Nobody writes to tell you that the rules apply to you. You work it out yourself, from a size test that sorts companies into two categories, and the answer decides your reporting deadlines and the size of the fines. The rules also widen on 1 October 2026.
Latvia's cybersecurity rules have one feature that catches companies out more often than any technical requirement in them. Nobody tells you that you are covered.
Under the National Cybersecurity Law a business has to work out for itself whether it counts as an essential or an important service provider, and if it does, tell the National Cybersecurity Centre within one month. No register puts you on a list, no letter arrives, and no grace period starts on the day you find out. The first round was due by 1 April 2025. So a company that discovers today that it was covered has not got a deadline coming up — it has already missed one.
The size test that sorts everyone
Both categories are covered by the law. The difference shows up in how closely you are supervised and, sharply, in the size of the fines. Two definitions do most of the sorting.
You are a large operator if you meet any one of these: 250 or more employees, turnover over EUR 50 million, or a balance sheet total over EUR 43 million.
You are a medium operator if you meet all of these: up to 249 employees, and turnover or a balance sheet total between EUR 10 million and the large thresholds.
The difference between “any one” and “all” matters. A business with 300 staff and modest turnover is large, because one limb is enough. A business with 40 staff and EUR 3 million of turnover is neither large nor medium, so the size-based routes do not reach it at all.
Who is an essential service provider
Some organisations are essential because of what they are, with no size test at all: the .lv registry, domain name resolution providers, electronic communications companies, qualified trust service providers, state bodies and public media.
Others are essential because they are a large operator in a listed sector. There are twenty sectors, covering energy, transport, banks, central counterparties and trading venues, healthcare, drinking water, and the digital ones: cloud computing, data centres, content delivery networks, ICT management and cybersecurity services.
Three further routes catch businesses that would never expect it: being the only provider of a service in one of those sectors in Latvia, whatever your size; being a public body working in one of them under private law; and being any organisation whose disruption could seriously affect public safety, national defence or public health, or create systemic risk.
The rules widen on 1 October 2026
That last route is being extended. From 1 October 2026 it expressly includes companies, foundations and associations that matter to national security, apart from owners of large forest or farm holdings.
This widens the essential category — the one with the heaviest obligations and the biggest fines. If you decided earlier that you were outside, this is the wording to look at again.
An important service provider is anyone who is not essential but is a medium operator in one of those sectors, or a medium or large operator in a further list: postal services, waste management, chemicals, industrial food production and medical devices.
What the law asks you to do
The head of the organisation is personally responsible for cybersecurity. They have to appoint a cybersecurity manager within three months of notifying your status, and tell the Centre and the Constitution Protection Bureau within five working days.
That manager's job is set out in the law: organise the security measures, run an ICT security check at least once a year and fix what it finds, attend training every year, and keep staff briefed on current risks. The technical minimum is in Cabinet Regulation No. 397.
Reporting an incident
This is where the timetable gets hard. When you detect any cyber incident you have to act on it immediately, tell the competent incident prevention institution, and immediately decide whether the incident is significant. That decision is yours, you make it under pressure, and everything that follows depends on it.
An incident is significant if any one of these is true: it endangers public health, safety or national security; it causes losses of at least EUR 500,000 or 5 per cent of turnover, whichever is lower — counting other people's losses, not just your own; it harms someone's life or health; it affects restricted-access information; or it crosses borders.
If it is significant, three clocks start:
| Step | Deadline |
|---|---|
| Early warning | Immediately, no later than 24 hours |
| Initial report | Immediately, no later than 72 hours — 24 for a trust service provider |
| Final report once it is resolved | Within one month of the initial report |
You cannot write these in your own words: each has a set form attached to the regulation, signed electronically. You also have to tell your own affected customers straight away.
The fines, and what actually triggers them
The headline numbers are large — up to EUR 10 million or 2 per cent of turnover for an essential provider, and EUR 7 million or 1.4 per cent for an important one. But the condition matters more than the number. Those powers only arise for substantial non-compliance, and the law says exactly what that means: not taking appropriate and proportionate measures; repeatedly refusing lawful requests for information from the supervisor; or failing to report a significant incident in time, or knowingly reporting it falsely.
So this is not a general penalty for imperfect security. It is aimed at having no measures at all, at obstructing the supervisor repeatedly, and at missed or false reporting.
What to do now
Do the self-assessment and put a date on it. It is the legal definition applied to your headcount, turnover and balance sheet against the sector you work in — not a view about how important you feel you are.
Look at the 1 October 2026 wording, especially if you concluded earlier that you were outside.
If you are covered and have not notified, you are already late. The duty does not disappear because a deadline has passed.
If you are a regulated financial institution, do not answer this question on its own. Financial firms covered by the EU's digital operational resilience regulation (DORA) are subject to it as the more specific regime: this Law applies to them only as far as its own scope provision allows, and gives way where DORA's requirements are equivalent. That also stops you being penalised twice, since DORA has penalties of its own.
It is worth noticing how few financial firms are in the listed sectors at all: only banks, central counterparties and trading venues. Payment and e-money institutions, investment firms, insurers and crypto-asset service providers come within this Law, if at all, only through the general routes above.