Latvia Data Protection & Privacy Regulation

Controller/Processor Duties

In 2026 the DVI issued updated guidance permitting employees to record workplace meetings on a legitimate-interest basis, provided clear internal procedures are followed. This is an uncertain-confidence finding, drawn from a single Tier-3 source, and represents a shift in how the legitimate-interest lawful basis is being applied to an employee-initiated recording scenario rather than a controller-initiated one. Employers operating in Latvia should note that this guidance addresses recording by employees rather than by the employer itself, and the requirement for clear internal procedures suggests the DVI expects documented governance around the practice rather than an unconditional permission.

Separately, the DVI retains its established statutory power to visit and inspect controllers' premises, including production facilities, warehouses, and other commercial or non-residential premises, in order to check compliance with Latvian data-protection law. This inspection power is a probable-confidence, standing feature of the DVI's regulatory toolkit rather than a new development this cycle, but it forms part of the same controller-facing compliance architecture that the 2026 workplace-recording guidance sits within.

Outlook

The item to watch is whether further DVI guidance clarifies the internal-procedure standard referenced in the 2026 workplace-recording guidance, and whether any enforcement action tests the legitimate-interest basis in this specific employee-recording context.

Controller/Processor Duties

Latvia's controller and processor duties saw two incremental clarifications from the Data State Inspectorate this cycle, both addressing recurring practical-compliance ambiguities rather than introducing new statutory obligations. First, 2026 DVI guidance clarifies that employees may record workplace meetings on a legitimate-interest basis, subject to internal policy safeguards. This resolves a common employment-context question by confirming legitimate interest as an available basis, conditioned on the employer having internal policy safeguards in place. This is the most recent identified controller-processor-duties development for Latvia, dated to 2026.

Second, DVI's data-minimisation guidance for CCTV and video-surveillance systems establishes a practical retention norm: footage is generally expected to be limited to approximately 30 days absent strong, documented justification for longer retention. This is a guidance-level norm rather than a binding statutory retention period, and is accordingly assessed rather than confirmed in confidence, reflecting its status as regulatory expectation rather than codified law. Separately, but related, Latvia's CCTV regime does not require mandatory DVI registration of surveillance systems, but does require clear signage stating the surveillance purpose and providing controller contact information, a binding requirement.

Read together, these two developments describe DVI's approach to controller-processor duties as one of targeted, sector- or context-specific guidance issued incrementally, rather than a single comprehensive controller-processor-duties framework document. The workplace-recording guidance addresses an employment-relations context; the CCTV guidance addresses a physical-security and surveillance context; both narrow practical uncertainty for controllers operating in those specific contexts without altering Latvia's underlying GDPR-based statutory obligations.

The accountability dimension of both pieces of guidance is also worth noting: the workplace-recording guidance is explicitly conditioned on internal policy safeguards, which implies an accountability expectation that employers relying on employee legitimate-interest recording maintain a documented internal policy, even though the guidance does not appear to specify the precise content such a policy must contain. Similarly, the CCTV signage requirement functions as a transparency-and-accountability control, giving data subjects notice of surveillance and a contact point for further inquiry or rights exercise, even in the absence of a formal registration obligation. It is also useful to distinguish these two 2026 guidance items from the security-measures and retention-and-disposal sub-modules they respectively sit under: the CCTV signage requirement is a security-and-transparency measure, while the 30-day retention norm is a data-minimisation and retention-and-disposal matter, and controllers should treat compliance with one as distinct from, though related to, compliance with the other.

Outlook

The main open question for this domain is whether either piece of 2026 guidance is tested against an actual DVI enforcement action — for instance, an employer relying on the workplace-recording legitimate-interest basis without adequate internal policy safeguards, or a CCTV operator retaining footage well beyond the 30-day norm without documented justification. No such enforcement test was evidenced this cycle, and until one occurs, both pieces of guidance remain untested compliance expectations rather than confirmed enforcement standards. A further item worth monitoring is whether DVI extends the workplace-recording legitimate-interest logic to analogous contexts beyond meetings specifically, since the 2026 guidance as evidenced this cycle is specific to meetings and does not itself address those adjacent scenarios.

Cross-Border & Adequacy

Regulation (EU) 2025/2518, which lays down additional procedural rules for the enforcement of the GDPR in cross-border cases, will apply from April 2027. This is a probable-confidence, forward-looking regulatory-horizon item rather than a currently operative rule, and it sits at the supranational EU level rather than being a Latvia-specific instrument. Its eventual application will affect how cross-border GDPR enforcement cases involving Latvian controllers or the DVI as lead or concerned supervisory authority are procedurally handled, though the specific mechanics of that change are not yet detailed in the evidence reaching this cycle.

No Latvia-specific cross-border transfer or adequacy development beyond this EU-level procedural regulation was identified this cycle.

Outlook

The April 2027 application date is the fixed marker to track. As that date approaches, future cycles should watch for implementing guidance from the European Data Protection Board or the DVI clarifying how the new procedural rules will be applied in cross-border cases involving Latvia.

AdTech & Commercial Privacy

The Data State Inspectorate fined SIA 4YOU MEBELES EUR 1,000 following a cookie-compliance sweep conducted under its Article 31 inspection powers, which identified unremedied cookie-consent deficiencies. Notably, the penalty itself was issued under Article 83(5)(e) for insufficient cooperation with the supervisory authority, a violation of Article 58(1)(e), rather than for the underlying cookie-consent failure directly. This is a procedurally distinct enforcement route: the Inspectorate appears willing to penalise a controller's failure to cooperate with a sweep or follow-up inspection as its own violation, separate from whatever substantive remediation the sweep itself sought. The fine level, at EUR 1,000, sits at the lower end of the Inspectorate's recorded enforcement range and is consistent with its broader pattern of routine, modest cookie-related penalties rather than large-scale punitive action.

This enforcement outcome sits within a wider programme of cookie and tracker sweeps that the Inspectorate runs as part of its active-supervision function. The target in this instance, a furniture retailer, suggests the sweep programme reaches beyond large digital-advertising intermediaries into ordinary commercial websites using standard cookie-consent tooling, indicating a reasonably broad net for this kind of routine compliance check rather than a sector-targeted campaign.

Outlook

Watch for whether further cookie-sweep outcomes in Latvia continue to attach primarily to non-cooperation under Article 58(1)(e) rather than to the underlying consent deficiency itself, which would indicate a settled enforcement technique, and for whether fine levels for such outcomes remain in the sub-EUR-2,000 range or escalate for repeat or larger-scale non-cooperation.

Algorithmic, Biometric & Surveillance Governance

The Data State Inspectorate's 2025 annual activity report designated it as Latvia's supervisory authority for personal data protection under the EU AI Act, with the Ministry of Environmental Protection and Regional Development (VARAM) coordinating overall AI Act implementation nationally. This is the clearest signal available that Latvia intends to route the personal-data dimension of AI-system oversight through its existing data-protection regulator rather than establishing a wholly new supervisory body for that purpose, consistent with an approach several EU jurisdictions have taken of layering AI Act competence onto existing sectoral regulators rather than creating parallel structures.

The specific Latvian legal instrument, whether a Cabinet decision, ministerial order or legislative amendment, that formally confers this supervisory role on the Inspectorate has not been independently located. The designation is understood at this point from the Inspectorate's own self-reporting in its annual activity report rather than from the underlying instrument, which means the precise scope of its AI Act competence, including which categories of AI system or which obligations under the Act fall within its remit as opposed to VARAM's general coordination function, has not been confirmed from a primary source.

Outlook

Watch for the formal instrument establishing or confirming the Inspectorate's AI Act supervisory role, which would clarify the precise boundary between its competence and VARAM's coordinating function, and for the Inspectorate's first substantive exercise of that role, whether through guidance, an investigation or an enforcement action concerning an AI system's personal-data processing.

Enforcement & Redress

Latvia's enforcement environment shows material escalation this cycle. The Riga Regional Court has upheld the Data State Inspectorate's EUR 1.2 million fine against Tet, a significant Latvian telecommunications provider, for unlawfully disclosing unverified customer personal data to debt-recovery services. This judgment is now final and not subject to appeal, converting what was previously a contested fine into a settled, confirmed enforcement outcome. The finality of this decision is a confirmed-confidence finding drawn from Latvian public broadcasting reporting.

Beyond this individual case, the DVI's own activity statistics for its latest reporting period show sustained enforcement volume: 266 in-depth review proceedings were initiated, 143 violations were identified within those reviews, and corrective measures were applied in 62 cases. The DVI also adopted seven administrative-offence decisions, five of which were fines for GDPR violations and two of which were penalties for failure to provide information to the DVI itself. These figures are probable-confidence findings drawn from a single Tier-3 source (Linklaters), and the exact date range of the reporting period they cover was not confirmable from the source excerpt reached this cycle, a gap that should be closed in a future cycle before the figures are treated as fully settled. The DVI additionally retains a statutory power to visit and inspect controllers' premises, including production facilities, warehouses and other commercial or non-residential premises, to check compliance with Latvian data-protection law.

Outlook

The item to watch is whether the volume of in-depth review proceedings this reporting period (266) converts into further administrative-offence decisions in the coming cycle, and whether a future source can confirm the exact reporting-period date range for these figures. The Tet judgment's finality removes any near-term appeal uncertainty from that specific case.

Enforcement & Redress

The Data State Inspectorate's enforcement and redress activity in Latvia shows a materially active, above-baseline enforcement programme this cycle, anchored by one headline case. DVI opened 266 in-depth review proceedings, identified 143 violations, applied corrective measures in 62 cases, and issued 7 administrative-offence decisions in a recent reporting period, of which 5 were GDPR fines and 2 concerned cooperation failures with DVI itself rather than substantive GDPR breaches.

The headline case within this activity remains the SIA "Tet" fine of EUR 1,200,000, imposed for disclosing unverified personal data, including a minor's data, to debt-recovery services without prior identity verification, in violation of GDPR Article 5(1). This fine sits well below the GDPR's statutory maximum penalty of EUR 20,000,000 or 4 percent of worldwide annual turnover, whichever is higher. The gap between Tet's actual fine and the statutory ceiling is instructive: DVI's largest identified fine to date represents a small fraction of the maximum available penalty, suggesting a calibrated, proportionality-conscious fining practice even in its most significant known case.

The proportion of DVI's enforcement outcomes is also analytically significant. Of 143 identified violations, corrective measures were applied in 62 cases, while only 7 proceeded to formal administrative-offence decisions. This indicates that DVI's default enforcement posture favours remediation over formal fining, reserving administrative-offence decisions, and by extension monetary fines, for a comparatively small subset of matters. This pattern suggests DVI's enforcement capacity is being deployed primarily toward correction and compliance-improvement rather than punitive deterrence, with fines functioning as an exception rather than the default response to an identified violation.

DVI's decisions carry a defined judicial-review pathway: administrative-offence decisions are appealable first to the DVI Director and subsequently to the District (City) Court under the Administrative Violations Code. This establishes that DVI's enforcement decisions, including the Tet fine, are not administratively final but subject to a defined internal-then-judicial appeal route. No indication of whether Tet or any other sanctioned party has exercised this appeal route was available this cycle.

It is also worth situating DVI's enforcement volume in context to the extent this cycle's evidence permits: 266 in-depth review proceedings in a single reporting period is a substantial docket, and the resulting 143-violation identification rate suggests DVI's review process is reasonably effective at surfacing genuine violations rather than functioning as a largely pro forma review exercise. No comparative figure from another jurisdiction is available within this cycle's evidence base, so this observation should be read as a description of Latvia's own docket composition rather than a comparative ranking. Finally, the 2-of-7 administrative-offence decisions concerning cooperation failures rather than substantive GDPR breaches is itself a distinct and separately notable finding: it indicates that DVI is willing to formally sanction non-cooperation with its own supervisory process as a distinct category of offence, independent of whatever substantive GDPR violation, if any, prompted the underlying inquiry.

Outlook

The most consequential open item for this domain is whether DVI's active 2026-2030 strategic emphasis on strengthened supervision translates into a materially higher rate of administrative-offence decisions relative to the 7-of-143 ratio observed in the most recent reporting period, which would signal a shift away from the remediation-favouring posture described above. A second item to track is whether the Tet decision, or any other DVI administrative-offence decision from this reporting period, is appealed to the District Court, which would be the first test of Latvia's GDPR judicial-redress pathway under this cycle's evidence base.