Law: Personal Data Processing Law of 21 June 2018 (the Law) and the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR)

Regulator: Data State Inspectorate (DVI)

Summary: On June 21, 2018, the Personal Data Processing Law of 21 June 2018 (the Law) entered into force to implement the GDPR. In addition, Latvia implemented the Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680) into national law on August 5, 2019.

Furthermore, the Data State Inspectorate (DVI), as the primary data protection regulator in Latvia, is responsible for enforcing the Law and for providing guidance on the GDPR. To date, the DVI has issued guidance on data processing in the context of Small and Medium Enterprises (SMEs) and the protection of health information. Another key regulator in Latvia is the Board of the Financial and Capital Market Commission (FCMC) which has taken enforcement action with regards to anti-money laundering and countering the financing of terrorism.