The GDPR reads the same in Riga as in Rotterdam. What is not portable is the layer underneath it — the places where the Regulation says “Member States may provide” and Latvia has provided: child consent at 13, a register of data protection officers, audit-record retention, and a limitation period the Regulation itself is silent on.
The interesting part is not the GDPR
The substantive rules are the same in Riga as in Rotterdam. The GDPR is a Regulation, it applies directly, and a compliance programme built for one Member State is mostly portable.
What is not portable is the layer underneath. The Regulation leaves a defined set of choices to national law, and Latvia has made them in the Personal Data Processing Law — a statute mostly about the regulator rather than about you. The handful of provisions that are about you are exactly where an imported policy goes wrong.
First, whether you are in scope at all
Article 3 catches more businesses than "operating in Latvia" suggests, on two independent limbs.
Establishment. The Regulation applies to processing in the context of the activities of an establishment in the Union — regardless of whether the processing itself takes place in the Union. A Latvian subsidiary with servers in Singapore is inside.
Targeting and monitoring. It also applies to a controller or processor not established in the Union where the processing relates to offering goods or services to people in the Union — expressly whether or not payment is required — or to monitoring their behaviour in the Union. A free product with Latvian users, and analytics tracking them, is inside on both counts.
Incorporation is not the test. Where the users are, and whether you are watching them, generally is.
Controller or processor, and what Article 28 must contain
The two roles have different duties throughout, and a technology company frequently occupies both — controller for its own marketing and staff data, processor for what its customers put into the product.
Where you act as a processor, the relationship has to be governed by a contract meeting Article 28's requirements. Its mandatory content is fixed by the Regulation, so it is worth knowing what has to be in it.
It must set out the subject matter and duration of the processing, its nature and purpose, the types of data, the categories of data subject, and the controller's rights and obligations. It must then bind the processor: to act only on documented instructions, including on transfers; to keep its people under a duty of confidence; to apply Article 32 security; to engage a sub-processor only with prior written authorisation and on the same terms, remaining fully liable for it; to assist with data subject rights and with Articles 32 to 36; to delete or return the data at the end; and to allow audits.
Two consequences are easy to miss. A processor that determines the purposes and means of processing becomes a controller for that processing. And the Commission has adopted standard contractual clauses for the controller–processor relationship, which may be used instead of drafting from scratch.
The 250-employee exemption almost never applies
Article 30(5) is the most over-read provision in the Regulation. It disapplies record-keeping below 250 employees — and then takes it back where the processing is likely to risk rights and freedoms, or is not occasional, or includes special category or criminal offence data.
The second limb does the work. A product that processes user data continuously is not processing "occasionally". For most technology companies below 250 employees the exemption is unavailable, and the useful question is which of the three limbs removes it.
What Latvia has actually decided
Six provisions of the Personal Data Processing Law change the answer for a technology business.
| Provision | The Latvian choice |
|---|---|
| Child consent | Valid from age 13 for information society services; below that, a parent must consent |
| Data protection officers | The Inspectorate keeps a public list of officers who have passed its qualification examination, held under a Cabinet Regulation of 2020 — but you may appoint someone on the list or another person |
| Audit records | Kept no longer than one year after the entry, unless other law or the nature of the processing requires otherwise |
| Video surveillance signage | Must state the controller's name, contact details and purpose, and where the rest of the Article 13 information can be obtained |
| Recipient information | How far back information about recipients must go — see below |
| Limitation period | Five years for a civil claim to remove an infringement, from the infringement or, if continuing, from the day it ceased |
The last two are the ones an imported programme will not contain at all. The limitation period is a rule the Regulation is silent on. The recipient-information provision needs care: the Regulation's own right under Article 15(1)(c) covers recipients to whom data have been or will be disclosed, with no period attached, so how the national provision sits against it is a question to put rather than an answer to assume.
The DPO point is the one most often stated backwards. Latvia runs an examination and a register, which is unusual, and it is easy to conclude that a Latvian DPO must be certified. The opposite is true: the list confers visibility, not a monopoly.
Breach notification, and enforcement
Article 33 is unchanged by Latvian law: a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours. A processor notifies its controller without undue delay — there is no 72-hour figure on the processor's side, and no direct route to the regulator. Security duties under the separate Latvian cybersecurity regime are a different obligation, on a different clock, to a different authority.
The fines are the Regulation's own, in two tiers: up to EUR 10 million or 2 per cent of worldwide turnover for controller and processor obligations; up to EUR 20 million or 4 per cent for the basic principles, data subject rights and transfers. Worth knowing: failing to comply with an order of the supervisory authority is itself in the upper tier, whatever the obligation the order was about.
What a private company should plan around is time. The Inspectorate decides within six months of opening a case, extendable to one year, and up to two years where lengthy fact-finding or the EU cooperation mechanism is engaged. Appealing a decision does not suspend it.
Where to start
If you already run an EU-wide programme, the Latvian work is narrow: check the age gate against 13, check whether the DPO appointment assumed certification was required, and check audit-record retention against the one-year rule.
If you have not built the programme yet, go the other way round: establish which limb of Article 3 catches you, decide controller or processor role by role, and build the Article 30 records — the 250-employee exemption will almost certainly not be available, and the records are what every later question is answered from.