Personal data protection without the headache
GDPR and the Latvian Personal Data Processing Law apply to every company that handles personal data. Our certified specialist organizes and supervises your data processing: records, policies, training and breach response, so an inspection finds order instead of gaps.
What you get out of it
Compliance you can prove
A processing inventory and an Article 30 register show an inspector exactly what personal data you process, why and on what legal basis.
Documents that fit Latvian law
Privacy policies, consent texts and internal security regulations written for your company, with Latvian-law specifics handled in Latvian language documents.
Staff that know the rules
Training and clear breach response guidance, so your employees do not become your biggest data protection risk.
DPO without a full-time hire
Where the law requires a data protection officer, our specialist takes the duty on an outsourced retainer instead of a new position on your payroll.
What the service includes
- Processing inventory and Article 30 records
- Privacy policies and consent texts
- Video surveillance registration and signage
- Internal security regulations for information systems
- Staff training and breach response guidance
- Ongoing outsourced DPO duty where the law requires one
Price on request: a one-off project or a fixed monthly retainer, sized to your processing.
How it works
- 1
Inventory
We map what personal data you process, where it lives and on what legal basis, for companies and public institutions alike.
- 2
Documents and training
We prepare the Article 30 register, policies, consent texts, signage and internal regulations, then train your staff.
- 3
Ongoing supervision
The specialist supervises processing, guides you through incidents and covers the DPO duty on a monthly retainer.
Data protection questions
When does a company need a data protection officer?
GDPR requires a DPO for public authorities and for organizations whose core activities involve large-scale regular monitoring of people or large-scale processing of special category data, such as health data. Many Latvian companies fall outside that duty but still need someone competent to run compliance. Our certified specialist covers both cases: the mandatory DPO duty or voluntary supervision.
How large can GDPR fines be?
The legal maximums for the most serious violations are up to 20 million EUR or 4% of worldwide annual turnover, whichever is higher. Real fines are scaled to the gravity of the case, but even a small one comes with reputational damage and orders to change your processing. Organized records, policies and training cost far less than any of that.
What is the Article 30 register?
It is the record of processing activities that GDPR Article 30 obliges most organizations to keep: what personal data you process, for what purpose, on what legal basis, who receives it and how long you keep it. It is the first document a supervisory authority asks for. We build it during the processing inventory and keep it current.
What are the video surveillance rules in Latvia?
Cameras must serve a defined lawful purpose, monitored areas need signage naming the operator and the purpose, and footage retention and access must be documented. We handle the registration and signage requirements and write the accompanying documentation, in Latvian where Latvian law requires it.
How does the monthly retainer work?
You pay a fixed monthly fee and our certified specialist acts as your ongoing data protection function: keeps the records current, reviews new processing, trains staff and guides you through incidents. Where the law requires a DPO, the retainer covers that duty too. The price is quoted per company once we see the scope of your processing.
How is this different from your NIS2 service?
NIS2 is about the cybersecurity of critical services: infrastructure, incident reporting and technical controls. Data protection is about personal data and GDPR duties: records, legal bases, policies and people's rights. Many clients need both, and the two services complement each other alongside our IT audit.
How fast can you set everything up?
The timeline depends on how many processing activities you have. We start with the inventory, then agree a document and training plan with clear deadlines. A small company gets the base set quickly, larger organizations are handled in stages.
Do you work with public institutions?
Yes, the service covers both private companies and public institutions in Latvia. Public bodies must appoint a data protection officer under GDPR, and our specialist can take that duty as an outsourced service, with Latvian-law documents prepared in Latvian.