National Annex — Latvia
Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.
| Review | Status |
|---|---|
| Confidence | Maintainer reviewed |
| Checked line by line against the legal text | No |
| Reviewed by a lawyer | No |
| Last reviewed | October 2026 |
| Reviewed by | Frederik B. Krogsgaard, maintainer |
| Second reviewer | Wanted, see CONTRIBUTING |
| Next review due | April 2027 |
NIS2 implementation
| Field | Value |
|---|---|
| Implementing law | Nacionālās kiberdrošības likums (National Cybersecurity Law), in force 1 September 2024. Entities had to notify the National Cybersecurity Centre by 1 April 2025. |
| Competent authority | National Cybersecurity Centre under the Ministry of Defence |
| National CSIRT / reporting | CERT.LV |
| Official starting point | https://mod.gov.lv/en/cybersecurity/register-national-cyber-security-centre |
Country notes for your CDC
Annual self-assessment reports go to the National Cybersecurity Centre. Latvia appeared in the May 2025 reasoned opinions over completeness of secondary measures, so verify the current implementing regulations.
Standard checklist for all countries
- GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
- Entity registration completed with the national authority where required
- RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
- Contact established with the national CSIRT before the first incident
- Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
- National guidance and frameworks mapped to your control evidence, per the note above
Selector tag
Tick "Latvia" in tools/regulatory-profile.html to include this country's references under the lv-nat tag.
Open CDC Framework, licensed CC BY 4.0.