Lithuania Data Protection & Privacy Regulation

Controller/Processor Duties

The State Data Protection Inspectorate is understood to have issued guidance, reported 28 October 2026, aimed at helping data controllers in Lithuania assess more consistently and objectively the risk a personal-data breach poses to the rights and freedoms of individuals. The stated purpose of the guidance is to support controllers in determining whether a breach meets the threshold for notification to VDAI itself and, separately, to affected data subjects, under the framework set out in Articles 33 and 34 of the General Data Protection Regulation. Framed this way, the guidance addresses a long-standing practical difficulty for controllers: the GDPR sets a risk-based notification threshold without prescribing a single assessment methodology, leaving considerable room for inconsistent practice across sectors and organisation sizes.

This finding is carried at a qualified level of confidence. It is sourced from a secondary legal-publishing report rather than from VDAI's own published guidance document, and the full text and scope of the recommendations have not been independently retrieved. What can be said is that a national regulator in Lithuania has moved to standardise breach-risk assessment methodology; what cannot yet be said with the same confidence is the precise content, legal status beyond non-binding guidance, or scope of application the recommendations carry. Controllers and processors operating in Lithuania should treat this as guidance under development in the public record rather than as a settled interpretive instrument, pending access to VDAI's primary publication.

No other controller or processor obligation development specific to Lithuania was located. The guidance sits within an otherwise stable domestic framework: it refines existing notification practice rather than introducing a new duty, and nothing in the record suggests any change to the underlying Article 33/34 obligations themselves, which remain those set by the directly applicable Regulation.

Outlook

The principal open item is simply whether the full guidance document becomes available for review, which would allow a firmer account of the methodology VDAI is recommending and the specific factors it directs controllers to weigh. Until then, the practical effect for controllers operating in Lithuania is best understood as an invitation to revisit their existing breach-risk assessment practice against a forthcoming or newly issued regulatory expectation, rather than as a change to the notification threshold itself.

Controller/Processor Duties

VDAI fined UAB InMedica EUR 450,000 for breach-reporting and data-security failures this cycle, one of the more substantial controller-processor-duties penalties recorded for Lithuania. The failures are understood from secondary reporting to concern obligations typically associated with security-of-processing and breach-notification duties, though the exact decision date and the precise GDPR article basis have not been independently confirmed beyond the secondary report relied on this cycle, and should be read with that limitation in mind.

In parallel, secondary reporting attributes to VDAI's own H1 2026 breach report a finding that human error accounted for 48 percent of reported personal-data breaches during the period. VDAI's own report was not independently retrieved this cycle; this figure rests on a Tier-4 aggregator source and should be treated as probable rather than confirmed. If accurate, it indicates that the plurality of breach causation in Lithuania during the first half of 2026 was attributable to human error rather than to external attack or system failure, which is relevant context for how controllers should be prioritising their internal control and training investments, though this report does not offer compliance instruction on that point.

Taken together, the InMedica fine and the breach-causation statistic point to a Lithuanian enforcement environment where breach-reporting and security-of-processing failures, including those rooted in human error, are drawing direct regulatory attention and material financial penalties.

Outlook

Independent retrieval of VDAI's own H1 2026 breach report, not accessed this cycle, would allow the 48 percent human-error figure to be confirmed directly rather than through secondary aggregation. The scale of the InMedica fine suggests breach-reporting and security-of-processing failures remain a priority enforcement area for VDAI.

Controller/Processor Duties

VDAI's own published breach statistics for H1 2026 found human error to be the leading cause of personal-data breaches reported in Lithuania during that period, accounting for 48% of reported incidents. As VDAI's own data, this is an assertive finding rather than a third-party estimate, and it provides a quantified baseline against which Lithuania's controller population's operational practices can be measured going forward.

The standing duty underlying all breach reporting remains in force: data controllers in Lithuania must notify VDAI of personal-data breaches within 72 hours, a duty derived from Article 33 of the GDPR. This 72-hour notification duty is the procedural backbone against which VDAI's human-error finding should be read; a high proportion of human-error-caused breaches implies that controllers' internal detection and escalation processes, which feed into whether the 72-hour clock is met, are an area of continuing operational risk.

A separate company was fined on 2 July 2026 over incident-reporting and data-security weaknesses, understood to connect the Article 33 notification duty directly to enforcement consequence where a controller's reporting or security practices fall short. The combination of VDAI's own statistical finding and a concrete enforcement action over reporting and security weaknesses in the same period indicates that breach-notification compliance is an active area of VDAI supervisory attention, not a dormant procedural requirement.

Outlook

Whether VDAI's H1 2026 human-error finding prompts new controller-facing guidance on breach-prevention measures, such as mandatory staff training benchmarks or technical control requirements aimed at reducing human-error-caused incidents, has not yet been established and is the item to watch arising from this finding.

Children & Vulnerable Groups

VDAI dismissed a parental complaint concerning a school attendance-tracking system in Decisions No. 3R-677 and 3R-676 of 15 April 2026. The regulator found that the municipality's processing of student location or attendance data through the tracking system was grounded in a legal processing obligation, and that this legal basis was not overridden by the parental objection raised in the complaint. This decision sits within a broader batch of eleven VDAI decisions issued around May 2026 addressing access-right-adjacent disputes, in which, according to secondary reporting, no fines were imposed in any of the eleven cases.

The significance of this decision for the children-and-vulnerable-groups module lies in VDAI's confirmation that a municipality's legal processing obligation can, in an appropriate case, take precedence over a parental objection to a student-tracking system, rather than the objection automatically prevailing because the data subject is a minor. This is a data-point on how VDAI balances parental rights against institutional legal obligations in an education-sector processing context, without establishing a broader rule about student-tracking systems generally.

Outlook

No further children-or-vulnerable-groups-specific enforcement or guidance development for Lithuania was identified this cycle beyond the school-tracking-system decision. Whether this dismissal pattern extends to other parental complaints in the same May 2026 batch, all apparently resolved without fines, is relevant context for understanding VDAI's current approach to this category of complaint.

Enforcement & Redress

Secondary monitoring reports suggest VDAI has continued an active and escalating enforcement cadence this period, with activity spanning the healthcare, direct marketing and education sectors. This account is attributed to a secondary aggregator rather than to individually retrieved VDAI decisions, so it is reported here in hedged terms: the pattern described is one of sustained regulatory attention across these three sectors, not a confirmed set of specific fines, reprimands or corrective orders with dates and amounts attached. No individually dated VDAI enforcement action within the current window has been independently confirmed.

This reported cadence sits against a specific piece of standing guidance from the European level: the European Data Protection Board's Guidelines 04/2026 address the choice between imposing a fine and issuing a reprimand, were adopted on 17 September 2026, and are understood to have been announced domestically by VDAI on 24 September 2026. The timing places VDAI's domestic enforcement activity in the period immediately following its own announcement of this European guidance, which is analytically suggestive of a regulator recalibrating its enforcement-tool choice in light of newly adopted European-level direction, though the record available does not permit a firm statement that any specific case applied the Guidelines 04/2026 framework.

The sectoral spread reported — healthcare, direct marketing and education — is consistent with sectors that generate recurring data-protection complaint volume in many jurisdictions, and its appearance here as a described cadence rather than as named cases means the current record supports a statement about the shape of VDAI's attention rather than about any individual enforcement outcome's severity or legal reasoning.

Outlook

The principal item to watch is whether the described cadence resolves into individually dated and publicly attributable decisions, which would allow the current hedged account to be replaced with specific case detail. A secondary item is how VDAI applies the EDPB's fine-versus-reprimand guidelines in practice once concrete decisions citing that framework become available, since the domestic announcement of the Guidelines on 24 September 2026 sets up an expectation that subsequent enforcement choices will visibly reflect it.

Enforcement & Redress

The State Data Protection Inspectorate (VDAI) published, on 30 September 2026, a summary of significant 2025 court decisions in administrative cases arising from complaints it handled. The summary draws on rulings from the Supreme Administrative Court (LVAT) and the Regional Administrative Court, and covers three distinct reviewed issues: the scope of the Inspectorate's discretion in choosing which corrective measure to apply once a violation is found, the lawfulness of video surveillance, and the lawfulness of processing carried out to comply with a legal obligation or to collect service fees. The summary itself, rather than the individual rulings it describes, is the confirmed development this period; the specific holdings on each of the three issues were not itemised in the material reaching this review, so the precise substantive standards the courts applied cannot yet be stated with confidence.

The existence of this summary is nonetheless a meaningful signal about the character of Lithuania's data-protection enforcement environment. It indicates that VDAI's enforcement decisions, including its choice of corrective measure once it finds a violation, are subject to active appellate-court review rather than being accepted without challenge. This sits alongside a standing, separately-sourced example of VDAI's enforcement record: decision 3R-490, dated 23 March 2026, in which VDAI found a cloud-software provider in violation of Article 32 of the GDPR for a ransomware-vulnerability security failure. That fine was calculated starting from a severity-based 15 percent of the Article 32 statutory maximum, an initial figure of EUR1,500,000, before being reduced to a final sum of EUR4,500. This decision is carried as standing background context rather than as a new development this period, but it illustrates the scale of discretion VDAI exercises in moving from an initial statutory-maximum-based calculation to a final fine figure, which is directly relevant to understanding why the discretion exercised in choosing corrective measures is now the subject of active judicial review as reflected in the 2025 court-decisions summary.

Taken together, the active appellate-review record on corrective-measure discretion and video-surveillance lawfulness, alongside VDAI's demonstrated willingness to apply a large discount between an initial statutory-maximum-based calculation and a final fine figure, indicates an enforcement environment under ongoing judicial scrutiny of the Inspectorate's discretion rather than one operating free of appellate check.

Outlook

A closer reading of the underlying LVAT and Regional Administrative Court decisions summarised by VDAI on 30 September 2026 would clarify the specific standards now governing corrective-measure discretion, video-surveillance lawfulness, and legal-obligation or service-fee-based processing in Lithuania. Until that detail becomes available, the enforcement and redress picture in Lithuania should be read as one of active, multi-stranded judicial review of VDAI's discretion, without yet being able to state the precise substantive standard the courts have settled on for any of the three reviewed issues.

Enforcement & Redress

Lithuania's enforcement and redress landscape this cycle is anchored by the Regional Administrative Court's reported confirmation of VDAI's record EUR 2,385,276 fine against Vinted UAB, originally imposed in July 2024 for transparency and erasure-handling violations of GDPR Articles 5(1)(d) and 5(1)(f), covering data accuracy and storage-limitation principles. This court confirmation is significant beyond the individual case: it establishes an appellate-level benchmark for VDAI's expectations on how controllers handle data-subject erasure requests and maintain transparency about processing, a benchmark other controllers facing similar VDAI scrutiny can expect to be measured against.

Alongside the Vinted confirmation, VDAI imposed a EUR 450,000 fine on UAB InMedica for breach-reporting and data-security failures, and personally fined an individual general practitioner EUR 1,153 under Decision No. 3R-1040 of 5 June 2026 for unlawfully accessing 1,231 patients' personal data and using that access for personal messages, a finding linked to infringements of GDPR Articles 5(1)(a), 6(1) and 9(2) concerning lawfulness, fairness and the processing of special-category health data. The GP fine is notable for being a personal, rather than organisational, penalty, and for the scale of unauthorised access involved relative to the modest fine amount.

Taken together, these three enforcement actions — Vinted's confirmed appellate fine, the InMedica security-failure fine, and the GP's personal fine for unauthorised health-data access — demonstrate an enforcement and redress function that is active across institutional scales, from a platform business to an individual healthcare professional, and across violation types, from transparency and erasure handling to unauthorised access to special-category data.

Outlook

The confirmed Vinted benchmark is likely to continue shaping VDAI's approach to transparency and erasure-handling enforcement in future cases. The personal fine against the GP for unauthorised health-data access may be a signal of continued VDAI attention to individual accountability for unauthorised access to special-category data within institutional settings, alongside the institutional-level fines against InMedica and Vinted.

Enforcement & Redress

VDAI's enforcement activity this cycle spans two decisions of markedly different scale. VDAI fined UAB InMedica EUR 450,000 following two investigations that found multiple GDPR violations connected to breach-incident reporting and data security. The exact decision date and the precise GDPR articles found to have been breached have not been confirmed against VDAI's own decision register; this finding is sourced from secondary reporting rather than the primary decision text, and should be read with that caveat attached.

Separately, and with considerably more precision available in the sourcing, VDAI decision No. 3R-1040, dated 5 June 2026, fined a healthcare worker personally EUR 1,153 under GDPR Articles 5(1)(a), 6(1) and 9(2) for accessing 1,231 patient files without authorisation while on sick leave. The scale of files accessed, 1,231 patient records, and the circumstance that the access occurred while the worker was on sick leave rather than performing an authorised clinical function, together with the specific articles cited (the integrity-and-confidentiality principle, the lawfulness-of-processing basis, and the special-category-health-data processing conditions), give this decision a comparatively well-evidenced profile relative to the InMedica fine.

The general fine-tier architecture under GDPR Article 83 continues to apply directly in Lithuania without any LT-specific cap or add-on identified this cycle: maximum fines of EUR 10 million or 2% of global annual turnover apply to breaches of Articles 8, 11, 25-39, 42 and 43, rising to EUR 20 million or 4% for non-compliance with a VDAI order, with fine decisions time-barred after three years. Against this backdrop, the EDPB adopted Guidelines 04/2026 on the choice between imposing a fine versus a reprimand on 17 September 2026, which VDAI announced domestically on 24 September 2026; the guidelines address precisely the fine-tier calculus engaged by both the InMedica and healthcare-worker decisions, although the underlying EDPB text has not been independently retrieved this cycle and the finding rests on a Lithuanian-language commentary source translated for this brief.

Outlook

The newly adopted EDPB guidance on fine-versus-reprimand decision-making may influence how VDAI approaches future enforcement matters, though neither the InMedica nor the healthcare-worker decision predates or necessarily reflects the new guidance given their respective dates relative to the 17 September 2026 adoption. Independent confirmation of the InMedica decision against VDAI's own decision register, including its precise date and the specific articles found breached, remains the most material open item for this module going into the next cycle.

Enforcement & Redress

VDAI's enforcement activity this period spans both volume and subject-matter breadth. Eleven VDAI decisions were issued between 13 and 27 May 2026, none of which carried fines, indicating a continuing pattern of decisions that address compliance findings without a monetary penalty in every case. Against that backdrop, two fines were imposed in the following weeks: a general practitioner was fined €1,153 personally under decision 3R-1040, dated 5 June 2026, for accessing 1,231 patient files while on sick leave, a violation found under Article 9 of the GDPR governing special-category data; and a separate company was fined on 2 July 2026 over incident-reporting and data-security weaknesses.

The Article 9 fine against the general practitioner is a special-category data case of a kind VDAI has been willing to pursue down to the level of an individual practitioner's personal access pattern, rather than only against institutional controllers. The July fine, by contrast, targets the structural dimension of a company's incident-reporting and security practices rather than a single individual's unauthorised access. Together, these two fines this period illustrate that VDAI's enforcement reach extends across both individual-level special-category data misuse and organisational-level security and reporting deficiencies.

This enforcement activity should be read alongside VDAI's own H1 2026 finding that human error caused 48% of reported breaches: the Article 9 case against the general practitioner is itself an instance of individual human conduct producing a special-category data violation, giving a concrete enforcement illustration of the kind of risk the statistical finding describes in aggregate.

Outlook

Whether the volume of VDAI decisions issued without fines in May 2026 reflects a deliberate graduated-enforcement approach, reserving fines for the more serious cases such as the Article 9 and incident-reporting breaches that followed, is not established from this period's evidence alone and is an item to watch as further decisions are issued.