--- title: "Latvia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/latvia/ source_html: /jurisdictions/latvia/index.html description: "Latvia data protection and privacy regulation: 10 categories, 51 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: bba39c5a90931c748083088871a49356da18526cbcd2d1a8273b818fceb92266 generator: "fe-fleet/md-twin@1.0" --- # Latvia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 51 claims · 40 sources in the cumulative register Download report (PDF) Expand all Latvia receives its first full ten-module structured-claims baseline this cycle, and a challenger-fold review has corrected two stale case-law characterisations while surfacing a confirmed national variance on children's consent age. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Algorithmic, Biometric & Surveillance Governance. Not fully checked this cycle: Sectoral Watch, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=LATVIA)[Build Report](/reports/?j=LATVIA)[Compare](/compare/?j=LATVIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Data State Inspectorate (Datu valsts inspekcija, DVI) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 51 Claims 10 Tier-1 sources Traffic-light mix 4 green 6 amber (sums to 10 rendered categories; click to filter) No red categories; 4 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Latvia is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Latvia’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,106 Full executive summary 284 ###### Latest update · 25 October 2026 #### Lead Signal Latvia's Data State Inspectorate fined SIA 4YOU MEBELES EUR 1,000 on 2 July 2026 following a cookie-compliance sweep that found unremedied consent deficiencies under Article 31, with the penalty issued under Article 83(5)(e) for insufficient cooperation with the authority under Article 58(1)(e) rather than for the underlying cookie breach itself. The penalty is modest in absolute terms, but it extends a visible pattern: the Inspectorate runs active, routine sweeps of adtech and cookie-consent practices and is prepared to penalise non-cooperation with its inspection process as a distinct violation from the substantive breach. #### Other Developments AI Act supervisory role. The Inspectorate's 2025 annual activity report designated it as Latvia's supervisory authority for personal data protection under the EU AI Act, with the Ministry of Environmental Protection and Regional Development coordinating overall implementation. The specific Latvian instrument or Cabinet decision formally conferring this role has not been independently located, so the designation is understood from the Inspectorate's own reporting rather than from the underlying legal instrument itself. This marks the clearest signal yet that algorithmic-governance oversight in Latvia will run, at least in part, through the existing data-protection supervisory structure rather than through a wholly separate body. #### Cross-Monitor Connections The AI Act supervisory designation connects directly to developments tracked under artificial-intelligence-focused oversight, where the question of which national body holds competence for AI-system supervision is a live one across the EU; Latvia's apparent answer, assigning the personal-data-protection dimension to its existing data authority, is a data point relevant to that wider mapping exercise. The cookie-enforcement pattern, meanwhile, touches commercial and advertising-technology practice in ways relevant to assessments of digital-advertising compliance posture more broadly, though no crypto-asset or financial-integrity nexus was identified in the evidence. #### Outlook The instrument formally designating the Inspectorate under the AI Act remains to be independently confirmed, and the full scope of its 2026 enforcement activity beyond the EUR 1,000 cookie fine was not comprehensively surveyed. Watch for the underlying Cabinet or legislative instrument on the AI Act role, and for whether the Inspectorate's cookie-sweep programme produces further enforcement outcomes at a similarly modest fine level or escalates where non-cooperation recurs. 3 earlier updates not shown here. ###### Standing brief · as of 5 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Latvia receives its first full ten-module structured-claims baseline this cycle, and a challenger-fold review has corrected two stale case-law characterisations while surfacing a confirmed national variance on children's consent age. The Court of Justice of the European Union's Case C-439/19, concerning Latvia's public register of road-traffic penalty points, was decided by the Grand Chamber on 2021-06-22: the Court ruled that GDPR precludes the Latvian legislation permitting public disclosure and re-use of that data under Article 10 GDPR. A second referral, Case C-175/20, concerning a Latvian tax authority's request that an internet-advertising service provider supply taxpayer data, is understood to have been decided on 2022-02-24, with the Court finding that GDPR does not in principle preclude such a request, subject to Article 5(1) GDPR necessity, proportionality and time-limitation safeguards. The same review indicates that Latvia's Personal Data Processing Law is understood to set the child-consent age for information-society services at 13 years, exercising the GDPR Article 8(1) member-state option to lower the default age of 16. #### Other Developments Latvia's Data State Inspectorate (DVI) is Latvia's Article 51 GDPR supervisory authority and an EDPB member, headquartered in Riga. The Personal Data Processing Law, endorsed by the Cabinet of Ministers on 2018-03-06, implements GDPR into Latvian national law and has been in force since 2018-07-05. GDPR Article 7 requires consent as a lawful basis to be freely given, informed, specific and unambiguous, with genuine withdrawal ability, and Latvia's data subject rights framework is governed by GDPR together with the Personal Data Processing Law of 21 June 2018, with GDPR Chapter III applying directly in Latvia as an EU Member State. DVI's enforcement record has escalated over successive years: the authority imposed a €7,000 administrative fine on an online retailer in 2019 under GDPR Article 83(5)(b) and (e) for failing to comply with an Article 17 erasure request and for non-cooperation with the regulator; it fined HH Invest SIA €15,000 in December 2020 for providing insufficient information to a data subject; and it fined Lursoft €65,000 in 2021 for unlawful processing of personal data. Latvia's Augstākā tiesa (Senāts) has referred a preliminary-ruling question, Case C-507/23, to the CJEU concerning Article 82(1) GDPR compensation for non-material damage, including whether an apology can constitute compensation. On the accountability side, the EDPB has adopted Opinion 6/2024 on DVI's draft list of processing operations exempt from the Article 35(5) GDPR DPIA requirement, and DVI published guidance on 3 June 2026 confirming that an international group of companies may appoint a single Data Protection Officer provided each entity can easily communicate with them, while each entity remains responsible for its own compliance decisions. Organisations in Latvia are understood to be required to notify DVI of a Data Protection Officer's appointment. Reports suggest no Latvia-specific derogation from the standard GDPR Chapter V cross-border transfer regime has been confirmed, with adequacy, SCCs, BCRs and derogations applying directly. In the adtech space, a DVI preventive audit found that none of 29 websites operated by 26 large e-merchants ensured appropriate cookie consent was obtained, with three traders found in significant violation and 23 required to remediate; DVI's cookie guide of April 2022 clarifies that personalised and analytical cookies require consent while technical and functional cookies necessary for website operation do not. DVI also assessed compliance with both GDPR and the Law on Information Society Services 2004 in a preventive check of e-merchant cookie practices, has published guidance for employers on processing employee personal data, and is understood to have issued clarification in March 2026 on the personal-data rules applicable to handling student test papers. Reports suggest the Latvian Parliament may have adopted amendments to the Law on Administrative Liability introducing new procedures for accessing subscriber data and updating fine structures, though the amendments' commencement date has not been confirmed. #### Cross-Monitor Connections Latvia's algorithmic, biometric and surveillance-governance module intersects with EU AI Act implementation; this cycle's research routes that intersection to the artificial-intelligence monitor for AI-Act-first analysis rather than duplicating it here. #### Outlook Whether Latvia has exercised the GDPR Article 9(4) option to impose further conditions on genetic, biometric or health data processing remains unconfirmed. The finalisation status of DVI's Article 35(5) DPIA-exemption list following the EDPB's opinion has not been established. The substantive terms and commencement date of the Law on Administrative Liability amendments remain to be verified. Read full brief · 1106 words Standing brief, as of 5 August 2026. #### Regulatory Status Latvia's Data State Inspectorate (DVI) is the Article 51 GDPR supervisory authority and an EDPB member. The Personal Data Processing Law has implemented GDPR into national law since it entered into force on 2018-07-05. A challenger-fold review confirmed that CJEU Case C-439/19 was decided by the Grand Chamber on 2021-06-22, ruling that GDPR precludes Latvia's public disclosure of road-traffic penalty-point data under Article 10 GDPR. A second CJEU case, C-175/20, is understood to have been decided on 2022-02-24, finding that GDPR does not in principle preclude a Latvian tax authority's request for taxpayer data from an internet-advertising provider, subject to Article 5(1) safeguards. Latvia is understood to have set the child-consent age for information-society services at 13 years under the GDPR Article 8(1) derogation, though this rests on tier-4 corroboration pending primary-statute verification. DVI's enforcement record has escalated markedly: a €7,000 fine in 2019 for an Article 17 erasure-request breach, a €15,000 fine against HH Invest SIA in December 2020, and a €65,000 fine against Lursoft in 2021 for unlawful processing. A pending CJEU reference, Case C-507/23, concerns Article 82(1) GDPR compensation for non-material damage, including whether an apology can constitute compensation. A DVI preventive audit found that none of 29 e-merchant websites ensured appropriate cookie consent, with three traders in significant violation and 23 required to remediate. DVI has also confirmed sectoral GDPR overlays in telecoms/eprivacy cookie enforcement and published employer guidance on employee data processing. #### Outlook Open items carried into the next cycle include Latvia's Article 9(4) derogation posture, the finalisation status of DVI's DPIA-exemption list, the commencement date of the Law on Administrative Liability amendments, and primary-statute confirmation of the child-consent-age derogation. Read full brief · 284 words Key regulatory facts for Latvia Regulatory Dimension Latvia Standing Position Jurisdiction Latvia (LV) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 51 sourced findings) Regulator & Framework GDPR is directly applicable and the national implementing Law plus an active, EDPB-recognised supervisory authority are confirmed; territorial/material scope questions are being actively clarified via CJEU referrals... Lawful Processing & Special Data Core consent rules track GDPR directly, but the special-categories sub-module carries live CJEU interpretive uncertainty and an unconfirmed Article 9(4) national-derogation status. Data Subject Rights Rights framework is confirmed via direct GDPR effect and evidenced through an actual DVI enforcement decision on the erasure right; deadline-specific and portability/restriction sub-modules lack Latvia-specific... Controller/Processor Duties DPO-related guidance is mature and consistent, but the DPIA-exemption list underpinning accountability_and_dpia was still in EDPB-reviewed draft form, and breach-notification, ROPA, joint-controller, security and... Primary Instruments Cited EDPB, OneTrust DataGuidance, EUR-Lex, noyb.eu, White & Case Last Confirmed / Updated 2026-10-25 (40 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Latvia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR is directly applicable and the national implementing Law plus an active, EDPB-recognised supervisory authority are confirmed; territorial/material scope questions are being actively clarified via CJEU referrals rather than left as gaps. Primary framework General Data Protection Regulation (EU) 2016/679, as implemented by the Personal Data Processing Law of 21 June 2018 Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Green GDPR is directly applicable and the national implementing Law plus an active, EDPB-recognised supervisory authority are confirmed; territorial/material scope questions are being actively clarified via CJEU referrals rather than left as gaps. #### Sub-modules (5) #### Regulator And AuthorityGreen DVI is confirmed as Latvia's Article 51 GDPR supervisory authority, listed on the EDPB member register with its Riga headquarters and its representative to the Board. Claims (4): - The Data State Inspectorate (DVI), located at Elijas Street 17, Riga, LV-1050, is Latvia's GDPR supervisory authority and EDPB member. - Datu valsts inspekcija (DVI) — The DVI is Latvia's independent national data-protection supervisory authority, resident in Riga. - Datu valsts inspekcija (DVI) — The Data State Inspectorate (DVI) is Latvia's national data-protection authority and is functionally independent. - DVI's 2026-2030 strategy sets deepening public understanding, responsible-innovation promotion, strengthened active supervision/risk management and organisational development as its priorities. #### Act And InstrumentsGreen The Personal Data Processing Law of 21 June 2018 implements the GDPR into Latvian national law, following Cabinet of Ministers endorsement of the implementing bill on 6 March 2018. Claims (4): - The Personal Data Processing Law of 21 June 2018 implements the GDPR into Latvian national law, following Cabinet of Ministers endorsement of the draft bill on 6 March 2018. - Personal Data Processing Law (Latvia) — Latvia's Personal Data Processing Law implements GDPR nationally and provides derogating provisions, including for use of the national identity code under GDPR Art 87. - The Personal Data Processing Law is Latvia's national GDPR-implementing statute, comprising nine chapters and 39 sections. - The Personal Data Processing Law applies as Latvia's national GDPR-implementing act, with pre-GDPR legislation fully repealed. #### Material ScopeGreen Material scope questions (e.g., obligations of internet-advertising service providers vis-à-vis tax-authority information requests) have reached the CJEU via a Latvian court referral, clarifying GDPR's material/temporal limits in a Latvian administrative-law context. Claims (1): - The CJEU received a preliminary-ruling request from Latvia's Administratīvā apgabaltiesa (Regional Administrative Court) concerning the material and temporal limits of GDPR obligations applicable to internet-advertising service providers responding to tax-authority information requests. #### Territorial ScopeAmber No Latvia-specific territorial-scope derogation or extension beyond GDPR Article 3 was identified in this research pass. #### Regulator Registration And FilingAmber No general processing-notification/filing regime was identified beyond GDPR's own framework; DPO-appointment notification to DVI is addressed under controller_processor_duties.dpo_requirements rather than here. Latvia's data-protection regime is anchored on the GDPR as directly-applicable EU law, implemented and supplemented domestically by the Personal Data Processing Law of 21 June 2018 (Fizisko personu datu apstrādes likums). The Data State Inspectorate (Datu valsts inspekcija, DVI), headquartered at Elijas Street 17, Riga LV-1050, is the Article 51 GDPR supervisory authority and sits as Latvia's representative on the EDPB. Material and territorial scope questions have been the subject of CJEU preliminary rulings originating from Latvian courts, including a referral from the Regional Administrative Court on the scope of GDPR obligations for internet-advertising service providers responding to tax-authority information requests. Periodic update · new data 2026-10-11 #### Regulator & Framework The Datu valsts inspekcija (DVI) remains Latvia's single national data-protection supervisory authority under the Personal Data Processing Law, an institutional position unrelated to the 2023 merger of the former financial and capital markets regulator into Latvijas Banka. DVI's regulatory remit has grown in scope through its role in Latvia's AI Act implementation: a Cabinet of Ministers regulation establishing the procedure for the AI Centre's organisation of a special regulatory sandbox and associated data processing was published in Latvijas Vēstnesis on 15 January 2026. That regulation requires DVI to issue a concluding opinion assessing a sandboxed AI system's compliance with personal-data-protection requirements and permits DVI to recommend protective measures where appropriate. This development places DVI at the intersection of two distinct regulatory frameworks, data protection proper and AI governance, within a single national instrument. The sandbox procedure is now in force, and the obligation it places on DVI is triggered on the operation of an AI system within the regulatory sandbox, rather than running on a fixed calendar schedule. #### Outlook The sandbox-opinion duty is a standing in-force obligation rather than a forward deadline; the item to watch is how DVI exercises this opinion function as applications enter the sandbox, and whether the Cabinet regulation's procedure is further elaborated or amended. No Latvia-specific EU Data Act implementing or designating instrument was located this cycle, leaving that an open gap in the broader sectoral-watch picture connected to this module. Sources and claims (9) - [EDPB](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) — The Data State Inspectorate (DVI), located at Elijas Street 17, Riga, LV-1050, is Latvia's GDPR supervisory authority and EDPB member. - [OneTrust DataGuidance](https://www.dataguidance.com/news/latvia-cabinet-ministers-endorses-draft-gdpr) — The Personal Data Processing Law of 21 June 2018 implements the GDPR into Latvian national law, following Cabinet of Ministers endorsement of the draft bill on 6 March 2018. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A62020CC0175) — The CJEU received a preliminary-ruling request from Latvia's Administratīvā apgabaltiesa (Regional Administrative Court) concerning the material and temporal limits of GDPR obligations applicable to internet-advertising service providers responding to tax-authority information requests. - [noyb.eu](https://noyb.eu/en/project/dpa/dvi-latvia) — Datu valsts inspekcija (DVI) — The DVI is Latvia's independent national data-protection supervisory authority, resident in Riga. - [White & Case](https://www.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-latvia) — Personal Data Processing Law (Latvia) — Latvia's Personal Data Processing Law implements GDPR nationally and provides derogating provisions, including for use of the national identity code under GDPR Art 87. - [noyb.eu](https://noyb.eu/en/project/dpa/dvi-latvia) — Datu valsts inspekcija (DVI) — The Data State Inspectorate (DVI) is Latvia's national data-protection authority and is functionally independent. - [noyb.eu](https://noyb.eu/en/project/dpa/dvi-latvia) — The Personal Data Processing Law is Latvia's national GDPR-implementing statute, comprising nine chapters and 39 sections. - [noyb.eu](https://noyb.eu/en/project/dpa/dvi-latvia) — DVI's 2026-2030 strategy sets deepening public understanding, responsible-innovation promotion, strengthened active supervision/risk management and organisational development as its priorities. - [White & Case](https://www.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-latvia) — The Personal Data Processing Law applies as Latvia's national GDPR-implementing act, with pre-GDPR legislation fully repealed. ### Latvia: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent rules track GDPR directly, but the special-categories sub-module carries live CJEU interpretive uncertainty and an unconfirmed Article 9(4) national-derogation status. Primary framework GDPR Articles 6, 7 and 9; Personal Data Processing Law of 21 June 2018 Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Amber Core consent rules track GDPR directly, but the special-categories sub-module carries live CJEU interpretive uncertainty and an unconfirmed Article 9(4) national-derogation status. D2 · Lawful Processing — Full Module Record 4 sub-modules · 74 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights framework is confirmed via direct GDPR effect and evidenced through an actual DVI enforcement decision on the erasure right; deadline-specific and portability/restriction sub-modules lack Latvia-specific confirmatory findings. Primary framework GDPR Chapter III (Articles 12-23); Personal Data Processing Law of 21 June 2018 Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Green Rights framework is confirmed via direct GDPR effect and evidenced through an actual DVI enforcement decision on the erasure right; deadline-specific and portability/restriction sub-modules lack Latvia-specific confirmatory findings. #### Sub-modules (5) #### Access RightGreen Access and other data-subject rights are governed by GDPR Chapter III together with the Personal Data Processing Law of 21 June 2018. Claims (2): - Latvia's data subject rights framework is governed by the GDPR together with the Personal Data Processing Law of 21 June 2018. - GDPR Chapter III, entitled 'Rights of the data subject', contains Articles 12 to 23, which apply directly in Latvia as an EU Member State. #### Rectification And ErasureGreen DVI has actively enforced the Article 17 erasure right, fining an online retailer for failing to execute an erasure request and for non-cooperation with the authority. Claims (1): - DVI imposed a €7,000 fine on an online retailer in 2019 for failing to comply with a data subject's Article 17 erasure request and for non-cooperation with the supervisory authority. #### Restriction And ObjectionAmber No Latvia-specific restriction/objection finding was identified beyond the general GDPR framework. #### Data PortabilityAmber No Latvia-specific portability finding was identified beyond the general GDPR framework. #### Deadlines And Response WindowsAmber No Latvia-specific variance from the GDPR's statutory response deadlines (Article 12(3)) was identified. Data subject rights in Latvia derive directly from GDPR Chapter III (Articles 12-23), supplemented by the Personal Data Processing Law. DVI's 2019 enforcement action against an online retailer for failure to execute an Article 17 erasure request and for non-cooperation under Article 58(2)(c) and (g) and Article 23 of the Personal Data Processing Law demonstrates the rights framework is operative and enforced. Periodic update · new data 2026-08-25 #### Data Subject Rights The Data State Inspectorate's enforcement action against SIA "Tet" is this cycle's principal data-subject-rights finding for Latvia. DVI imposed a EUR 1,200,000 fine against the internet-service-provider for disclosing unverified personal data, including data belonging to a minor, to debt-recovery services without first verifying the data subject's identity, in violation of GDPR Article 5(1)'s accuracy and lawfulness principles. This is rectification-and-erasure-adjacent in character: had the disclosed data been properly verified before disclosure, the inaccuracy, and the affected individual's status as a minor, would plausibly have been identified before the data reached a third party. The case is significant for several reasons beyond its size. First, it demonstrates that DVI treats pre-disclosure identity verification as a component of the lawfulness and accuracy obligations under GDPR Article 5(1), rather than as a separate, lower-stakes administrative step; the fine's basis was the disclosure of unverified data, not merely an unauthorised disclosure of accurate data. Second, the involvement of a minor's data elevates the case's severity within DVI's assessment. Third, debt-recovery disclosure is a specific, recurring risk vector for data-subject-rights violations: personal data transferred to third-party debt-recovery services is a common commercial practice across sectors, and Tet's failure to verify data before such a transfer is a cautionary pattern relevant to any controller engaging in similar third-party disclosures for debt-recovery or similar purposes. At EUR 1.2 million, the Tet fine sits well below the GDPR's statutory maximum of EUR 20,000,000 or 4 percent of worldwide annual turnover, whichever is higher, indicating that even DVI's most significant known case to date has been calibrated substantially under the available ceiling. It is worth situating this case within the broader taxonomy of data-subject-rights risk. The right to accuracy and the associated obligation on controllers to take reasonable steps to ensure data is not inaccurate before further processing or disclosure sits alongside, but is analytically distinct from, the right to erasure and the right to rectification proper; the Tet case's core failure was upstream of any data-subject request for rectification or erasure. This distinction matters for compliance purposes: a controller cannot rely solely on a functioning rectification-request process to discharge its Article 5(1) accuracy obligations, since that obligation applies proactively to the controller's own data-handling practices, independent of whether any data subject has exercised a formal rights request. The absence of any further data-subject-rights-specific finding for Latvia this cycle, beyond the Tet case, should be read against the backdrop of DVI's broader enforcement volume: 266 in-depth review proceedings and 143 identified violations across DVI's full docket in a recent reporting period represent a much larger population of matters than data-subject-rights cases specifically, and this cycle's evidence base isolates Tet as the identifiable data-subject-rights-specific case within that broader volume rather than indicating that no other data-subject-rights matters exist within DVI's docket. #### Outlook The clearest forward-looking test for this domain is whether DVI issues any further data-subject-rights enforcement action addressing pre-disclosure verification failures, particularly in debt-recovery or other third-party-disclosure contexts, which would establish the Tet case as the first instance of a now-settled enforcement pattern rather than a singular event. A secondary item to track is whether Tet or any similarly situated controller in Latvia updates its third-party-disclosure verification practices in response to this case, and whether any private civil claim follows from the affected data subjects independent of DVI's administrative fine; no such follow-on private action was evidenced this cycle. Sources and claims (3) - [OneTrust DataGuidance](https://www.dataguidance.com/notes/latvia-data-subject-rights) — Latvia's data subject rights framework is governed by the GDPR together with the Personal Data Processing Law of 21 June 2018. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62024CJ0484) — GDPR Chapter III, entitled 'Rights of the data subject', contains Articles 12 to 23, which apply directly in Latvia as an EU Member State. - [EDPB (republishing DVI press release)](https://www.edpb.europa.eu/news/national-news/2019/data-state-inspectorate-latvia-imposes-financial-penalty-7000-euros-against_en) — DVI imposed a €7,000 fine on an online retailer in 2019 for failing to comply with a data subject's Article 17 erasure request and for non-cooperation with the supervisory authority. ### Latvia: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ DPO-related guidance is mature and consistent, but the DPIA-exemption list underpinning accountability_and_dpia was still in EDPB-reviewed draft form, and breach-notification, ROPA, joint-controller, security and retention sub-modules lack confirmed Latvia-specific findings. Primary framework GDPR Articles 24-39; Personal Data Processing Law of 21 June 2018 Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Amber DPO-related guidance is mature and consistent, but the DPIA-exemption list underpinning accountability_and_dpia was still in EDPB-reviewed draft form, and breach-notification, ROPA, joint-controller, security and retention sub-modules lack confirmed Latvia-specific findings. Periodic update · new data 2026-09-28 #### Controller/Processor Duties In 2026 the DVI issued updated guidance permitting employees to record workplace meetings on a legitimate-interest basis, provided clear internal procedures are followed. This is an uncertain-confidence finding, drawn from a single Tier-3 source, and represents a shift in how the legitimate-interest lawful basis is being applied to an employee-initiated recording scenario rather than a controller-initiated one. Employers operating in Latvia should note that this guidance addresses recording by employees rather than by the employer itself, and the requirement for clear internal procedures suggests the DVI expects documented governance around the practice rather than an unconditional permission. Separately, the DVI retains its established statutory power to visit and inspect controllers' premises, including production facilities, warehouses, and other commercial or non-residential premises, in order to check compliance with Latvian data-protection law. This inspection power is a probable-confidence, standing feature of the DVI's regulatory toolkit rather than a new development this cycle, but it forms part of the same controller-facing compliance architecture that the 2026 workplace-recording guidance sits within. #### Outlook The item to watch is whether further DVI guidance clarifies the internal-procedure standard referenced in the 2026 workplace-recording guidance, and whether any enforcement action tests the legitimate-interest basis in this specific employee-recording context. Periodic update · new data 2026-08-25 #### Controller/Processor Duties Latvia's controller and processor duties saw two incremental clarifications from the Data State Inspectorate this cycle, both addressing recurring practical-compliance ambiguities rather than introducing new statutory obligations. First, 2026 DVI guidance clarifies that employees may record workplace meetings on a legitimate-interest basis, subject to internal policy safeguards. This resolves a common employment-context question by confirming legitimate interest as an available basis, conditioned on the employer having internal policy safeguards in place. This is the most recent identified controller-processor-duties development for Latvia, dated to 2026. Second, DVI's data-minimisation guidance for CCTV and video-surveillance systems establishes a practical retention norm: footage is generally expected to be limited to approximately 30 days absent strong, documented justification for longer retention. This is a guidance-level norm rather than a binding statutory retention period, and is accordingly assessed rather than confirmed in confidence, reflecting its status as regulatory expectation rather than codified law. Separately, but related, Latvia's CCTV regime does not require mandatory DVI registration of surveillance systems, but does require clear signage stating the surveillance purpose and providing controller contact information, a binding requirement. Read together, these two developments describe DVI's approach to controller-processor duties as one of targeted, sector- or context-specific guidance issued incrementally, rather than a single comprehensive controller-processor-duties framework document. The workplace-recording guidance addresses an employment-relations context; the CCTV guidance addresses a physical-security and surveillance context; both narrow practical uncertainty for controllers operating in those specific contexts without altering Latvia's underlying GDPR-based statutory obligations. The accountability dimension of both pieces of guidance is also worth noting: the workplace-recording guidance is explicitly conditioned on internal policy safeguards, which implies an accountability expectation that employers relying on employee legitimate-interest recording maintain a documented internal policy, even though the guidance does not appear to specify the precise content such a policy must contain. Similarly, the CCTV signage requirement functions as a transparency-and-accountability control, giving data subjects notice of surveillance and a contact point for further inquiry or rights exercise, even in the absence of a formal registration obligation. It is also useful to distinguish these two 2026 guidance items from the security-measures and retention-and-disposal sub-modules they respectively sit under: the CCTV signage requirement is a security-and-transparency measure, while the 30-day retention norm is a data-minimisation and retention-and-disposal matter, and controllers should treat compliance with one as distinct from, though related to, compliance with the other. #### Outlook The main open question for this domain is whether either piece of 2026 guidance is tested against an actual DVI enforcement action — for instance, an employer relying on the workplace-recording legitimate-interest basis without adequate internal policy safeguards, or a CCTV operator retaining footage well beyond the 30-day norm without documented justification. No such enforcement test was evidenced this cycle, and until one occurs, both pieces of guidance remain untested compliance expectations rather than confirmed enforcement standards. A further item worth monitoring is whether DVI extends the workplace-recording legitimate-interest logic to analogous contexts beyond meetings specifically, since the 2026 guidance as evidenced this cycle is specific to meetings and does not itself address those adjacent scenarios. D4 · Controller & Processor — Full Module Record 7 sub-modules · 65 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR Chapter V applies directly via EU membership; no Latvia-specific derogation, additional localisation mandate, or independent adequacy instrument was found, which is the expected baseline for an EU Member State. Primary framework GDPR Chapter V (Articles 44-49) Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Green Full GDPR Chapter V applies directly via EU membership; no Latvia-specific derogation, additional localisation mandate, or independent adequacy instrument was found, which is the expected baseline for an EU Member State. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy Regulation (EU) 2025/2518, which lays down additional procedural rules for the enforcement of the GDPR in cross-border cases, will apply from April 2027. This is a probable-confidence, forward-looking regulatory-horizon item rather than a currently operative rule, and it sits at the supranational EU level rather than being a Latvia-specific instrument. Its eventual application will affect how cross-border GDPR enforcement cases involving Latvian controllers or the DVI as lead or concerned supervisory authority are procedurally handled, though the specific mechanics of that change are not yet detailed in the evidence reaching this cycle. No Latvia-specific cross-border transfer or adequacy development beyond this EU-level procedural regulation was identified this cycle. #### Outlook The April 2027 application date is the fixed marker to track. As that date approaches, future cycles should watch for implementing guidance from the European Data Protection Board or the DVI clarifying how the new procedural rules will be applied in cross-border cases involving Latvia. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 44 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Telecoms/eprivacy and employment sub-modules are well evidenced via DVI enforcement/guidance; financial, health, credit-scoring and insurance sub-modules carry no confirmed Latvia-specific findings. Primary framework GDPR plus sector-specific instruments (Law on Information Society Services 2004, as amended) Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Amber Telecoms/eprivacy and employment sub-modules are well evidenced via DVI enforcement/guidance; financial, health, credit-scoring and insurance sub-modules carry no confirmed Latvia-specific findings. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 50 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/tracker enforcement and guidance are well evidenced and show active but imperfect compliance across the merchant sector; dark-patterns, opt-out-signal, clean-room and direct-marketing sub-modules lack confirmed Latvia-specific findings. Primary framework GDPR plus Law on Information Society Services 2004, as amended (ePrivacy transposition) Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Amber Cookie/tracker enforcement and guidance are well evidenced and show active but imperfect compliance across the merchant sector; dark-patterns, opt-out-signal, clean-room and direct-marketing sub-modules lack confirmed Latvia-specific findings. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy The Data State Inspectorate fined SIA 4YOU MEBELES EUR 1,000 following a cookie-compliance sweep conducted under its Article 31 inspection powers, which identified unremedied cookie-consent deficiencies. Notably, the penalty itself was issued under Article 83(5)(e) for insufficient cooperation with the supervisory authority, a violation of Article 58(1)(e), rather than for the underlying cookie-consent failure directly. This is a procedurally distinct enforcement route: the Inspectorate appears willing to penalise a controller's failure to cooperate with a sweep or follow-up inspection as its own violation, separate from whatever substantive remediation the sweep itself sought. The fine level, at EUR 1,000, sits at the lower end of the Inspectorate's recorded enforcement range and is consistent with its broader pattern of routine, modest cookie-related penalties rather than large-scale punitive action. This enforcement outcome sits within a wider programme of cookie and tracker sweeps that the Inspectorate runs as part of its active-supervision function. The target in this instance, a furniture retailer, suggests the sweep programme reaches beyond large digital-advertising intermediaries into ordinary commercial websites using standard cookie-consent tooling, indicating a reasonably broad net for this kind of routine compliance check rather than a sector-targeted campaign. #### Outlook Watch for whether further cookie-sweep outcomes in Latvia continue to attach primarily to non-cooperation under Article 58(1)(e) rather than to the underlying consent deficiency itself, which would indicate a settled enforcement technique, and for whether fine levels for such outcomes remain in the sub-EUR-2,000 range or escalate for repeat or larger-scale non-cooperation. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 49 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The GDPR baseline (Art 9, Art 22, Art 2(2)(d)) applies directly, but no Latvia-specific statutory overlay, DPA guidance, or enforcement action on profiling, ADM transparency, AI risk assessment, biometric regime, genetic data or surveillance carveouts was confirmed. Primary framework GDPR Articles 9, 22 and 2(2)(d) (no confirmed Latvia-specific overlay) Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Amber The GDPR baseline (Art 9, Art 22, Art 2(2)(d)) applies directly, but no Latvia-specific statutory overlay, DPA guidance, or enforcement action on profiling, ADM transparency, AI risk assessment, biometric regime, genetic data or surveillance carveouts was confirmed. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The Data State Inspectorate's 2025 annual activity report designated it as Latvia's supervisory authority for personal data protection under the EU AI Act, with the Ministry of Environmental Protection and Regional Development (VARAM) coordinating overall AI Act implementation nationally. This is the clearest signal available that Latvia intends to route the personal-data dimension of AI-system oversight through its existing data-protection regulator rather than establishing a wholly new supervisory body for that purpose, consistent with an approach several EU jurisdictions have taken of layering AI Act competence onto existing sectoral regulators rather than creating parallel structures. The specific Latvian legal instrument, whether a Cabinet decision, ministerial order or legislative amendment, that formally confers this supervisory role on the Inspectorate has not been independently located. The designation is understood at this point from the Inspectorate's own self-reporting in its annual activity report rather than from the underlying instrument, which means the precise scope of its AI Act competence, including which categories of AI system or which obligations under the Act fall within its remit as opposed to VARAM's general coordination function, has not been confirmed from a primary source. #### Outlook Watch for the formal instrument establishing or confirming the Inspectorate's AI Act supervisory role, which would clarify the precise boundary between its competence and VARAM's coordinating function, and for the Inspectorate's first substantive exercise of that role, whether through guidance, an investigation or an enforcement action concerning an AI system's personal-data processing. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 43 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The GDPR default age-of-consent rule applies by direct effect, but confirmation of any Latvia-specific lower threshold (permitted between 13 and 16) was not found; dependent-adults and minor-profiling-ban sub-modules carry no confirmed findings. Primary framework GDPR Article 8 (default age 16, absent confirmed national derogation) Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Amber The GDPR default age-of-consent rule applies by direct effect, but confirmation of any Latvia-specific lower threshold (permitted between 13 and 16) was not found; dependent-adults and minor-profiling-ban sub-modules carry no confirmed findings. D9 · Children's Privacy — Full Module Record 5 sub-modules · 69 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Latvia: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Multiple concrete enforcement decisions, an active CJEU reference on private compensation rights, and ongoing 2026 regulatory activity together demonstrate a functioning, actively-used enforcement and redress ecosystem. Primary framework GDPR Articles 58, 77-84; Personal Data Processing Law of 21 June 2018 Supervisory authority [Data State Inspectorate (Datu valsts inspekcija, DVI)](https://www.dvi.gov.lv/) Traffic-light rationale — Green Multiple concrete enforcement decisions, an active CJEU reference on private compensation rights, and ongoing 2026 regulatory activity together demonstrate a functioning, actively-used enforcement and redress ecosystem. Periodic update · new data 2026-09-28 #### Enforcement & Redress Latvia's enforcement environment shows material escalation this cycle. The Riga Regional Court has upheld the Data State Inspectorate's EUR 1.2 million fine against Tet, a significant Latvian telecommunications provider, for unlawfully disclosing unverified customer personal data to debt-recovery services. This judgment is now final and not subject to appeal, converting what was previously a contested fine into a settled, confirmed enforcement outcome. The finality of this decision is a confirmed-confidence finding drawn from Latvian public broadcasting reporting. Beyond this individual case, the DVI's own activity statistics for its latest reporting period show sustained enforcement volume: 266 in-depth review proceedings were initiated, 143 violations were identified within those reviews, and corrective measures were applied in 62 cases. The DVI also adopted seven administrative-offence decisions, five of which were fines for GDPR violations and two of which were penalties for failure to provide information to the DVI itself. These figures are probable-confidence findings drawn from a single Tier-3 source (Linklaters), and the exact date range of the reporting period they cover was not confirmable from the source excerpt reached this cycle, a gap that should be closed in a future cycle before the figures are treated as fully settled. The DVI additionally retains a statutory power to visit and inspect controllers' premises, including production facilities, warehouses and other commercial or non-residential premises, to check compliance with Latvian data-protection law. #### Outlook The item to watch is whether the volume of in-depth review proceedings this reporting period (266) converts into further administrative-offence decisions in the coming cycle, and whether a future source can confirm the exact reporting-period date range for these figures. The Tet judgment's finality removes any near-term appeal uncertainty from that specific case. Periodic update · new data 2026-08-25 #### Enforcement & Redress The Data State Inspectorate's enforcement and redress activity in Latvia shows a materially active, above-baseline enforcement programme this cycle, anchored by one headline case. DVI opened 266 in-depth review proceedings, identified 143 violations, applied corrective measures in 62 cases, and issued 7 administrative-offence decisions in a recent reporting period, of which 5 were GDPR fines and 2 concerned cooperation failures with DVI itself rather than substantive GDPR breaches. The headline case within this activity remains the SIA "Tet" fine of EUR 1,200,000, imposed for disclosing unverified personal data, including a minor's data, to debt-recovery services without prior identity verification, in violation of GDPR Article 5(1). This fine sits well below the GDPR's statutory maximum penalty of EUR 20,000,000 or 4 percent of worldwide annual turnover, whichever is higher. The gap between Tet's actual fine and the statutory ceiling is instructive: DVI's largest identified fine to date represents a small fraction of the maximum available penalty, suggesting a calibrated, proportionality-conscious fining practice even in its most significant known case. The proportion of DVI's enforcement outcomes is also analytically significant. Of 143 identified violations, corrective measures were applied in 62 cases, while only 7 proceeded to formal administrative-offence decisions. This indicates that DVI's default enforcement posture favours remediation over formal fining, reserving administrative-offence decisions, and by extension monetary fines, for a comparatively small subset of matters. This pattern suggests DVI's enforcement capacity is being deployed primarily toward correction and compliance-improvement rather than punitive deterrence, with fines functioning as an exception rather than the default response to an identified violation. DVI's decisions carry a defined judicial-review pathway: administrative-offence decisions are appealable first to the DVI Director and subsequently to the District (City) Court under the Administrative Violations Code. This establishes that DVI's enforcement decisions, including the Tet fine, are not administratively final but subject to a defined internal-then-judicial appeal route. No indication of whether Tet or any other sanctioned party has exercised this appeal route was available this cycle. It is also worth situating DVI's enforcement volume in context to the extent this cycle's evidence permits: 266 in-depth review proceedings in a single reporting period is a substantial docket, and the resulting 143-violation identification rate suggests DVI's review process is reasonably effective at surfacing genuine violations rather than functioning as a largely pro forma review exercise. No comparative figure from another jurisdiction is available within this cycle's evidence base, so this observation should be read as a description of Latvia's own docket composition rather than a comparative ranking. Finally, the 2-of-7 administrative-offence decisions concerning cooperation failures rather than substantive GDPR breaches is itself a distinct and separately notable finding: it indicates that DVI is willing to formally sanction non-cooperation with its own supervisory process as a distinct category of offence, independent of whatever substantive GDPR violation, if any, prompted the underlying inquiry. #### Outlook The most consequential open item for this domain is whether DVI's active 2026-2030 strategic emphasis on strengthened supervision translates into a materially higher rate of administrative-offence decisions relative to the 7-of-143 ratio observed in the most recent reporting period, which would signal a shift away from the remediation-favouring posture described above. A second item to track is whether the Tet decision, or any other DVI administrative-offence decision from this reporting period, is appealed to the District Court, which would be the first test of Latvia's GDPR judicial-redress pathway under this cycle's evidence base. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 106 words · 13 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties