The GDPR says the same thing in Riga as in Rotterdam. What does not travel is the Latvian layer underneath it: consent from age 13, a register of data protection officers, a one-year limit on audit records, and a five-year deadline for claims that the GDPR says nothing about.
The interesting part is not the GDPR itself
The main rules are the same in Riga as in Rotterdam. The GDPR applies directly in every EU country, so a compliance programme built for one of them mostly travels.
What does not travel is the layer underneath. The GDPR leaves a set number of choices to national law, and Latvia has made them in the Personal Data Processing Law — a statute that is mostly about the regulator rather than about you. The few provisions that are about you are exactly where a policy copied from abroad goes wrong.
First: does the GDPR apply to you at all
It reaches further than “we operate in Latvia” suggests, through two separate routes.
You have a presence in the EU. The GDPR covers processing carried out in the context of an EU establishment's activities, even if the processing itself happens elsewhere. A Latvian subsidiary with servers in Singapore is covered.
You target or track people in the EU. It also covers companies with no EU presence at all, if they offer goods or services to people in the EU — expressly whether or not anyone pays — or monitor their behaviour. A free product with Latvian users, and analytics following them around, is covered twice over.
Where you are registered is not the test. Where your users are, and whether you are watching them, usually is.
Are you a controller or a processor — and what the contract must say
The two roles carry different duties all the way through, and a technology company is usually both: a controller for its own marketing and staff data, and a processor for whatever its customers put into the product.
Where you act as a processor, the relationship has to be governed by a contract that meets the GDPR's requirements. The content is fixed by the Regulation, so it is worth knowing what has to be in it.
It has to set out the subject matter and duration of the processing, its nature and purpose, the types of data, the categories of people involved, and the controller's rights and duties. It then has to commit the processor to specific things: act only on written instructions, including about transfers abroad; keep staff under a duty of confidence; apply the required security measures; bring in a sub-processor only with prior written permission and on the same terms, staying fully responsible for it; help with people's data rights and with security, breach and impact-assessment duties; delete or return the data at the end; and allow audits.
Two consequences are easy to miss. A processor that starts deciding why and how data is processed becomes a controller for that part. And the European Commission has published standard clauses for this relationship, which can be used instead of drafting from scratch.
The 250-employee exemption almost never applies
This is the most over-read provision in the GDPR. It says you do not have to keep records of processing if you have fewer than 250 employees — and then takes it back where the processing is likely to be risky for people, or is not occasional, or involves sensitive or criminal-offence data.
The middle one does the work. A product that handles user data continuously is not doing it “occasionally”. For most technology companies under 250 employees the exemption simply is not available, and the useful question is which of the three conditions removes it.
What Latvia has actually decided
Six provisions of the Personal Data Processing Law change the answer for a technology business.
| Subject | The Latvian choice |
|---|---|
| Children's consent | Valid from age 13 for online services; below that a parent has to consent |
| Data protection officers | The Inspectorate keeps a public list of officers who have passed its qualification examination, held under a 2020 Cabinet Regulation — but you may appoint someone from the list or anyone else |
| Audit records | Kept no longer than one year after the entry, unless another law or the nature of the processing requires otherwise |
| Camera signage | Must give the controller's name, contact details and purpose, and say where the rest of the information can be obtained |
| Who the data was shared with | How far back this has to go — see below |
| Time limit for claims | Five years to bring a civil claim to stop an infringement, counted from the infringement or, if it continues, from the day it stopped |
The last two are the ones an imported programme will not contain at all. The time limit is a rule the GDPR says nothing about. The provision on who data was shared with needs care: the GDPR's own right covers recipients the data have been or will be disclosed to, with no period attached, so how the Latvian provision sits alongside it is a question to put rather than an answer to assume.
The officer point is the one most often stated backwards. Latvia runs an examination and a register, which is unusual, and it is easy to conclude that a Latvian data protection officer has to be certified. The opposite is true: being on the list gives visibility, not a monopoly.
Reporting a breach, and what enforcement looks like
Latvian law changes nothing here. A controller tells the supervisory authority without undue delay and, where possible, within 72 hours. A processor tells its controller without undue delay — there is no 72-hour figure on the processor's side, and no direct line to the regulator. Security duties under Latvia's separate cybersecurity law are a different obligation, on a different clock, to a different authority.
The fines come from the GDPR itself, in two levels: up to EUR 10 million or 2 per cent of worldwide turnover for controller and processor duties, and up to EUR 20 million or 4 per cent for the basic principles, people's rights and transfers abroad. One thing worth knowing: failing to comply with an order of the supervisory authority sits in the upper level, whatever the obligation the order was about.
What a company should actually plan around is time. The Inspectorate decides within six months of opening a case, extendable to a year, and up to two years where the facts take long to establish or the EU cooperation mechanism is involved. Appealing does not pause the decision.
Where to start
If you already run an EU-wide programme, the Latvian work is narrow: check your age gate against 13, check whether your officer appointment assumed certification was required, and check how long you keep audit records against the one-year rule.
If you have not built the programme yet, work the other way round. Establish which of the two routes brings you into scope, decide role by role whether you are controller or processor, and build the records of processing — the 250-employee exemption almost certainly will not help you, and those records are what every later question gets answered from.