Cybersecurity law in Latvia: NIS2 compliance (2026)

Latvia's National Cyber Security Law (Nacionālās kiberdrošības likums) replaced the 2010 Information Technologies Security Law, creating the National Cybersecurity Centre under the Ministry of Defence and expanding covered sectors beyond the NIS2 baseline. The law introduced mandatory cybersecurity managers, a National Cybersecurity Council, and self-assessment obligations with staggered compliance deadlines through October 2025.

Intensive, targeted DDoS attacks began against Latvian public-sector and transport-sector internet resources, causing intermittent disruptions; CERT.LV characterised the volume as the highest in two years. The campaign, attributed to Russia-linked threat actors, illustrated Latvia's front-line exposure to cyber-enabled hybrid warfare and directly reinforced the urgency of the incoming National Cyber Security Law.

Latvia's parliament passed the National Cyber Security Law in final reading, transposing the EU NIS2 Directive ahead of the EU-wide October 2024 deadline and establishing stronger incident-reporting obligations, expanded sector coverage, and new governance structures including the National Cybersecurity Council. The new law also provided for the Constitutional Protection Bureau (SAB) and CERT.LV to play reinforced supervisory roles.

Latvia's Cabinet adopted its third national cybersecurity strategy, driven by Russia's full-scale invasion of Ukraine and the resulting surge in hybrid cyber threats against Baltic critical infrastructure. The strategy prioritised creation of the National Cybersecurity Centre, NIS2 transposition, resilience of critical infrastructure, and enhanced NATO and EU cooperation.

Latvia's government adopted its second national cybersecurity strategy, defining five action areas: ICT system resilience, universal access to strategic systems, public awareness and education, international cooperation, and the rule of law in cyberspace. The strategy formalised implementation of NIS Directive obligations already in force and set the groundwork for sector-specific security requirements.

CERT.LV, Latvia's national computer emergency response team, moved from the Ministry of Transport to oversight by the Ministry of Defence, reflecting the strategic reclassification of cybersecurity as a national security and defence matter. This institutional alignment prefigured the later embedding of all cybersecurity governance within the defence ministry structure.

Latvia's parliament adopted the Law on the Security of Information Technologies (in force from 1 February 2011), formally establishing CERT.LV under the University of Latvia's Institute of Mathematics and Computer Science and creating statutory duties for incident handling and critical information infrastructure protection. The law served as the primary national cybersecurity instrument for 13 years until replaced in 2024.

The Council of Europe Convention on Cybercrime became binding on Latvia (signed May 2004, ratified April 2007), harmonising Latvian criminal law with international standards on computer-related offences, electronic evidence, and mutual legal assistance. Latvia simultaneously joined the Additional Protocol criminalising racist and xenophobic content distributed through computer systems.