or by other means.

A separate paragraph permits reproducing and broadcasting speeches, lecture excerpts, and similar works, including courtroom speeches, for information purposes. The article's current wording took effect 10 January 2012, per the INFOLEX mirror's own redaction-history field.

Article 22-1 lets a research organization or cultural-heritage institution reproduce, without the author's permission or remuneration, a work it can lawfully access for non-commercial text-and-data-mining research, keeping the copy only as long as the research requires. A contract term barring reliance on this exception is void. Article 22-2 lets anyone reproduce a lawfully accessible work for text-and-data-mining purposes without permission or remuneration.

That limitation applies only unless the rightsholder has expressly reserved that use by appropriate means, which for content publicly available online means machine-readable means. The same pairing of exceptions reaches a database's contents. Article 63(1)(6) gives research organizations and cultural-heritage institutions an equivalent unconditional right to extract a database for text-and-data-mining research.

Article 63(1)(7) extends the general, opt-out-conditioned exception to any lawful user extracting a database for text-and-data-mining purposes.