Latvia Recording Laws: One-Party Consent, GDPR Rules, and Penalties (2026)

Quick Answer: Is Latvia One-Party or All-Party Consent?

Latvia follows a one-party consent standard for the private recording of conversations. A participant in a telephone call or face-to-face conversation may record that conversation without notifying the other parties and without obtaining their consent. This is the baseline rule under Latvian criminal law because Section 144 of the Criminal Law (Krimināllikums) targets unauthorized interception by non-participants, not recordings made by active participants.

However, one-party consent governs only the act of recording. What you do with the recording afterward triggers a separate and significant legal regime: the EU General Data Protection Regulation (GDPR) and Latvia's Personal Data Processing Law (Fizisko personu datu apstrādes likums) regulate the storage, use, sharing, and deletion of any recording containing identifiable voices or images. A recording that is legally made under one-party consent can still expose you to GDPR liability if you process it without a lawful basis.

This article covers the full legal framework: Criminal Law Sections 143-145 and the 2024 deepfake amendment (Article 90.1), the Constitutional privacy protections under the Satversme, GDPR obligations and DVI enforcement, government surveillance under the Operational Activities Law, workplace monitoring, public recording, the EU AI Act's 2026 obligations, and cross-border considerations. It addresses the law of the Republic of Latvia as of May 2026.

Overview of Latvia's Recording Laws

Latvia is a member state of the European Union located in the Baltic region of Northern Europe. Its legal framework governing the recording of conversations draws from multiple sources: the Latvian Constitution (Satversme), the Criminal Law (Krimināllikums), the Operational Activities Law (Operatīvās darbības likums), the Electronic Communications Law (Elektronisko sakaru likums), and the EU General Data Protection Regulation as implemented by Latvia's Personal Data Processing Law.

The relevant criminal provisions for recording and surveillance fall primarily within Chapter XIV of the Criminal Law, which addresses offenses against the fundamental rights and freedoms of persons. The key sections are:

• Section 143: Violation of the inviolability of a dwelling (relevant when covert surveillance involves unauthorized entry)
• Section 144: Violation of confidentiality of correspondence and telecommunications (the primary wiretapping provision)
• Section 145: Illegal activities involving personal data of natural persons

In May 2024, the Saeima (Latvian parliament) also added Article 90.1, which specifically targets the use of deepfake technologies to influence elections.

Understanding all of these overlapping legal frameworks is essential for anyone who records conversations in Latvia, whether for personal, journalistic, legal, or business purposes.

Constitutional Protections for Privacy

The Latvian Constitution, known as the Satversme, establishes the foundational right to privacy in Article 96. This provision guarantees everyone the right to inviolability of their private life, home, and correspondence.

The Constitutional Court of Latvia (Satversmes tiesa) has interpreted Article 96 broadly to include the protection of personal data. The court has confirmed that recording, storing, and sharing personal communications can constitute an interference with the right to private life protected under the Satversme.

Permissible Limitations Under Article 116

Article 116 of the Satversme permits restrictions on the rights guaranteed in Article 96, but only through laws that are necessary to protect the rights of other persons, the democratic structure of the state, public safety, welfare, and morals. Any restriction must be proportionate to its legitimate aim.

This constitutional framework means that while recording a conversation you participate in is legally permitted, distributing or publishing that recording in ways that infringe on another person's privacy could violate constitutional protections if the interference is not justified by a legitimate purpose.

Freedom of Expression Under Article 100

Article 100 of the Satversme protects freedom of expression and press freedom. The Constitutional Court has held that this provision encompasses both freedom of the press in its broader definition and the right of the public to receive information. This constitutional guarantee is relevant to journalists and ordinary citizens who record matters of public interest, including the conduct of public officials.

Criminal Law Provisions on Recording and Privacy

Latvia's Criminal Law (Krimināllikums) contains several provisions relevant to recording and surveillance. The most directly applicable sections fall within Chapter XIV, which addresses offenses against the fundamental rights and freedoms of persons.

Section 144: Violation of Confidentiality of Correspondence and Telecommunications

Section 144 is the primary criminal provision governing unauthorized interception of private communications. The section provides:

Subsection (1): For a person who commits intentional violation of the confidentiality of personal correspondence, information in the form of transmissions over a telecommunications network, or the confidentiality of information and programs provided for use in connection with electronic data processing, the applicable punishment is deprivation of liberty for a term of up to two years, or temporary deprivation of liberty, or community service, or a fine.

Subsection (2): For a person who commits the same acts for the purpose of acquiring property, the applicable punishment is deprivation of liberty for a term of up to five years, or temporary deprivation of liberty, or community service, or a fine.

Section 144 targets third-party interception of communications. It does not criminalize a participant in a conversation from recording that conversation. The provision addresses non-participants who intercept, tap, or otherwise intrude into communications to which they are not a party. This is the statutory basis for Latvia's one-party consent framework.

Section 145: Illegal Activities Involving Personal Data

Section 145 of the Criminal Law addresses illegal activities involving personal data of natural persons. Where such illegal activities cause substantial harm, the applicable punishment is deprivation of liberty up to two years.

This provision complements Section 144 by addressing the handling of personal data obtained through communications. A person who intercepts a communication under Section 144 and then exploits the personal data within it could face liability under both provisions.

Section 143: Violation of the Inviolability of a Dwelling

Section 143 of the Criminal Law prescribes liability for illegal entry into a residence against the will of the person residing there. While not directly about recording, this provision is relevant when covert recording involves unauthorized entry into someone's home. Placing a hidden recording device inside another person's dwelling without authorization could trigger liability under this section in addition to Section 144.

Article 90.1: Deepfake Technologies and Elections

In May 2024, the Saeima enacted Article 90.1 of the Criminal Law, making Latvia one of the first EU member states to directly criminalize the use of AI-generated synthetic media in the political context. The provision criminalizes the production or dissemination of intentionally false, discrediting information about a political party, a candidate for the Saeima, a municipal council, or a Member of the European Parliament, using deepfake technologies (including synthetic photo, video, and audio materials), if committed during the pre-election campaigning period or on election day. The penalty is deprivation of liberty up to five years, temporary deprivation of liberty, probation supervision, or community service. The law also criminalizes using automated data processing systems to prevent persons from participating in democratic processes.

One-Party Consent: What It Means in Practice

Latvia's one-party consent framework means that if you are a participant in a conversation, whether in person or over the phone, you may record that conversation without telling the other parties. This applies to both audio and video recording where you are physically present or actively participating in the call.

Phone Recordings

When you make or receive a phone call in Latvia, you are legally permitted to record the call as long as you are one of the parties to the conversation. There is no statutory requirement to announce that you are recording or to obtain the other party's consent before pressing record.

However, the subsequent use of that recording is subject to data protection rules. If you plan to share, publish, or use the recording for a purpose beyond your own personal reference, you must have a lawful basis under the GDPR to process the personal data contained in the recording.

In-Person Recordings

The same one-party consent principle applies to face-to-face conversations. If you are physically present in a conversation, you may record it. There is no distinction in Latvian law between recording a phone call and recording an in-person discussion, provided you are an active participant.

Recording a conversation to which you are not a party, whether by planting a hidden device, intercepting a phone line, or using other surveillance technology, is illegal under Section 144 of the Criminal Law and potentially under the Operational Activities Law as well.

Important Limitations

While making the recording may be legal, the following uses could expose you to civil or criminal liability:

• Publishing the recording in a way that violates someone's privacy rights under Article 96 of the Satversme
• Using the recording to defame someone under Latvia's civil liability provisions
• Disclosing trade secrets or confidential business information captured in the recording
• Violating the terms of a non-disclosure agreement or other contractual obligation
• Processing the recording without a GDPR lawful basis where identifiable personal data is involved

GDPR and Data Protection Requirements

As an EU member state, Latvia is subject to the General Data Protection Regulation (EU) 2016/679, which has applied directly since May 25, 2018. Latvia further implemented the GDPR through its Personal Data Processing Law (Fizisko personu datu apstrādes likums), which entered into force on July 5, 2018.

How GDPR Applies to Recordings

A recording of a conversation containing identifiable voices constitutes personal data under the GDPR. The act of recording, storing, reviewing, sharing, or deleting that recording is considered "processing" of personal data.

Any person or organization that records conversations must identify a lawful basis for processing under Article 6 of the GDPR. The six lawful bases are:

1. Consent of the data subject (the person being recorded)
2. Contractual necessity (the recording is needed to perform a contract)
3. Legal obligation (a law requires the recording)
4. Vital interests (the recording protects someone's life)
5. Public task (the recording is needed for an official function)
6. Legitimate interests (the recorder's interests outweigh the data subject's rights)

For most private recordings, the legitimate interest basis is the most commonly relied upon, provided the recorder can demonstrate that the purpose of the recording outweighs the privacy expectations of the recorded individual.

The Personal/Household Exemption

The GDPR includes a household exemption under Article 2(2)(c), which provides that the regulation does not apply to data processing carried out by a natural person in the course of a purely personal or household activity. If you record a conversation purely for your own personal reference and do not share it publicly, the full weight of GDPR obligations may not apply.

Latvia's Personal Data Processing Law reinforces this exemption and extends it specifically to dash cameras used in road traffic and CCTV cameras used for personal household security, provided the surveillance does not cover public spaces on a large scale.

Data Protection Authority: Datu valsts inspekcija (DVI)

The Data State Inspectorate (Datu valsts inspekcija, or DVI) is Latvia's national supervisory authority for data protection. Established in 2001 and headquartered in Riga, the DVI enforces the GDPR and the Personal Data Processing Law.

The DVI has the power to investigate complaints, conduct audits, and impose administrative fines. Notable enforcement actions include:

• SIA TET (September 2022): The DVI imposed a EUR 1.2 million fine for customer data processing violations. In June 2024, the Riga Regional Court upheld the DVI's decision following an appeal by Tet Ltd.
• Lursoft IT (November 2020): EUR 65,000 fine for publishing non-public register data.
• SIA ZZ Dats (October 2025): EUR 300,000 fine for failure to implement adequate technical and organizational security measures under GDPR Article 32, related to unauthorized access to data from 42 Latvian municipalities' Unified Municipal Information System. ZZ Dats has appealed to Riga City Court.

GDPR Penalties

Violations of the GDPR in Latvia can result in administrative fines of up to 20 million euros or 4% of the organization's annual worldwide turnover, whichever is higher. In addition, Latvia's Criminal Law provides that illegal processing of personal data that causes material damage can result in imprisonment for up to five years.

Government and Law Enforcement Surveillance

The legal framework for government surveillance in Latvia is governed primarily by the Operational Activities Law (Operatīvās darbības likums) and supplemented by the Criminal Procedure Law (Kriminālprocesa likums).

The Operational Activities Law

The Operational Activities Law establishes the legal basis, principles, objectives, and procedures for covert investigative activities conducted by authorized state institutions. Under this law, operational activities include the use of audio and video recording equipment, technical surveillance tools, and electronic interception capabilities.

Only officials of state institutions specifically authorized by law may conduct operational surveillance activities. These authorized bodies include the State Police, the State Security Service (Valsts drošības dienests, VDD), the Constitution Protection Bureau (SAB), and the Military Intelligence and Security Service (MIDD).

Judicial Authorization Requirement

Wiretapping and the interception of private communications by law enforcement require prior authorization from an investigating judge. This judicial oversight requirement applies to:

• Telephone wiretapping and monitoring
• Interception of electronic communications (email, messaging)
• Covert audio recording of conversations where the surveilling party is not a participant
• Monitoring of mail and physical correspondence

The investigating judge must determine that the surveillance is necessary, proportionate, and that the information sought cannot reasonably be obtained through less intrusive means. Operational wiretapping may only be used to investigate crimes, not lesser offenses.

Heightened Surveillance at the Russian Border

Latvia has significantly expanded its national security surveillance infrastructure in response to Russian intelligence threats. In December 2025, Latvia completed a 280-kilometer physical barrier along its border with Russia. The border is equipped with smart surveillance infrastructure, including electronic communications networks, cameras, presence detection systems, and associated monitoring equipment.

Latvia's State Security Service (VDD) identified Russian intelligence as the primary national security threat in its 2024 Annual Report. The VDD noted that Russian intelligence services have been increasing activity in Latvia as part of a broader Kremlin strategy to establish instability along EU and NATO borders. Belarus acts as a supporting element of Russian intelligence, with its territory used for electronic intelligence operations against the Baltic states.

Persons traveling in or near Latvia's eastern border regions should be aware that surveillance infrastructure is operational and that national security legislation may apply to communications in monitored zones.

Data Retention by Telecommunications Providers

Under Latvia's Electronic Communications Law (Elektronisko sakaru likums), telecommunications operators are required to retain certain call data for a minimum period of 18 months. As of the 2022 update implementing the European Electronic Communications Code (EECC), internet service providers must also retain specified user activity data.

Operators are strictly prohibited from disclosing any information about interception activities to the subjects of surveillance or to third parties, except where explicitly authorized by law.

Recording Police Officers and Public Officials

Recording police officers performing their official duties is constitutionally protected under Article 100 of the Satversme, which guarantees freedom of expression and the right to receive information. However, this protection is qualified by data protection obligations and the circumstances of the recording.

The leading authority on this question is CJEU Case C-345/17, Buivids v. Datu valsts inspekcija. In this case, a Latvian citizen, Mr. Buivids, filmed police officers at a police station while giving a statement (without notifying the officers) and subsequently published the video on YouTube. The national DVI found a data protection violation. The Latvian Supreme Court referred the matter to the Court of Justice of the EU, which ruled that:

1. The filming and uploading of the video constituted processing of personal data falling within the scope of EU data protection law.
2. The filming could potentially qualify as processing solely for journalistic purposes, which attracts a derogation from normal GDPR requirements, provided the "sole object" of the activity was the disclosure of information, opinions, or ideas to the public.
3. Whether Mr. Buivids' specific actions qualified as journalistic activities was left for the Latvian Supreme Court to determine, balancing his right to freedom of expression against the officers' right to privacy.

In practical terms, citizens recording police conduct in public or semi-public settings (such as a police station lobby) may rely on the journalistic purposes derogation if the recording is made for the purpose of documenting matters of public interest and not for private or commercial use. The Buivids ruling does not grant blanket permission: the specific facts, location, and purpose of the recording determine whether the derogation applies.

Workplace Recording and Employee Monitoring

Workplace recording and employee monitoring in Latvia are governed primarily by the GDPR, Latvia's Personal Data Processing Law, and the Labour Law (Darba likums). There is no standalone Latvian statute specifically addressing workplace surveillance, so the general data protection framework applies.

Employer Obligations

Employers who wish to record telephone conversations, install CCTV cameras, or monitor electronic communications in the workplace must:

• Identify a lawful basis for the monitoring under GDPR Article 6
• Inform employees about the monitoring in advance, in accordance with GDPR Articles 13 and 14
• Conduct a Data Protection Impact Assessment (DPIA) if the monitoring involves systematic observation of employees or monitoring of publicly accessible areas
• Limit the monitoring to what is strictly necessary and proportionate to the stated purpose
• Establish clear retention periods and delete recordings when they are no longer needed

CCTV in the Workplace

Latvia's Personal Data Processing Law specifies minimum requirements for CCTV informative signs, which must include the name and contact information of the data controller, the purpose of the data processing, and information about how to exercise data subject rights under Article 13 of the GDPR. A general recommended maximum retention period of 30 days applies to workplace CCTV recordings unless a longer period can be specifically justified.

Hidden surveillance cameras in the workplace are generally not permitted. The DVI and European Data Protection Board guidelines require transparency in employee monitoring. Covert recording of employees may only be justified in exceptional circumstances, such as when there is a reasonable suspicion of criminal activity and less intrusive methods have been exhausted.

Employee Recording of Workplace Meetings

Under Latvia's interpretation of the legitimate interests basis in GDPR Article 6(1)(f), employees may record workplace meetings when they have a legitimate interest in doing so, such as protecting their own legal rights in the context of a dispute with their employer. Employees who exercise this right should follow any formal internal procedures the employer has established on the subject. Employers are advised to adopt clear recording policies to prevent disputes about whether a recording was justified.

Audio Recording of Employee Calls

Employers in financial services and other regulated industries may be required to record customer-facing telephone calls under the EU Markets in Financial Instruments Directive II (MiFID II). In such cases, the legal obligation provides the lawful basis under the GDPR, but employers must still inform employees and customers that calls are being recorded.

Recording in Public Places

Recording in public spaces in Latvia is generally permitted, but specific rules apply depending on the nature and scale of the recording.

Personal Photography and Video

Individuals may record in public places for personal purposes. The GDPR household exemption typically applies to casual photography and video recording for personal use, such as recording a family outing or a public event.

Journalism and Media

Latvia protects freedom of expression and press freedom under Article 100 of the Satversme and the relevant provisions of the European Convention on Human Rights. Journalists may record in public spaces, and the GDPR provides derogations for journalistic purposes.

Large-Scale Surveillance

CCTV surveillance of public areas on a large scale is subject to the full requirements of the GDPR, including conducting a Data Protection Impact Assessment, posting informative signage, establishing retention limits, and consulting with the DVI if the risk cannot be adequately mitigated.

AI-Generated Content and Deepfake Law in Latvia

Latvia has developed one of the EU's most specific legislative responses to AI-generated synthetic media in the context of recording and identity.

Article 90.1 of the Criminal Law (2024)

As described above, Article 90.1 of the Criminal Law, enacted in May 2024, criminalizes election-related deepfakes. The law is notable for specifically including audio materials within the definition of prohibited synthetic content, which means AI-generated voice cloning used to create false statements attributed to candidates is covered by the criminal prohibition.

While Article 90.1 targets election contexts, the combination of this provision with existing Criminal Law protections (Section 144 on communications confidentiality, Section 145 on personal data misuse) and civil defamation law creates a layered framework against harmful uses of synthetic recordings outside the election context as well.

EU AI Act: Disclosure Requirements for Synthetic Audio and Video

The EU AI Act (Regulation (EU) 2024/1689), which entered into force on August 1, 2024 and becomes fully applicable on August 2, 2026, introduces mandatory disclosure obligations for AI-generated and AI-manipulated content. Article 50(4) of the AI Act specifically requires that AI systems generating or manipulating audio, video, image, or text content (including deepfakes) must ensure that the output is labeled in a machine-readable format and that disclosure of the artificial nature of the content is made to persons exposed to it.

In Latvia, VARAM (the Ministry of Smart Administration and Regional Development) is designated as the primary national authority responsible for AI Act implementation. The State Data Inspectorate (DVI) has been assigned responsibility for overseeing compliance with the AI Act's provisions on prohibited AI practices and high-risk AI systems.

For anyone who uses AI tools to generate, edit, or synthesize recordings of conversations or voice content, the practical implication is:

• From August 2, 2026, synthetic audio and video content must carry machine-readable disclosure labels
• Distributing AI-generated recordings of real persons without disclosure may violate both the AI Act and, if defamatory, the Criminal Law
• Political use of synthetic voice/video content during election periods is criminalized under Article 90.1 regardless of the AI Act timeline

Latvia's Pre-Election Agitation Law Amendments (2024)

Separately from the Criminal Law amendment, Latvia also enacted 2024 amendments to the Pre-election Agitation Law introducing mandatory disclosure requirements for AI-generated content in political advertising. Political parties and candidates must clearly disclose when campaign materials have been created or altered using AI tools. This complements Article 90.1 by addressing the broader use of AI in campaigns beyond just malicious deepfakes.

Penalties Summary

Understanding the full range of penalties for illegal recording and surveillance in Latvia is essential for compliance.

Criminal Penalties

Offense	Provision	Maximum Penalty
Unauthorized interception of communications	Criminal Law Section 144(1)	Up to 2 years imprisonment
Same offense committed for financial gain	Criminal Law Section 144(2)	Up to 5 years imprisonment
Illegal activities involving personal data causing substantial harm	Criminal Law Section 145	Up to 2 years imprisonment
Illegal processing of personal data causing material harm	Criminal Law	Up to 5 years imprisonment
Unauthorized entry into a dwelling (e.g., to plant a recording device)	Criminal Law Section 143	Criminal liability with imprisonment
Deepfake use to influence elections or prevent electoral participation	Criminal Law Article 90.1 (2024)	Up to 5 years imprisonment

Administrative Penalties (GDPR)

Violation Type	Maximum Fine
Standard GDPR violations (e.g., procedural non-compliance)	Up to 10 million euros or 2% of global turnover
Serious GDPR violations (unlawful processing, consent violations)	Up to 20 million euros or 4% of global turnover
Administrative sanctions against liable officials	Up to 1,000 euros

Civil Liability

Individuals whose privacy rights have been violated by unlawful recording may pursue civil claims for damages under Latvian civil law. The limitation period for GDPR compensation claims in Latvia is five years.

Business Compliance Guidelines

Organizations operating in Latvia that record conversations or conduct surveillance should follow these compliance steps to minimize legal risk.

Before Recording

1. Identify the lawful basis under GDPR Article 6 for the recording activity
2. Conduct a Data Protection Impact Assessment if the recording involves systematic monitoring, large-scale processing, or surveillance of publicly accessible areas
3. Draft a privacy notice that clearly explains the recording activity, its purpose, the legal basis, retention period, and data subject rights
4. Implement technical safeguards including access controls, encryption, and secure storage for recordings
5. Assess AI Act obligations if any recordings involve AI-generated or AI-altered content (mandatory disclosure labeling from August 2, 2026)

During Recording

6. Provide notice to individuals being recorded through verbal announcements, signage, or automated messages at the start of calls
7. Limit the scope of recording to what is strictly necessary for the stated purpose
8. Train employees on recording policies and data protection obligations

After Recording

9. Establish retention schedules and delete recordings promptly when they are no longer needed (CCTV recordings: 30-day general guideline)
10. Respond to data subject requests including access, erasure, and portability requests within the GDPR's one-month timeframe
11. Report data breaches involving recordings to the DVI within 72 hours and to affected individuals without undue delay if the breach poses a high risk

Cross-Border Recording: EU Adequacy and Russia Context

EU Adequacy and GDPR

Latvia is an EU member state, which means that transfers of recordings or personal data derived from recordings to other EU member states require no additional legal mechanism. All EU member states are presumed adequate under GDPR. Transfers to non-EU countries must comply with Chapter V of the GDPR (adequacy decisions, standard contractual clauses, binding corporate rules, or other permitted mechanisms).

Russia and Belarus: Heightened Awareness

Persons who communicate with individuals in Russia or Belarus should be aware of a materially different legal environment. Russia and Belarus are not subject to GDPR, do not maintain EU adequacy status, and operate extensive state surveillance apparatus. Communications originating in Latvia that cross into Russian or Belarusian telecommunications infrastructure may be subject to interception by those states' security services, which operate outside Latvian or EU legal frameworks.

Within Latvia itself, communications near the Russian border are subject to Latvia's enhanced national security surveillance infrastructure (as described above). This does not affect the legality of ordinary citizens' recordings; the Operational Activities Law's judicial authorization requirement still applies to any Latvian state surveillance of Latvian persons.

Comparison With Neighboring Countries

Latvia's one-party consent approach is shared by several of its neighbors and trading partners, though important differences exist in how countries apply GDPR and local law to recorded content.

Estonia, Latvia's northern neighbor, also follows a one-party consent framework with similar GDPR obligations. Lithuania, to the south, likewise operates under a one-party consent model with GDPR overlay requirements.

By contrast, many Western European countries impose stricter consent requirements for recording. Germany, for example, requires all-party consent and treats unauthorized recording as a criminal offense under Section 201 of the German Criminal Code. France similarly requires consent from all parties under Article 226-1 of the French Penal Code. Organizations doing business across multiple EU jurisdictions should carefully review the specific recording laws of each country where they operate.