NIS2 in Latvia

Nacionālās kiberdrošības likums

Law in force since 2024-09-01

Law: NKDL
Authority: National Cyber Security Centre (NKDC)
Classes: būtisko pakalpojumu sniedzējs (essential), svarīgo pakalpojumu sniedzējs (important)
Register: NKDC status notification (official e-address)
ISO 27001: Not named in the law
Self-check: NKDC NKDL tests

Know when Latvia changes its NIS2 rules

One email when the law, the deadlines or the portal change.

The law

The law took effect on 2024-09-01. A law of 2026-06-04 amended it with effect from 2026-06-18. One part of that amendment applies from 2026-10-01.

Name: Nacionālās kiberdrošības likumsNational Cybersecurity Law
Published: 2024-07-04
In force: 2024-09-01
Text: Read the NKDL

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Latvia differs

Art. 20(3) NKDL Electronic communications providers are essential at any size. Under the Directive, only medium and larger ones are essential.
Art. 20(3) NKDL Electronic communications providers are essential at any size. Under the Directive, only medium and larger ones are essential.

Also note

The NKDC offers an interactive test. It tells you if the law applies and which authority supervises you.

Registration

Assess your own status. Notify the NKDC within 1 month after you meet the status. Companies in scope at the start had to notify by 2025-04-01. Report a change within 2 weeks. Domain name registration providers must register at any size.

Portal: NKDC status notification (official e-address)
Rule: Deadline counts from the day you come into scope
Deadline: 2025-04-01
Later entrants: 1 month after you come into scope
You need: An official e-address (e-adrese) and a signed status-notification form. Send the form as an attachment to "Aizsardzības ministrija Nacionālais kiberdrošības centrs".
Changes: Report changes to your data within 14 days

Incident reporting

24 hEarly warning
72 hIncident notification
1 monthFinal reportafter the initial report

Send the reports to the competent incident-prevention body. For private companies this is CERT.LV at the University of Latvia.

Essential entities also report to the Constitution Protection Bureau (SAB). Trust service providers file the initial report within 24 hours. The duty applies from 2025-07-01. Send the report by email with a secure electronic signature. If the incident is still open, send a progress report first.

Measures and proof

Essential: Essential entities send a self-assessment report to the NKDC each year if they own ICT critical infrastructure or a class A system. Others send one every 3 years. The NKDC can order an external audit if it suspects a breach.
Important: Important entities follow the same self-assessment rule: yearly with a class A system, otherwise every 3 years. The NKDC can order an external audit by an independent auditor. The entity pays for it.

The dates, in order

2025-04-01 First status notification due
2025-07-01 Incident reporting duties apply
2025-10-01 First self-assessment report due; yearly due date is 1 October
2026-06-18 2026 amendments in force
2026-10-01 National-security companies, foundations and associations become essential

Duties of management

The head of the entity runs cybersecurity management and answers for it. The head names a cybersecurity manager within 3 months after the status notice.

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

Fine ceilings, Art. 46 NKDL. The higher amount applies. Each "At EUR" figure is the ceiling at that entity turnover.
Class	Ceiling	At EUR 20m	At EUR 500m	At EUR 2bn
Essential	EUR 10m or 2%	EUR 10m	EUR 10m	EUR 40m
Important	EUR 7m or 1.4%	EUR 7m	EUR 7m	EUR 28m

The percentage applies only when the entity own net turnover exceeds EUR 500,000,000. Below that, the cap is the fixed amount. The percentage uses the entity itself, not the group.