Latvia

Section 90.1 criminalizes the deliberate production or dissemination of knowingly false, discrediting information about a political organization (party), an association of political organizations, or a candidate for the Saeima, a municipal council, or the European Parliament, using deepfake technology, when committed during the pre-election campaign period or on election day; the maximum penalty is five years' deprivation of liberty, or alternatively short-term deprivation of liberty, probationary supervision, or community service.

Section 90.2 criminalizes the same conduct directed at a candidate for a state office the Saeima elects, appoints, or confirms, when committed during that process, carrying the same maximum penalty.

A controller must notify the Data State Inspectorate (DVI) without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Latvia, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Latvia-specific derogation to this timeline was found.

Latvia's national supplement to the directly applicable General Data Protection Regulation (GDPR), establishing the Data State Inspectorate (DVI) as supervisory authority with GDPR Article 57-58 powers, national procedure for decisions, disputes and appeals, and data protection officer regulation. It does not restate GDPR's substantive lawful basis, rights, or transfer rules, which apply directly.

Transferring personal data of a person in Latvia outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Latvia-specific transfer restriction beyond Chapter V was found.

General Data Protection Regulation (GDPR) Articles 15 to 21 apply directly in Latvia: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller, generally within one month. Article 22 gives a qualified right against a decision based solely on automated processing with legal or similarly significant effect.

The Personal Data Processing Law's national role is institutional (the Data State Inspectorate's powers and complaint procedure) rather than a rewrite of the rights chapter; no Latvia-specific derogation narrowing these rights was found.

The Data State Inspectorate (DVI) holds the General Data Protection Regulation (GDPR) Article 57-58 toolkit, investigative powers, corrective powers, and administrative fine authority up to the Article 83 tiers. DVI has issued fines under this authority, including a reported EUR 1.2 million penalty against a service provider. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

Article 25(2) of the Personal Data Processing Law, confirmed at likumi.lv, restates General Data Protection Regulation (GDPR) Article 9's special-category list and its own biometric-data term mirroring GDPR Article 4(14)'s definition (processing necessary for unique identification). It carries no illustrative list, enumeration, or named example distinguishing facial recognition from voice data or any other biometric modality.

No Latvia-specific narrowing or widening of the biometric category beyond the GDPR baseline was found in this provision.

Section 241 makes arbitrary access to the resources of an automated data processing system a crime only where it involves breaching the system's protective means, or is carried out without permission or by using rights granted to another person, and causes substantial harm; the maximum penalty rises from two to four years where the access is for financial gain, and to seven years where committed by an organized group, causing serious consequences, or directed at a system processing state-security-related information.

Because breaching a protective measure or exceeding an authorization is the trigger, crawling a public, unauthenticated page carries no exposure under this section. Section 243 separately criminalizes unauthorized modification, damage, destruction, impairment, or concealment of information in such a system, or knowingly entering false information into it, at penalties up to three years, rising to seven for an organized group or serious consequences.

Section 244 criminalizes the unauthorized manufacture, adaptation, distribution, acquisition, transport, or storage of a tool, device, software, password, or access code intended to influence such a system's resources or to gain access to it for committing a crime, at penalties up to two years, rising to five for an organized group or serious consequences.

Article 21.1 permits reproducing a lawfully accessible work to carry out text and data mining, defined as any automated analytical technique used to analyze text and data digitally to derive information such as patterns, trends, and correlations. Copies made for that purpose may be kept only as long as needed for the mining.

A rights holder can prohibit this use by giving clear notice in an appropriate manner, and a prohibition on the online use of publicly accessible works must be given in machine-readable form, including through metadata. A separate, non-waivable exception at Article 21.2 covers a research organization or a cultural heritage institution mining lawfully accessible works for scientific research, without that opt-out, but Article 21.2(5) excludes computer programs from its scope.

A person or legal entity that has taken the initiative and risk of investment in creating a database, where its creation, verification, or presentation reflects a substantial qualitative or quantitative investment, is recognized as its maker and can prevent extraction, meaning the permanent or temporary transfer of the whole or a substantial part of its content to another medium, and re-utilization, meaning making that content available to the public by distributing, renting, or providing online or other transmission of it.

Repeated and systematic extraction or re-utilization of insubstantial parts is also barred where it conflicts with the database's normal use or unreasonably prejudices the maker's legitimate interests. The right runs fifteen years from the year following completion, restarting on a substantial new investment, and does not reach a lawful user's extraction or re-utilization of an insubstantial part for any purpose, nor extraction for text and data mining permitted under Articles 21.1 and 21.2.

Article 27 requires a subject (an essential service provider under Article 20, an important service provider under Article 21, or an owner or lawful possessor of ICT critical infrastructure) to take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems it uses, and to prevent or minimise the impact of a cyber incident on its service recipients and on other services.

Article 21(1)(2)(l)-(n) names an online marketplace, an online search engine and a social media platform provider expressly among the medium-or-large digital providers this duty reaches as important entities.

Article 28 additionally requires the subject to draft a cyber-risk-management and ICT-business-continuity plan and to train staff on it, with the plan's required content and the minimum cybersecurity requirements the subject's systems must meet set by Cabinet Regulation No. 397 of 25 June 2025; Article 25 requires the subject's head to appoint a cybersecurity manager (kiberdrošības pārvaldnieks) within three months of the subject's status notification, and Article 26.1, inserted by the amendment in force since 18 June 2026, adds a criminal-record screening duty for ICT staff with privileged system access.

Article 3(3)-(4) exempts a financial entity already covered by Regulation (EU) 2022/2554 (DORA), and any subject covered by an equivalent sector-specific EU cybersecurity regime, from these provisions to the extent that regime's own requirements are at least equivalent.

Article 39 requires any person who discovers a vulnerability in a subject's information system or electronic communications network to report it to the competent cyber incident prevention institution within five working days, and lets that person report anonymously and have their identity kept confidential.

Once the institution has assessed a report as substantiated and relayed it, Article 40 requires the affected subject to take the actions necessary to remediate the vulnerability within the institution's own deadline, capped at 90 days from receiving the information and extendable to 180 days on the subject's request for objective reasons, reporting progress to the institution as it goes. This is a subject-facing remediation clock rather than only a state-run coordination function.

Article 46(5), however, defines a fine-triggering 'material non-compliance' with a closed three-item list (failing to take appropriate measures, repeatedly refusing supervisory information requests, and a late or false significant-incident notification) that does not name a missed Article 40 deadline, so whether that specific failure draws the Article 46 fine, rather than only the non-monetary corrective and suspension powers Article 45 gives generally, is not settled by the text and is recorded as an open question here rather than as a penalty figure.

Article 34 requires a subject to notify the competent cyber incident prevention institution immediately of any cyber incident and to follow its instructions.

For a significant cyber incident, the subject must submit an early warning within 24 hours of becoming aware, an initial report within 72 hours (24 hours for a trust service provider), and, within one month of the initial report, a final report (or, if unresolved, a progress report followed by a final report once resolved); where relevant, the subject must also inform affected service recipients of protective measures and, after coordinating with the institution, of the incident itself.

This is NIS2 Article 23's own clock. Although the Law commenced 1 September 2024, its transitional provisions delayed Article 34's paragraphs two through five, the notification clock itself, until 1 July 2025.

For most private-sector and civilian public-sector subjects the competent cyber incident prevention institution is the Institute of Mathematics and Computer Science of the University of Latvia, which operates publicly as CERT.LV; the Military Intelligence and Security Service holds the same role for the defence sector. A missed or knowingly false notification is one of Article 46(5)'s three enumerated grounds for a material non-compliance fine.

Article 24(9) bans distributing audio and audiovisual works depicting physical or psychological violence, bloody or horror scenes, drug use or sexual acts, or containing coarse or indecent language, between 7:00 and 22:00.

Article 24(10) requires an electronic mass medium not observing that watershed for content that could harm a minor's physical, mental, or moral development to instead provide restricted access control, preceded by an acoustic warning signal and marked with a visual symbol describing the content's potentially harmful nature. Article 23(4) imposes the equivalent restricted-access-control duty on an on-demand catalogue offering such content.

Article 24(10.1) bars commercial use of a minor's personal data obtained through that access control, except where necessary to provide the service itself with the data subject's consent.

A video-sharing platform provider, defined by Article 23.5 as an information-society service whose main purpose or an essential function is to provide the public with programmes or user-generated videos it does not edit but organizes and promotes for profit, must take appropriate measures to protect the public from content and user-generated video or audio commercial communications that could harm minors' physical, mental, or moral development, that could incite violence or hatred, or that constitute a listed criminal offence.

It must publish its own publicly accessible code of conduct addressing commercial communications aimed at or capable of negatively affecting the psychological or physical development of minors, including in children's programming.

A press publisher holds an exclusive right to reproduce and make available online its press publications, defined as a journalistic compilation published under one title in a periodical or regularly updated edition, exercised against an information-society service provider. The right does not reach private or non-commercial use, hyperlinks, or the use of single words or very short extracts.

It cannot be invoked to prohibit use of works the publisher included under a simple licence, or whose copyright or related-rights term has expired, and runs for two years after the press publication is made public. An author whose work is included in a press publication has a right to a proportionate share of the revenue the publisher earns from this online use.

Article 21.1 permits reproducing a lawfully accessible work, including a press publication or its fragments, to carry out text and data mining. Copies made for that purpose may be kept only as long as needed for the mining. A rights holder, including a press publisher, can prohibit this use by giving clear notice in an appropriate manner.

A prohibition on the online use of publicly accessible works must be given in machine-readable form, including through metadata, which is the opt-out an aggregator's automated indexing must honor. A separate, non-waivable exception at Article 21.2 covers a research organization or a cultural heritage institution mining lawfully accessible works for scientific research, without that opt-out.