Cybersecurity Policy Report, Processing Activities Not Requiring DPIA Outlined by Latvian Agency, (Mar 6, 2025)
By Tony Foley
The Data State Inspectorate (DVI), Latvia’s data protection authority, has developed a list of data processing activities that do not require data controllers to conduct a data protection impact assessment (DPIA).
The DVI issued guidance in February that specified the circumstances under which controllers must conduct a DPIA. The new documentation, announced in a news release today, is designed to augment this guidance by helping organizations to better understand in which cases the risk of processing activities is sufficiently low as to not require further evaluation.
The press release specifies that the following activities do not require a DPIA:
Processing of personal data of employees only in Latvian territory, provided that it does not involve the processing of biometric or genetic data;
Processing of patients’ health data by self-employed medical practitioners, provided the processing does not result in a transfer of data outside the country;
Processing of personal data by individually practicing lawyers, notaries, and bailiffs, if related to professional secrecy and provided that data is not transferred to a third country;
Processing of customers’ personal data by companies for the provision of services and advertising in Latvia, provided the company is not engaged in large-scale data processing or processing of special categories of personal data;
Processing of the data of members and donors by associations and foundations;
Processing related to the management of residential buildings by associations and cooperatives of apartment owners that is not conducted on a large scale;
Processing of physical access control and timekeeping data, if special categories of personal data are not involved;
Breathalyzer checks performed in the transport sector, if they are required by regulation and are used to make sure that drivers are not under the influence; and
Processing of collective submissions by local governments, as in cases where residents submit a collective application.
The DVI added that this list was not comprehensive and might be supplemented to include new exceptions.
News: InternationalLegislation DataPrivacy DataSecurity GDPR