Latvia — GDPR + EU AI Act + Latvian AI Strategy 2021-2027: AI Compliance Requirements

Who Does This Apply To?

Applies to: any organisation established in Latvia, and any organisation outside Latvia processing the personal data of Latvian residents through AI systems — GDPR applies with extraterritorial reach (Art. 3), obligations attaching to the processing activity rather than company size, with no general small-business exemption. As an EU member state, Latvia is fully subject to the EU AI Act: AI used for creditworthiness assessment, insurance underwriting or logistics optimisation involving Latvian users falls under Annex III high-risk classification, requiring conformity assessment, technical documentation and post-market monitoring. The Datu valsts inspekcija (DVI) requires a documented lawful basis for AI training data sourced from Latvia, a DPIA for AI-driven employee profiling, financial scoring or large-scale consumer profiling, and DPO appointment for public authorities and large-scale processors. DVI applies Article 22 to third-party credit-bureau AI scores used in lending even where the lender makes the final decision, requiring a meaningful explanation to the individual. Penalties reach €20M / 4% of global turnover under GDPR and €35M / 7% under the EU AI Act.