🇱🇻Personal Data Processing Law
Personal Data Processing Law
Latvia applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.
Status: Current official text in force from 4 June 2021
Citation: Personal Data Processing Law, especially ss. 25-36
Regulator: Data State Inspectorate
Source basis: Official Likumi.lv English consolidation through the 6 May 2021 amendment downloaded, rendered and checked on 22 August 2026.
How the national law fits with GDPR
The Law establishes Latvia's supervisory framework and supplements the GDPR with national rules for DPO qualifications, public information, rights restrictions, expression, research, children and video surveillance.
National additions and variations
- Section 33 sets 13 as the age for consent-based information-society services offered directly to a child.
- Sections 17-24 establish an optional national DPO qualification examination and public list; organisations must not present an unqualified person as being on that list.
- Sections 28-31 regulate official-publication processing, archives, statistics and research and permit specified rights derogations only where exercise would make the purpose impossible or seriously impair it and the derogation is necessary.
- Section 32 permits journalism processing for public-interest publication only when freedom of expression conditions and proportionality are met.
- Section 36 sets national video-surveillance rules, including the household road-traffic-recording boundary and limits on disclosure of such recordings.
The local PDF is rendered from the official English consolidation. The Latvian text is controlling and sector legislation may supply additional processing grounds or restrictions.
Operational approach
First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.
Do not treat GDPR compliance as automatic compliance with PDPL. Record the national trigger, the responsible owner, the local procedure and the current official source reviewed.