--- title: "Lithuania Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/lithuania/ source_html: /jurisdictions/lithuania/index.html description: "Lithuania data protection and privacy regulation: 10 categories, 84 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-07T14:58:19Z content_sha256: 3b1834660abf93add581c338bb16e50955f34199908993be3927347ff6c42470 generator: "fe-fleet/md-twin@1.0" --- # Lithuania Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/lithuania/), [World Payments](https://payments.gi/jurisdictions/lithuania/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 84 claims · 49 sources in the cumulative register Download report (PDF) Expand all Lithuania's data-protection enforcement cadence is escalating even as the underlying legal framework remains stable. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Children & Vulnerable Groups, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=LITHUANIA)[Build Report](/reports/?j=LITHUANIA)[Compare](/compare/?j=LITHUANIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority State Data Protection Inspectorate (VDAI) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 84 Claims 13 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No red categories; 12 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Lithuania is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Lithuania’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 747 Full executive summary 422 ###### Latest update · 4 November 2026 #### Lead Signal Lithuania's data-protection record moves on a procedural rather than structural axis. The State Data Protection Inspectorate (VDAI) is understood to have issued guidance, reported 28 October 2026, intended to help data controllers assess more consistently and objectively the risk a personal-data breach poses to individuals' rights and freedoms, bearing on the notification decisions required under Articles 33 and 34 of the General Data Protection Regulation. This is non-binding guidance rather than a new legal obligation, and the finding rests on a single secondary report rather than on VDAI's own publication, so it is rendered here in qualified rather than assertive terms. #### Other Developments Enforcement cadence reported as active and escalating. Secondary monitoring describes VDAI as having continued an active, escalating enforcement cadence across healthcare, direct marketing and education, against a backdrop that includes the European Data Protection Board's Guidelines 04/2026 on the choice between a fine and a reprimand, adopted 17 September 2026 and understood to have been announced domestically by VDAI on 24 September 2026. Because this account comes from a secondary aggregator describing a cadence rather than a single dated decision, and the underlying VDAI decisions were not independently retrieved, it is reported here on a hedged basis: reports suggest this pattern of activity rather than confirming any specific enforcement outcome. #### Cross-Monitor Connections No cross-monitor connections are drawn; the two items in scope are domestic procedural and enforcement-cadence matters without an evidenced link to sanctions, conflict-finance, commodity-flow or information-operations monitoring. #### Outlook The breach-risk-assessment guidance is a methodology refinement that controllers operating in Lithuania will need to weigh against their existing Article 33/34 notification practice once the full text becomes available; at present only a secondary-press summary has been retrieved, leaving the guidance's precise scope unconfirmed. On enforcement, whether the reported cadence across healthcare, direct marketing and education translates into individually dated, publicly attributable VDAI decisions is the open item to watch, alongside how VDAI's domestic application of the EDPB's fine-versus-reprimand guidelines develops in individual cases. 4 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Lithuania's data-protection enforcement cadence is escalating even as the underlying legal framework remains stable. The State Data Protection Inspectorate's record EUR 2,385,276 fine against Vinted UAB, imposed in July 2024 for transparency and accountability violations including deficient handling of erasure requests and undisclosed shadow banning, was upheld by the Regional Administrative Court in May 2025. That confirmation on appeal removes the uncertainty that typically attaches to a first-instance fine and establishes the decision as a settled benchmark for how the VDAI expects controllers to handle data-subject erasure requests and transparency obligations going forward. #### Other Developments Breach reporting patterns. The VDAI's H1 2026 report identifies human error as the cause of 48 percent of reported personal data breaches in Lithuania, a finding that points controllers toward process and training gaps as the dominant breach vector rather than external attack or technical failure. Breach-notification duty confirmed. Data controllers in Lithuania must notify the VDAI of personal data breaches within 72 hours, a standing GDPR-derived duty that continues to anchor the controller/processor compliance baseline. Cross-border transfer mechanics clarified. The VDAI has clarified that Standard Contractual Clauses are optional in nature and apply specifically to data controller-processor relationships, a clarification assessed with moderate confidence from a single guidance source rather than a binding regulatory instrument. #### Cross-Monitor Connections The erasure-handling and shadow-banning findings underlying the Vinted decision touch consumer-facing digital-platform practices that may also be of interest to the artificial-intelligence monitor to the extent algorithmic ranking or account-visibility decisions were implicated, though that algorithmic dimension is not re-analysed here. The forthcoming EU cross-border GDPR enforcement cooperation regulation, applicable from April 2027, is a structural development relevant to any monitor tracking EU-level regulatory-cooperation architecture, including financial-integrity's own tracking of the parallel AMLA supervisory-cooperation build-out; the two are separate instruments but part of the same broader EU trend toward centralised, cooperative enforcement mechanisms. #### Outlook Watch for further decisions applying the erasure-handling and transparency standard established by the Vinted case, and for whether the human-error-driven breach pattern identified in the H1 2026 report prompts any enforcement or guidance response from the VDAI. The EU cross-border GDPR enforcement cooperation regulation, applicable from April 2027, remains a multi-year horizon item rather than a near-term operational change, but its eventual application will alter how VDAI cooperates with counterpart authorities on cross-border cases. Read full brief · 747 words ###### Latest update · 25 October 2026 #### Regulatory Status Lithuania's data-protection regulatory environment this period is defined by the State Data Protection Inspectorate's (VDAI) publication, on 30 September 2026, of a summary of significant 2025 court decisions in administrative cases arising from complaints it handled. The summary covers rulings from the Supreme Administrative Court (LVAT) and the Regional Administrative Court on three distinct issues: the scope of VDAI's discretion in choosing corrective measures once a violation is found, the lawfulness of video surveillance, and the lawfulness of processing carried out to comply with a legal obligation or to collect service fees. The individual rulings within the summary were not itemised in the material reaching this review, so the precise substantive standards applied by the courts on each issue are not yet confirmed. This active appellate-review record sits alongside VDAI's standing enforcement history, including decision 3R-490 of 23 March 2026, in which a cloud-software provider was found in violation of GDPR Article 32 for a ransomware-vulnerability security failure, with an initial severity-based calculation of EUR1,500,000 ultimately reduced to a final fine of EUR4,500. Together these indicate a Lithuanian data-protection enforcement environment under active judicial scrutiny of the Inspectorate's exercise of discretion, rather than one in which VDAI's enforcement choices go unreviewed. #### Outlook Further detail on the individual 2025 court rulings summarised by VDAI would clarify the specific standards now governing corrective-measure discretion, video-surveillance lawfulness, and legal-obligation or service-fee-based processing in Lithuania. That detail is not yet available from this period's review. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Lithuania's data-protection framework remains anchored in GDPR with the VDAI as supervisory authority, but this cycle is defined by an escalating enforcement cadence rather than framework change. The Regional Administrative Court's May 2025 confirmation of the VDAI's EUR 2,385,276 fine against Vinted UAB, for transparency violations including deficient erasure-request handling, establishes a settled enforcement benchmark. The 72-hour breach-notification duty for controllers remains confirmed and operative, while the VDAI's H1 2026 breach report identifies human error as the cause of 48 percent of reported breaches. On cross-border transfers, the VDAI has clarified that SCCs are optional and specific to controller-processor relationships, and a new EU cross-border enforcement cooperation regulation will apply from April 2027. #### Outlook Watch for further enforcement decisions building on the Vinted erasure-handling standard, for any guidance response to the human-error breach pattern, and for preparatory developments ahead of the April 2027 cross-border enforcement cooperation regulation's application. Read full brief · 422 words Key regulatory facts for Lithuania Regulatory Dimension Lithuania Standing Position Jurisdiction Lithuania (LT) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 84 sourced findings) Regulator & Framework Comprehensive, mature GDPR-aligned framework with an active, EDPB-participating supervisory authority and no material derogation gaps identified. Lawful Processing & Special Data No national derogation weakening GDPR standards identified; VDAI enforcement activity on biometric data confirms an active special-categories regime. Data Subject Rights Rights framework is directly GDPR-derived and actively enforced; no LT-specific narrowing identified. Controller/Processor Duties Core duties are directly GDPR-derived and actively supervised; retention/disposal sub-module lacks a confirmed LT-specific instrument. Primary Instruments Cited EDPB, DataGuidance, EUR-Lex, Linklaters, VitalLaw / Wolters Kluwer Cybersecurity Policy Report Last Confirmed / Updated 2026-11-04 (49 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Lithuania: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, mature GDPR-aligned framework with an active, EDPB-participating supervisory authority and no material derogation gaps identified. Primary framework General Data Protection Regulation (EU) 2016/679, as implemented by Law No XIII-1426 of 30 June 2018 amending Law No I-1374 (Law on Legal Protection of Personal Data) Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Green Comprehensive, mature GDPR-aligned framework with an active, EDPB-participating supervisory authority and no material derogation gaps identified. #### Sub-modules (5) #### Regulator And AuthorityGreen VDAI is the single national supervisory authority under GDPR Art. 51, participating in the EDPB. Claims (4): - The State Data Protection Inspectorate, located at L. Sapiegos str. 17, 10312 Vilnius, Lithuania, is listed as the national supervisory authority with contact reachable via ada@ada.lt. - State Data Protection Inspectorate (VDAI) — Lithuania's supervisory authority under GDPR, with the Inspector of Journalist Ethics holding concurrent jurisdiction over journalistic-purpose processing - The VDAI is Lithuania's single national data-protection supervisory authority. - State Data Protection Inspectorate (VDAI) — VDAI, an independent body located in Vilnius, is Lithuania's primary competent supervisory authority for GDPR, with the Inspector of Journalist Ethics holding concurrent jurisdiction over press-related processing. #### Act And InstrumentsGreen GDPR is directly applicable; national implementation is via Law No XIII-1426/2018 amending the Law on Legal Protection of Personal Data. Claims (2): - Lithuania implemented the GDPR through Law No XIII-1426 of 30 June 2018 amending Law No I-1374, together with the General Data Protection Regulation (Regulation (EU) 2016/679). - Law on Legal Protection of Personal Data (No. I-1374) — Fills GDPR derogation spaces including personal-code (ID number) processing, employment-context rules, journalistic/artistic exemptions and public-sector fine procedures. #### Material ScopeGreen Material scope follows GDPR: covers processing by private-sector and most public-sector bodies. Claims (1): - The GDPR ensures protection of natural persons where their data is processed by the private sector and by most public-sector entities. #### Territorial ScopeGreen GDPR extraterritorial reach applies: non-EU established entities offering goods/services to, or monitoring, Lithuania-based data subjects are in scope. Claims (1): - Non-EU established companies must apply the same GDPR rules with regard to the offering of goods or services and the monitoring of the behaviour of persons living in the EU. #### Regulator Registration And FilingAmber No general notification regime; controllers/processors must communicate DPO contact details to VDAI where a DPO is appointed. Claims (1): - Article 37 GDPR obliges controllers and processors meeting DPO thresholds to designate a DPO, publish the DPO's contact details, and communicate them to the relevant supervisory authority. Lithuania is an EU Member State fully subject to the GDPR, supervised by the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, 'VDAI'), and implementing GDPR via a national amending law to the pre-existing Law on Legal Protection of Personal Data. Sources and claims (9) - [EDPB](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) — The State Data Protection Inspectorate, located at L. Sapiegos str. 17, 10312 Vilnius, Lithuania, is listed as the national supervisory authority with contact reachable via ada@ada.lt. - [DataGuidance](https://www.dataguidance.com/jurisdictions/lithuania) — Lithuania implemented the GDPR through Law No XIII-1426 of 30 June 2018 amending Law No I-1374, together with the General Data Protection Regulation (Regulation (EU) 2016/679). - [EUR-Lex](https://eur-lex.europa.eu/LT/legal-content/summary/general-data-protection-regulation-gdpr.html) — The GDPR ensures protection of natural persons where their data is processed by the private sector and by most public-sector entities. - [EUR-Lex](https://eur-lex.europa.eu/LT/legal-content/summary/general-data-protection-regulation-gdpr.html) — Non-EU established companies must apply the same GDPR rules with regard to the offering of goods or services and the monitoring of the behaviour of persons living in the EU. - [DataGuidance](https://www.dataguidance.com/jurisdictions/lithuania) — Article 37 GDPR obliges controllers and processors meeting DPO thresholds to designate a DPO, publish the DPO's contact details, and communicate them to the relevant supervisory authority. - [Linklaters](https://www.linklaters.com/en/insights/data-protected/data-protected---lithuania) — State Data Protection Inspectorate (VDAI) — Lithuania's supervisory authority under GDPR, with the Inspector of Journalist Ethics holding concurrent jurisdiction over journalistic-purpose processing - [VitalLaw / Wolters Kluwer Cybersecurity Policy Report](https://www.vitallaw.com/news/recommendations-on-data-breach-risk-assessment-released-in-lithuania/cspd01bc243d3eae7b43078208db73eb67b77a) — The VDAI is Lithuania's single national data-protection supervisory authority. - [European Union](https://eur-lex.europa.eu/eli/reg/2016/679/oj) — State Data Protection Inspectorate (VDAI) — VDAI, an independent body located in Vilnius, is Lithuania's primary competent supervisory authority for GDPR, with the Inspector of Journalist Ethics holding concurrent jurisdiction over press-related processing. - [European Union](https://eur-lex.europa.eu/eli/reg/2016/679/oj) — Law on Legal Protection of Personal Data (No. I-1374) — Fills GDPR derogation spaces including personal-code (ID number) processing, employment-context rules, journalistic/artistic exemptions and public-sector fine procedures. ### Lithuania: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ No national derogation weakening GDPR standards identified; VDAI enforcement activity on biometric data confirms an active special-categories regime. Primary framework GDPR Arts. 6, 7, 9, 10; Law No XIII-1426/2018 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Green No national derogation weakening GDPR standards identified; VDAI enforcement activity on biometric data confirms an active special-categories regime. D2 · Lawful Processing — Full Module Record 4 sub-modules · 28 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Rights framework is directly GDPR-derived and actively enforced; no LT-specific narrowing identified. Primary framework GDPR Arts. 12-22 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Green Rights framework is directly GDPR-derived and actively enforced; no LT-specific narrowing identified. #### Sub-modules (5) #### Access RightAmber VDAI found Vinted failed to properly evidence action taken on access requests. Claims (2): - The Lithuanian SA found that the company also failed to demonstrate that it had taken or refused to act in accordance with the applicant's request for the right of access. - VDAI — Published procedure confirms data subjects may exercise GDPR rights via written request to the Inspectorate, with appeal to the Vilnius Regional Administrative Court against adverse decisions. #### Rectification And ErasureAmber VDAI enforcement covers both erasure-request handling (Vinted) and data-accuracy/rectification duties (Vilnius Municipality). Claims (2): - Lithuanian SA found the company, in response to erasure requests, stated it would not act on a specific request because the applicant did not identify a specific reason under Article 17(1) GDPR and failed to identify all purposes of continued processing. - A fine was imposed for infringements of Articles 5(1)(d) and 5(1)(f) GDPR for failure to implement appropriate technical and organisational measures ensuring accuracy of processed personal data. #### Restriction And ObjectionGreen GDPR Art. 18 restriction regime applies directly; no LT derogation found. Claims (1): - Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or important public interest. #### Data PortabilityGreen Standard Art. 20 portability right applies without LT-specific modification. Claims (1): - Data subjects have easier access to their data and a right to data portability, allowing personal data to be transferred more easily between service providers. #### Deadlines And Response WindowsGreen Controllers must respond within the GDPR's one-month (extendable by two months) statutory deadline. Claims (1): - Article 12(3) of the GDPR provides that organizations need to respond to data subject requests without undue delay and in any event within one month of receipt of the request. Data subject rights follow GDPR Arts. 15-22 directly. VDAI enforcement against Vinted (access/erasure) and against Vilnius Municipality (accuracy/rectification) demonstrates active application of these rights domestically. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (7) - [EDPB / VDAI](https://www.edpb.europa.eu/news/news/2024/lithuanian-sa-fine-eu-2-385-276-vinted-uab-company_en) — The Lithuanian SA found that the company also failed to demonstrate that it had taken or refused to act in accordance with the applicant's request for the right of access. - [EDPB / VDAI](https://www.edpb.europa.eu/news/news/2024/lithuanian-sa-fine-eu-2-385-276-vinted-uab-company_en) — Lithuanian SA found the company, in response to erasure requests, stated it would not act on a specific request because the applicant did not identify a specific reason under Article 17(1) GDPR and failed to identify all purposes of continued processing. - [EDPB / VDAI](https://www.edpb.europa.eu/news/national-news/2020/lithuanian-dpa-imposes-fine-improperly-processed-personal-data-parents_en) — A fine was imposed for infringements of Articles 5(1)(d) and 5(1)(f) GDPR for failure to implement appropriate technical and organisational measures ensuring accuracy of processed personal data. - [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) — Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or important public interest. - [EUR-Lex](https://eur-lex.europa.eu/LT/legal-content/summary/general-data-protection-regulation-gdpr.html) — Data subjects have easier access to their data and a right to data portability, allowing personal data to be transferred more easily between service providers. - [IAPP](https://iapp.org/news/a/why-these-dpas-are-wrong-about-limiting-dsr-extensions) — Article 12(3) of the GDPR provides that organizations need to respond to data subject requests without undue delay and in any event within one month of receipt of the request. - [dataprotection.gi](https://dataprotection.gi/jurisdictions/lithuania/) — VDAI — Published procedure confirms data subjects may exercise GDPR rights via written request to the Inspectorate, with appeal to the Vilnius Regional Administrative Court against adverse decisions. ### Lithuania: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core duties are directly GDPR-derived and actively supervised; retention/disposal sub-module lacks a confirmed LT-specific instrument. Primary framework GDPR Arts. 5, 24-39 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Green Core duties are directly GDPR-derived and actively supervised; retention/disposal sub-module lacks a confirmed LT-specific instrument. Periodic update · new data 2026-11-04 #### Controller/Processor Duties The State Data Protection Inspectorate is understood to have issued guidance, reported 28 October 2026, aimed at helping data controllers in Lithuania assess more consistently and objectively the risk a personal-data breach poses to the rights and freedoms of individuals. The stated purpose of the guidance is to support controllers in determining whether a breach meets the threshold for notification to VDAI itself and, separately, to affected data subjects, under the framework set out in Articles 33 and 34 of the General Data Protection Regulation. Framed this way, the guidance addresses a long-standing practical difficulty for controllers: the GDPR sets a risk-based notification threshold without prescribing a single assessment methodology, leaving considerable room for inconsistent practice across sectors and organisation sizes. This finding is carried at a qualified level of confidence. It is sourced from a secondary legal-publishing report rather than from VDAI's own published guidance document, and the full text and scope of the recommendations have not been independently retrieved. What can be said is that a national regulator in Lithuania has moved to standardise breach-risk assessment methodology; what cannot yet be said with the same confidence is the precise content, legal status beyond non-binding guidance, or scope of application the recommendations carry. Controllers and processors operating in Lithuania should treat this as guidance under development in the public record rather than as a settled interpretive instrument, pending access to VDAI's primary publication. No other controller or processor obligation development specific to Lithuania was located. The guidance sits within an otherwise stable domestic framework: it refines existing notification practice rather than introducing a new duty, and nothing in the record suggests any change to the underlying Article 33/34 obligations themselves, which remain those set by the directly applicable Regulation. #### Outlook The principal open item is simply whether the full guidance document becomes available for review, which would allow a firmer account of the methodology VDAI is recommending and the specific factors it directs controllers to weigh. Until then, the practical effect for controllers operating in Lithuania is best understood as an invitation to revisit their existing breach-risk assessment practice against a forthcoming or newly issued regulatory expectation, rather than as a change to the notification threshold itself. Periodic update · new data 2026-10-18 #### Controller/Processor Duties VDAI fined UAB InMedica EUR 450,000 for breach-reporting and data-security failures this cycle, one of the more substantial controller-processor-duties penalties recorded for Lithuania. The failures are understood from secondary reporting to concern obligations typically associated with security-of-processing and breach-notification duties, though the exact decision date and the precise GDPR article basis have not been independently confirmed beyond the secondary report relied on this cycle, and should be read with that limitation in mind. In parallel, secondary reporting attributes to VDAI's own H1 2026 breach report a finding that human error accounted for 48 percent of reported personal-data breaches during the period. VDAI's own report was not independently retrieved this cycle; this figure rests on a Tier-4 aggregator source and should be treated as probable rather than confirmed. If accurate, it indicates that the plurality of breach causation in Lithuania during the first half of 2026 was attributable to human error rather than to external attack or system failure, which is relevant context for how controllers should be prioritising their internal control and training investments, though this report does not offer compliance instruction on that point. Taken together, the InMedica fine and the breach-causation statistic point to a Lithuanian enforcement environment where breach-reporting and security-of-processing failures, including those rooted in human error, are drawing direct regulatory attention and material financial penalties. #### Outlook Independent retrieval of VDAI's own H1 2026 breach report, not accessed this cycle, would allow the 48 percent human-error figure to be confirmed directly rather than through secondary aggregation. The scale of the InMedica fine suggests breach-reporting and security-of-processing failures remain a priority enforcement area for VDAI. Periodic update · new data 2026-10-04 #### Controller/Processor Duties VDAI's own published breach statistics for H1 2026 found human error to be the leading cause of personal-data breaches reported in Lithuania during that period, accounting for 48% of reported incidents. As VDAI's own data, this is an assertive finding rather than a third-party estimate, and it provides a quantified baseline against which Lithuania's controller population's operational practices can be measured going forward. The standing duty underlying all breach reporting remains in force: data controllers in Lithuania must notify VDAI of personal-data breaches within 72 hours, a duty derived from Article 33 of the GDPR. This 72-hour notification duty is the procedural backbone against which VDAI's human-error finding should be read; a high proportion of human-error-caused breaches implies that controllers' internal detection and escalation processes, which feed into whether the 72-hour clock is met, are an area of continuing operational risk. A separate company was fined on 2 July 2026 over incident-reporting and data-security weaknesses, understood to connect the Article 33 notification duty directly to enforcement consequence where a controller's reporting or security practices fall short. The combination of VDAI's own statistical finding and a concrete enforcement action over reporting and security weaknesses in the same period indicates that breach-notification compliance is an active area of VDAI supervisory attention, not a dormant procedural requirement. #### Outlook Whether VDAI's H1 2026 human-error finding prompts new controller-facing guidance on breach-prevention measures, such as mandatory staff training benchmarks or technical control requirements aimed at reducing human-error-caused incidents, has not yet been established and is the item to watch arising from this finding. D4 · Controller & Processor — Full Module Record 7 sub-modules · 47 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is sound (GDPR Chapter V) but LT-specific TIA practice and confirmation of any localisation rules could not be fully verified in this pass. Primary framework GDPR Arts. 44-49 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Amber Framework is sound (GDPR Chapter V) but LT-specific TIA practice and confirmation of any localisation rules could not be fully verified in this pass. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 48 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core sectors (telecoms, employment, health, credit) are covered by guidance or investigation; education and insurance sub-modules show a coverage gap. Primary framework GDPR; Law on Electronic Communications No. IX-2135 (as amended); Civil Service Law Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Amber Core sectors (telecoms, employment, health, credit) are covered by guidance or investigation; education and insurance sub-modules show a coverage gap. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 41 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie and direct-marketing rules are covered; opt-out-signal and clean-room concepts are not applicable/found under the EU framework. Primary framework GDPR; ePrivacy Directive 2002/58/EC as transposed via Law on Electronic Communications No. IX-2135 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Amber Cookie and direct-marketing rules are covered; opt-out-signal and clean-room concepts are not applicable/found under the EU framework. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 37 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric/genetic governance is documented; ADM-transparency and state-surveillance-carveout sub-modules rely on general GDPR text without LT-specific enforcement examples. Primary framework GDPR Arts. 9, 22, 35; VDAI DPIA Order of 14 March 2019 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Amber Biometric/genetic governance is documented; ADM-transparency and state-surveillance-carveout sub-modules rely on general GDPR text without LT-specific enforcement examples. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 42 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core Art. 8 framework applies but the exact Lithuanian national age-of-consent derogation (if any) could not be confirmed; education-settings and dependent-adults sub-modules lack dedicated LT instruments. Primary framework GDPR Art. 8 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Amber Core Art. 8 framework applies but the exact Lithuanian national age-of-consent derogation (if any) could not be confirmed; education-settings and dependent-adults sub-modules lack dedicated LT instruments. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups VDAI dismissed a parental complaint concerning a school attendance-tracking system in Decisions No. 3R-677 and 3R-676 of 15 April 2026. The regulator found that the municipality's processing of student location or attendance data through the tracking system was grounded in a legal processing obligation, and that this legal basis was not overridden by the parental objection raised in the complaint. This decision sits within a broader batch of eleven VDAI decisions issued around May 2026 addressing access-right-adjacent disputes, in which, according to secondary reporting, no fines were imposed in any of the eleven cases. The significance of this decision for the children-and-vulnerable-groups module lies in VDAI's confirmation that a municipality's legal processing obligation can, in an appropriate case, take precedence over a parental objection to a student-tracking system, rather than the objection automatically prevailing because the data subject is a minor. This is a data-point on how VDAI balances parental rights against institutional legal obligations in an education-sector processing context, without establishing a broader rule about student-tracking systems generally. #### Outlook No further children-or-vulnerable-groups-specific enforcement or guidance development for Lithuania was identified this cycle beyond the school-tracking-system decision. Whether this dismissal pattern extends to other parental complaints in the same May 2026 batch, all apparently resolved without fines, is relevant context for understanding VDAI's current approach to this category of complaint. D9 · Children's Privacy — Full Module Record 5 sub-modules · 55 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Lithuania: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Enforcement powers and recent activity are well evidenced; funding/capacity and collective-redress sub-modules lack confirmed LT-specific detail. Primary framework GDPR Arts. 58, 77-84 Supervisory authority [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/) Traffic-light rationale — Green Enforcement powers and recent activity are well evidenced; funding/capacity and collective-redress sub-modules lack confirmed LT-specific detail. Periodic update · new data 2026-11-04 #### Enforcement & Redress Secondary monitoring reports suggest VDAI has continued an active and escalating enforcement cadence this period, with activity spanning the healthcare, direct marketing and education sectors. This account is attributed to a secondary aggregator rather than to individually retrieved VDAI decisions, so it is reported here in hedged terms: the pattern described is one of sustained regulatory attention across these three sectors, not a confirmed set of specific fines, reprimands or corrective orders with dates and amounts attached. No individually dated VDAI enforcement action within the current window has been independently confirmed. This reported cadence sits against a specific piece of standing guidance from the European level: the European Data Protection Board's Guidelines 04/2026 address the choice between imposing a fine and issuing a reprimand, were adopted on 17 September 2026, and are understood to have been announced domestically by VDAI on 24 September 2026. The timing places VDAI's domestic enforcement activity in the period immediately following its own announcement of this European guidance, which is analytically suggestive of a regulator recalibrating its enforcement-tool choice in light of newly adopted European-level direction, though the record available does not permit a firm statement that any specific case applied the Guidelines 04/2026 framework. The sectoral spread reported — healthcare, direct marketing and education — is consistent with sectors that generate recurring data-protection complaint volume in many jurisdictions, and its appearance here as a described cadence rather than as named cases means the current record supports a statement about the shape of VDAI's attention rather than about any individual enforcement outcome's severity or legal reasoning. #### Outlook The principal item to watch is whether the described cadence resolves into individually dated and publicly attributable decisions, which would allow the current hedged account to be replaced with specific case detail. A secondary item is how VDAI applies the EDPB's fine-versus-reprimand guidelines in practice once concrete decisions citing that framework become available, since the domestic announcement of the Guidelines on 24 September 2026 sets up an expectation that subsequent enforcement choices will visibly reflect it. Periodic update · new data 2026-10-25 #### Enforcement & Redress The State Data Protection Inspectorate (VDAI) published, on 30 September 2026, a summary of significant 2025 court decisions in administrative cases arising from complaints it handled. The summary draws on rulings from the Supreme Administrative Court (LVAT) and the Regional Administrative Court, and covers three distinct reviewed issues: the scope of the Inspectorate's discretion in choosing which corrective measure to apply once a violation is found, the lawfulness of video surveillance, and the lawfulness of processing carried out to comply with a legal obligation or to collect service fees. The summary itself, rather than the individual rulings it describes, is the confirmed development this period; the specific holdings on each of the three issues were not itemised in the material reaching this review, so the precise substantive standards the courts applied cannot yet be stated with confidence. The existence of this summary is nonetheless a meaningful signal about the character of Lithuania's data-protection enforcement environment. It indicates that VDAI's enforcement decisions, including its choice of corrective measure once it finds a violation, are subject to active appellate-court review rather than being accepted without challenge. This sits alongside a standing, separately-sourced example of VDAI's enforcement record: decision 3R-490, dated 23 March 2026, in which VDAI found a cloud-software provider in violation of Article 32 of the GDPR for a ransomware-vulnerability security failure. That fine was calculated starting from a severity-based 15 percent of the Article 32 statutory maximum, an initial figure of EUR1,500,000, before being reduced to a final sum of EUR4,500. This decision is carried as standing background context rather than as a new development this period, but it illustrates the scale of discretion VDAI exercises in moving from an initial statutory-maximum-based calculation to a final fine figure, which is directly relevant to understanding why the discretion exercised in choosing corrective measures is now the subject of active judicial review as reflected in the 2025 court-decisions summary. Taken together, the active appellate-review record on corrective-measure discretion and video-surveillance lawfulness, alongside VDAI's demonstrated willingness to apply a large discount between an initial statutory-maximum-based calculation and a final fine figure, indicates an enforcement environment under ongoing judicial scrutiny of the Inspectorate's discretion rather than one operating free of appellate check. #### Outlook A closer reading of the underlying LVAT and Regional Administrative Court decisions summarised by VDAI on 30 September 2026 would clarify the specific standards now governing corrective-measure discretion, video-surveillance lawfulness, and legal-obligation or service-fee-based processing in Lithuania. Until that detail becomes available, the enforcement and redress picture in Lithuania should be read as one of active, multi-stranded judicial review of VDAI's discretion, without yet being able to state the precise substantive standard the courts have settled on for any of the three reviewed issues. Periodic update · new data 2026-10-18 #### Enforcement & Redress Lithuania's enforcement and redress landscape this cycle is anchored by the Regional Administrative Court's reported confirmation of VDAI's record EUR 2,385,276 fine against Vinted UAB, originally imposed in July 2024 for transparency and erasure-handling violations of GDPR Articles 5(1)(d) and 5(1)(f), covering data accuracy and storage-limitation principles. This court confirmation is significant beyond the individual case: it establishes an appellate-level benchmark for VDAI's expectations on how controllers handle data-subject erasure requests and maintain transparency about processing, a benchmark other controllers facing similar VDAI scrutiny can expect to be measured against. Alongside the Vinted confirmation, VDAI imposed a EUR 450,000 fine on UAB InMedica for breach-reporting and data-security failures, and personally fined an individual general practitioner EUR 1,153 under Decision No. 3R-1040 of 5 June 2026 for unlawfully accessing 1,231 patients' personal data and using that access for personal messages, a finding linked to infringements of GDPR Articles 5(1)(a), 6(1) and 9(2) concerning lawfulness, fairness and the processing of special-category health data. The GP fine is notable for being a personal, rather than organisational, penalty, and for the scale of unauthorised access involved relative to the modest fine amount. Taken together, these three enforcement actions — Vinted's confirmed appellate fine, the InMedica security-failure fine, and the GP's personal fine for unauthorised health-data access — demonstrate an enforcement and redress function that is active across institutional scales, from a platform business to an individual healthcare professional, and across violation types, from transparency and erasure handling to unauthorised access to special-category data. #### Outlook The confirmed Vinted benchmark is likely to continue shaping VDAI's approach to transparency and erasure-handling enforcement in future cases. The personal fine against the GP for unauthorised health-data access may be a signal of continued VDAI attention to individual accountability for unauthorised access to special-category data within institutional settings, alongside the institutional-level fines against InMedica and Vinted. Periodic update · new data 2026-10-12 #### Enforcement & Redress VDAI's enforcement activity this cycle spans two decisions of markedly different scale. VDAI fined UAB InMedica EUR 450,000 following two investigations that found multiple GDPR violations connected to breach-incident reporting and data security. The exact decision date and the precise GDPR articles found to have been breached have not been confirmed against VDAI's own decision register; this finding is sourced from secondary reporting rather than the primary decision text, and should be read with that caveat attached. Separately, and with considerably more precision available in the sourcing, VDAI decision No. 3R-1040, dated 5 June 2026, fined a healthcare worker personally EUR 1,153 under GDPR Articles 5(1)(a), 6(1) and 9(2) for accessing 1,231 patient files without authorisation while on sick leave. The scale of files accessed, 1,231 patient records, and the circumstance that the access occurred while the worker was on sick leave rather than performing an authorised clinical function, together with the specific articles cited (the integrity-and-confidentiality principle, the lawfulness-of-processing basis, and the special-category-health-data processing conditions), give this decision a comparatively well-evidenced profile relative to the InMedica fine. The general fine-tier architecture under GDPR Article 83 continues to apply directly in Lithuania without any LT-specific cap or add-on identified this cycle: maximum fines of EUR 10 million or 2% of global annual turnover apply to breaches of Articles 8, 11, 25-39, 42 and 43, rising to EUR 20 million or 4% for non-compliance with a VDAI order, with fine decisions time-barred after three years. Against this backdrop, the EDPB adopted Guidelines 04/2026 on the choice between imposing a fine versus a reprimand on 17 September 2026, which VDAI announced domestically on 24 September 2026; the guidelines address precisely the fine-tier calculus engaged by both the InMedica and healthcare-worker decisions, although the underlying EDPB text has not been independently retrieved this cycle and the finding rests on a Lithuanian-language commentary source translated for this brief. #### Outlook The newly adopted EDPB guidance on fine-versus-reprimand decision-making may influence how VDAI approaches future enforcement matters, though neither the InMedica nor the healthcare-worker decision predates or necessarily reflects the new guidance given their respective dates relative to the 17 September 2026 adoption. Independent confirmation of the InMedica decision against VDAI's own decision register, including its precise date and the specific articles found breached, remains the most material open item for this module going into the next cycle. Periodic update · new data 2026-10-04 #### Enforcement & Redress VDAI's enforcement activity this period spans both volume and subject-matter breadth. Eleven VDAI decisions were issued between 13 and 27 May 2026, none of which carried fines, indicating a continuing pattern of decisions that address compliance findings without a monetary penalty in every case. Against that backdrop, two fines were imposed in the following weeks: a general practitioner was fined €1,153 personally under decision 3R-1040, dated 5 June 2026, for accessing 1,231 patient files while on sick leave, a violation found under Article 9 of the GDPR governing special-category data; and a separate company was fined on 2 July 2026 over incident-reporting and data-security weaknesses. The Article 9 fine against the general practitioner is a special-category data case of a kind VDAI has been willing to pursue down to the level of an individual practitioner's personal access pattern, rather than only against institutional controllers. The July fine, by contrast, targets the structural dimension of a company's incident-reporting and security practices rather than a single individual's unauthorised access. Together, these two fines this period illustrate that VDAI's enforcement reach extends across both individual-level special-category data misuse and organisational-level security and reporting deficiencies. This enforcement activity should be read alongside VDAI's own H1 2026 finding that human error caused 48% of reported breaches: the Article 9 case against the general practitioner is itself an instance of individual human conduct producing a special-category data violation, giving a concrete enforcement illustration of the kind of risk the statistical finding describes in aggregate. #### Outlook Whether the volume of VDAI decisions issued without fines in May 2026 reflects a deliberate graduated-enforcement approach, reserving fines for the more serious cases such as the Article 9 and incident-reporting breaches that followed, is not established from this period's evidence alone and is an item to watch as further decisions are issued. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 63 words · 18 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (41 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 10 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 12 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties