Cybersecurity Policy Report, Latvian Agency Eyes Building Management Data Processing Activities, (Jan 6, 2026)

By Tony Foley

The Latvian Data Protection Inspectorate (DVI) recently outlined the findings of a preventive inspection it conducted regarding the data processing activities of the largest companies in the country that provide residential building management services.

In a press release announcing the findings, the DVI said the purpose of the inspection was to determine how residential building management companies balanced the management tasks set out in regulatory enactments and concluded service contracts with the regulatory requirements on the processing of personal data. The scope of the inspection considered questions received by the DVI regarding managers’ unjustified transfers of personal data to third parties or data processing in information systems, as well as requests from managers for guidance on how to process personal data in accordance with the law.

The DVI concluded that the inspection generally indicated an optimal level of knowledge about personal data processing among residential building managers but identified a number of shortcomings in their activities. Specifically, the DVI found deficiencies in internal controls developed by the managers, errors in application of legal grounds for processing, the provision of incomplete information to data subjects about their processing activities, and potential conflicts of interest in the appointment of data protection officers, among other findings.

The full text of the DVI’s report on the inspection may be downloaded from the press release but is available only in Latvian.

News: InternationalLegislation DataPrivacy DataSecurity