🇱🇹Law on Legal Protection of Personal Data

← Back to laws in Lithuania

Law on Legal Protection of Personal Data

Lithuania applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Law supplements the GDPR in Lithuania, allocates supervisory competence and adds rules for personal identification numbers, employment and candidate data, criminal-conviction data, children and enforcement.

National additions and variations

• The Law restricts use and publication of the Lithuanian personal identification number and prohibits making it public except where legislation provides otherwise.
• National employment provisions permit specified processing of candidate and employee data while requiring notice where candidate data is collected from former employers or other sources.
• Processing of criminal-conviction and offence data outside official authority requires a statutory basis or a documented legitimate-interest assessment with appropriate safeguards.
• The national Article 8 rule sets 14 as the age for consent-based information-society services offered directly to a child.
• Supervision is divided between the State Data Protection Inspectorate and the Inspector of Journalist Ethics for processing connected with journalistic, academic, artistic or literary expression.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.