Latvia
(a) What is the NIS2 implementation status?
The National Cybersecurity Law, which implements NIS 2, was adopted by the Saeima (the Parliament of Latvia) in its third and final reading on 20 June 2024. The Cabinet of Ministers is now expected to pass regulations and issue instructions on various cybersecurity-related matters by 17 October 2024.
(b) What is the envisaged NIS2 implementation timeline?
The National Cybersecurity Law came into force on 1 September 2024.
(c) What does the NIS2 mean for other national cybersecurity legislation?
The National Cybersecurity Law repealed the Law on the Security of Information Technologies, which had been in force since 1 February 2011. It empowered the Cabinet of Ministers to pass regulations and issue instructions on various cybersecurity risk management issues, such as, for instance (i) minimum cybersecurity requirements, (ii) cybersecurity compliance self-assessment, (iii) requirements for cybersecurity managers and auditors, (iv) criteria for evaluating and reporting cybersecurity incidents, and (v) requirements for information and communication technology continuity action plans.
(d) Who will be the supervisory authority and how are they preparing the market?
The National Cybersecurity Centre (NCC) is the primary authority responsible for handling cybersecurity-related matters. It serves as the central contact point for addressing cybersecurity issues, overseeing national cybersecurity efforts, developing cybersecurity policies, and fostering international collaboration in the cybersecurity domain. The NCC also monitors the cybersecurity of essential and important service providers, except for the entities constituting critical information and communication technology infrastructure. Historically, responsibility for the cybersecurity of critical information and communication technology infrastructure has fallen within the remit of the Constitution Protection Bureau.
(e) What should you be doing/on the lookout for?
The Ministry of Defence has estimated that the National Cybersecurity Law (NCL) applies to approximately 2,000 entities, in particular essential and important service providers, as well as critical information and communication technology infrastructure. Articles 20 and 21 of the NCL set out the criteria for classifying service providers into these categories, while the Cabinet of Ministers approves the list of critical information and communication technology infrastructure.
Service providers are required to conduct a self-assessment and, if eligible, notify their status under the NCL to the National Cybersecurity Centre by 1 April 2025. The NCL subjects shall appoint a cybersecurity manager and submit a self-assessment report by 1 October 2025. This report shall detail their compliance and/or non-compliance with the minimum cybersecurity requirements, which consist of suitable and proportionate technical and organisational measures aimed at managing cybersecurity risks and addressing cybersecurity incidents.
In the event of a major cybersecurity incident, the NCL subjects shall promptly report such an incident to the relevant cybersecurity incident prevention institution. An early warning of a major cybersecurity incident shall be submitted immediately, but no later than within 24 hours, while the initial report on the incident shall be provided within 72 hours. The final report on the major cybersecurity incident shall be presented to the relevant cybersecurity incident prevention institution within a month. The NCL also encourages the reporting of cybersecurity incidents of lesser magnitude, near-miss incidents, and cybersecurity threats.
Gross non-compliance with the NCL requirements may result in penalties, including: (i) up to EUR 10 million or up to 2% of net turnover for essential service providers, (ii) up to EUR 7 million or up to 1.4% of net turnover for important service providers, and (iii) up to EUR 10 million or up to 2% of net turnover for the owners of critical information and communication technology infrastructure.
Contact
Dmitrijs Ņemirovskis E: dmitrijs.nemirovskis@eversheds-sutherland.lv
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Share this page