Latvia's National Cybersecurity Law is how the country applies the EU's NIS2 Directive, and it changed again in June 2026. If your company runs a website or an online store in Latvia, two questions follow: does the law apply to you, and what does it ask of your site? This guide answers both and ends with a short list for businesses outside its scope.
Who does Latvia's National Cybersecurity Law apply to?
The law covers two groups: essential and important service providers. Both are mostly medium-sized and large companies in sectors the law lists, plus public bodies. A few services, such as electronic communications, DNS and trust services, are covered whatever their size. Having a website or an online store does not, on its own, bring a company into scope.
What counts is what your company does and how big it is. Article 1 of the National Cybersecurity Law (in Latvian) sets the size thresholds:
- Large: at least 250 employees, or net turnover above €50 million, or a balance sheet above €43 million.
- Medium-sized: up to 249 employees, with turnover between €10 and €50 million or a balance sheet between €10 and €43 million.
A company with fewer than 250 people and both turnover and balance sheet under €10 million is therefore normally outside the law, unless it offers one of the size-independent services or is the only provider of its kind in Latvia.
| Group | Who is in it (examples) | Article |
|---|---|---|
| Essential service providers | Large companies in energy, transport, health, drinking water, digital infrastructure and other listed sectors; electronic communications providers, DNS providers and top-level domain registries, qualified trust service providers, public administration bodies | Article 20 |
| Important service providers | Medium-sized companies in the same sectors, plus medium-sized and large companies in postal services, waste management, chemicals, food production and wholesale, manufacturing, online marketplaces, search engines and social networks | Article 21 |
Is an online store covered?
Not because it sells online. The law lists online marketplaces, platforms where other sellers trade, and only medium-sized or large ones. A shop selling its own products is judged by its sector. A medium-sized food producer or wholesaler is in scope, and its online store becomes one of the systems it has to protect.
If you meet the criteria, you assess your own status and notify the National Cybersecurity Centre within a month (Article 22). If you don't, the centre can list you itself.
What does the law require from a covered company?
A covered company must notify the National Cybersecurity Centre, appoint a cybersecurity manager, manage its cyber risks and meet the minimum security requirements set by the Cabinet of Ministers. The head of the organisation is responsible, not only the IT team. Significant incidents are reported on a fixed timetable, and the supervisor can ask for self-assessments and audits.
- Notification. Within a month of meeting the criteria, the company tells the National Cybersecurity Centre, which works under the Ministry of Defence. Changes follow within two weeks.
- A cybersecurity manager. Appointed within three months and reported to the centre within five working days. Once a year the manager checks IT security, takes training and briefs staff.
- Risk management. Proportionate technical and organisational measures, a business continuity plan and the minimum requirements.
- Self-assessment and audit. A self-assessment report, and an audit if the supervisor asks.
Amendments in force since 18 June 2026 took private organisations doing state-delegated tasks off the list of public bodies, abolished the public list of cybersecurity auditors, and let employers check people with privileged access to critical systems against the Criminal Records Register.
Fines reach €10 million for essential and €7 million for important providers, or 2% and 1.4% of turnover for companies above €500 million (Article 46).
What do the minimum requirements mean for your website?
The detail is in Cabinet Regulation No. 397, Minimum Cybersecurity Requirements (in Latvian), in force since 2 July 2025. It covers all of a covered company's IT systems, the website and online store included. Most of it is good maintenance practice, now written down and checked.
Each system gets a security class, A, B or C, which sets how strict the rules are. These parts touch a website most.
| Requirement (Regulation No. 397) | What it means for a website or online store |
|---|---|
| Asset inventory (points 30–32) | The website, hosting, domain, plugins and integrations are on the system list, updated within a month of any change. |
| Vulnerability handling (point 46) | A routine for finding and fixing vulnerabilities in the platform, plugins and server. In practice: regular updates, checked after each one. |
| Access control (points 50–52) | Only the rights each job needs; no daily work from admin accounts. Multi-factor authentication for admins on class B systems, for everyone on class A. |
| Logs (points 57–66) | System and network logs kept for 6, 12 or 18 months by class, protected from changes and deletion. |
| Backups (points 67–75) | A backup restores data, code and configuration. Restores are tested every six months for class A, yearly for class B. |
| Encryption (point 81) | Data sent over public networks is encrypted where technically possible. For a website: HTTPS on every page and form. |
| Outsourcing (points 86–89) | The host or developer must report incidents immediately, accept monitoring, and return or delete the data when the contract ends. |
How fast must a cyber incident be reported?
For a significant incident, a covered company sends an early warning within 24 hours, an initial report within 72 hours and a final report within a month of the initial one. It also tells the users of its service who are affected, without delay. For civilian organisations, the reports go to CERT.LV, Latvia's incident response team.
Reporting deadlines for a significant incident
24 hours
Early warning
A first notice that a significant incident has been detected.
72 hours
Initial report
A first assessment: how serious the incident is and what it affects.
1 month
Final report
What happened, the cause and the measures taken. If the incident isn't resolved by then, a progress report comes first.
Anyone can report an incident to CERT.LV, by email or by phone; the details are on the CERT.LV incidents page. Before restoring the site from a backup, keep the evidence: logs, suspicious files and when you noticed the problem.
What should a small business outside the law still do?
The law asks nothing of you, so there is nothing to register or report. The minimum requirements are still a sound list to start from, because they reduce the same risks on any website. And if you supply IT services to a covered company, its contract may bring the same requirements to your door.
The regulation makes covered companies require their suppliers to report incidents immediately, accept monitoring and return or delete data at the end. If you build or run systems for such a client, plan for that when you quote.
A starter list for your website
- The platform, plugins, theme and server software are updated regularly, and someone checks the site works after each update.
- Backups are stored away from the server, and a restore has been tried at least once a year.
- Admins sign in with multi-factor authentication and use an ordinary account for daily work.
- Accounts of former staff and partners are deleted or blocked.
- The whole site and every form run over HTTPS only.
- You know where the domain, hosting and website logins are kept and who manages them.
- Your maintenance contract says how incidents are reported to you and how you get your data back if you part ways.
- You have one page for an incident: who to call, how to switch off forms or payments, and how to report to CERT.LV.
Some of this you can do yourself. Updates, backup tests and monitoring take steady time, which is what website maintenance and hosting covers: someone is responsible for keeping the software current, the backups working and problems spotted early.
Frequently asked questions
What is NIS2 and how does Latvia apply it?
NIS2 is the EU's cybersecurity directive, 2022/2555. It sets which sectors and companies must manage cyber risk and report incidents, and each member state applies it through its own law. In Latvia that is the National Cybersecurity Law, in force since 1 September 2024, with the detail in Cabinet Regulation No. 397.
Does Latvia's cybersecurity law apply to small businesses?
Usually not. A company with fewer than 250 employees whose turnover and balance sheet are both under €10 million is neither medium-sized nor large under the law. The exceptions are services covered whatever their size, such as electronic communications, DNS and trust services, and a company that is the only provider of its kind of service in Latvia.
Who supervises the National Cybersecurity Law in Latvia?
The National Cybersecurity Centre, under the Ministry of Defence, supervises essential and important service providers and keeps their list. The Constitution Protection Bureau supervises critical ICT infrastructure. CERT.LV takes incident reports from civilian organisations. Companies already covered had to notify the centre by 1 April 2025.
What are the fines under the National Cybersecurity Law?
An essential service provider can be fined up to €10 million and an important one up to €7 million. When a company's turnover exceeds €500 million, the fine can reach 2% or 1.4% of turnover respectively. The amounts are set in Article 46 of the law, and the supervisor decides the fine in each case.
Does the law require a particular host or platform?
No. Neither the law nor Regulation No. 397 names a platform. They ask that systems are listed, updated, backed up and protected by access control, and that supplier contracts include incident reporting. The regulation does bar contracts with IT providers registered in Russia or Belarus, or owned from those countries.
Who do I contact if my website is hacked in Latvia?
Report it to CERT.LV by email or phone, even if your company isn't covered by the law. Say what happened, which systems are affected and when you noticed, and keep logs and suspicious files before restoring. If you have lost money, also report it to the State Police. Covered companies must meet the 24- and 72-hour deadlines too.
