Where we work · Latvia
ISO and GRC certification consulting in Latvia
Achieve ISO and GRC certification in Latvia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Latvia
Clients include
ISO and GRC certification in Latvia at a glance
Latvian demand for ISO and GRC certification is driven by statute at least as much as by customers. The Data State Inspectorate supervises the GDPR under the Personal Data Processing Law, in force since 2018. The National Cybersecurity Law, in force from 1 September 2024 and written with NIS2 in mind, is backed by Cabinet Regulation No. 397 on minimum cybersecurity requirements and by a data centre security regulation that took effect on 1 October 2026. The Energy Efficiency Law lets large enterprises choose between an energy audit and a certified management system, while the Public Procurement Law tells buyers how to ask for quality and environmental certificates. Wood products, electrical machinery, food, ports and logistics, finance and technology firms feel these rules first, and free ports and special economic zones add industrial sites. Certificates come from certification bodies accredited by the Latvian National Accreditation Bureau, or an equivalent body, never from Sterling. Sterling serves Latvian clients from its Frankfurt office, drawing on 8,100+ client engagements in 60+ countries and 20+ years of experience, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Latvia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Latvia (12)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Personal Data Processing Law Datu valsts inspekcija (the Data State Inspectorate) — the Law describes it as an institution of direct administration under the supervision of the Cabinet, a data supervisory authority within the meaning of the Regulation, and independent in its operation | The Law sets the Inspectorate's tasks and rights, including inspections of data processing, administrative offence proceedings, the data protection certification procedure and publication of violations by public bodies. It also allows the Inspectorate to answer in English when it examines complaints from non-residents. | |
| Data protection officers: official list and qualification examination Datu valsts inspekcija (the Data State Inspectorate), which the Law tasks with checking the qualification of data protection officers and keeping the list of those who passed | A data protection officer can be entered in a list the Inspectorate maintains once the qualification examination is passed, which gives controllers a national reference point when they appoint or outsource the role. | |
| Accreditation of GDPR certification bodies and code-of-conduct monitoring bodies The national accreditation body assesses, accredits and supervises certification bodies, using an opinion from the Data State Inspectorate and the Inspectorate's requirements and criteria | The Law provides a route for GDPR certification bodies and for monitoring bodies of codes of conduct. It does not make certification compulsory, and it is a different matter from ISO management system certification. | |
| Nacionālais kiberdrošības centrs (the National Cybersecurity Centre, NCSC) — the Law names it the national competent authority and single point of contact in cybersecurity matters, implementing national cybersecurity supervision Essential and important service providers and critical ICT infrastructure under the national cybersecurity law | The National Cybersecurity Law (Nacionālās kiberdrošības likums), adopted by the Saeima on 20 June 2024 and in force from 1 September 2024; the Law lists Directive (EU) 2022/2555 (NIS2) among the Union acts its norms arise from. It applies to providers of essential and important services and owners of critical ICT infrastructure. The NCSC's site says Cabinet Regulation No. 397 on minimum cybersecurity requirements entered into force on 2 July 2025. The Regulation names ISO/IEC 27001 Lead Auditor only as an example of a certificate showing an external cybersecurity auditor's knowledge; it does not require an entity to hold ISO/IEC 27001. | ISO/IEC 27001 |
| Nacionālais kiberdrošības centrs (the National Cybersecurity Centre) with the competent incident response institutions Information systems hosted in data centres, and data centre operators serving entities under the cybersecurity law | Cabinet regulation on requirements for hosting information systems and data centre security, which the NCSC says came into force on 1 October 2026. It sets uniform requirements for hosting systems of entities under the cybersecurity law in data centres, for data centre security and for conformity assessment; conformity can be shown by a data centre auditor's opinion, a certificate recognised in the regulation or another conformity document. The NCSC says using a cloud service does not remove the entity's duty to check the data centres behind it. | |
| Latvijas Banka — the National Cybersecurity Law names it as the authority with which the NCSC shares information on cybersecurity of the financial entities referred to in Article 2 of Regulation (EU) 2022/2554 Financial entities in DORA's scope (credit institutions, payment and e-money institutions, investment firms and others) | Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025. The National Cybersecurity Law gives way to DORA and other sector acts where their cybersecurity risk-management and incident-reporting duties are at least equal. Neither text names ISO/IEC 27001. | |
| Pārtikas un veterinārais dienests (the Food and Veterinary Service) — the Law on the Supervision of the Handling of Food says it approves food establishments, assigns approval numbers and registers establishments that need no approval Food business operators | The Law on the Supervision of the Handling of Food (Pārtikas aprites uzraudzības likums), adopted on 19 February 1998 and in force from 20 March 1998, with Regulation (EC) No 852/2004, which requires operators after primary production to maintain procedures based on HACCP principles. Neither text requires a third-party certificate. | HACCP, ISO 22000 |
| Zāļu valsts aģentūra (the State Agency of Medicines of the Republic of Latvia), whose site has sections on medicines, medical devices, and blood, tissue, cells and organs Medicines and medical devices | The Agency's site covers licensed pharmaceutical activity, wholesalers, vigilance for medical devices, clinical investigations and performance studies, and a list of authorised institutions for compliance assessment. For manufacturers, Regulation (EU) 2017/745 says all manufacturers should have a quality management system and a post-market surveillance system; the text does not name ISO 13485. | ISO 13485 |
| Valsts darba inspekcija (the State Labour Inspectorate) — its Law gives it State supervision and control in the field of employment legal relationships and labour protection Employers in all sectors (occupational health and safety) | The Labour Protection Law (Darba aizsardzības likums), adopted on 20 June 2001 and in force from 1 January 2002, defines internal supervision of the working environment and the evaluation of working environment risks, and puts the employer's duties and the Inspectorate's role in law. The State Labour Inspectorate Law took effect on 10 July 2008. Neither names ISO 45001. | ISO 45001 |
| Valsts būvniecības kontroles birojs (the State Construction Control Bureau), which the Energy Efficiency Law makes the responsible institution for energy efficiency monitoring Large enterprises and large electricity consumers | The Energy Efficiency Law (Energoefektivitātes likums), adopted on 3 March 2016 and in force from 29 March 2016. A large enterprise on the Central Statistical Bureau's list must conduct an energy audit and repeat it regularly, or introduce and maintain a certified energy management system in line with the energy management standard, or a certified supplemented environmental management system, in each case covering at least 90 per cent of its final energy consumption. Large electricity consumers face a similar choice. The Law does not name ISO 50001 or ISO 14001. | ISO 50001, ISO 14001 |
| The Whistleblowing Law names the competent authorities and a contact point for whistleblowers Private employers with an internal whistleblowing system duty | The Whistleblowing Law (Trauksmes celšanas likums), adopted on 20 January 2022 and in force from 4 February 2022. Public bodies, and private legal persons above the Law's headcount threshold, must set up an internal whistleblowing system; the Law lets a third party run it, and exempts the headcount threshold for financial and capital market firms and those in anti-money laundering fields. The Law does not name ISO 37001 or ISO 37301. | ISO 37001, ISO 37301 |
| The Artificial Intelligence Centre (Mākslīgā intelekta centrs), which Cabinet Regulation No. 12 of 13 January 2026 charges with organising a special regulatory environment Developers and users of artificial intelligence systems | Cabinet Regulation No. 12 on the procedure by which the Artificial Intelligence Centre organises the special regulatory environment and data processing, in force from 16 January 2026. Project implementers can receive free consultations from competent authorities on whether an AI system meets legal requirements. Regulation (EU) 2024/1689 (the Artificial Intelligence Act) applies beside it; neither is a certification scheme. |
Accreditation and recognition
- Latvijas Nacionālais akreditācijas birojs (the Latvian National Accreditation Bureau, LATAK): National accreditation body — Cabinet Regulation No. 111 of 27 February 2018 makes the State agency a direct administration institution under the Minister for Economics that performs the national accreditation body's functions under the Law On Conformity Assessment, which says conformity assessment bodies are accredited and accreditation decisions taken by the national accreditation body; its tasks also include assessing, under the European cross-border accreditation policy, bodies accredited by other countries' accreditation institutions.
- SIA "Latvijas standarts" — national standardisation body: Standards role only — Cabinet Regulation No. 346 of 1 June 2021 names the company as the body performing the national standardisation body's functions under the Standardisation Law.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public Procurement Law (Publisko iepirkumu likums) and Directive 2014/24/EU (Contracting authorities, with the Procurement Monitoring Bureau running the publication management system): The Law, adopted on 15 December 2016 and in force from 1 March 2017, says that when a contracting authority asks for a certificate of an independent authority on quality assurance standards, it must refer to systems approved by accredited authorities and must accept certificates from accredited authorities in other EU Member States. For environmental management it must refer to EMAS or other standards that conform to European or international environmental management system standards and are approved by accredited authorities. Both rules apply above the contract price thresholds the Cabinet sets. Each authority decides whether to ask at all.
Economic zones
- Free ports and special economic zones: Riga, Ventspils, Liepāja, Rēzekne and Latgale: port and logistics operations, manufacturing, trade and transit
- Latgale Special Economic Zone: manufacturing, infrastructure development
- Export manufacturing and trade base: wood and wood products, electrical machinery and equipment, food and agricultural products
- Artificial intelligence regulatory environment: artificial intelligence, public sector data services, technology start-ups
Sterling in Latvia
Sterling delivers in Latvia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Latvia clients ask
Are certification audits in Latvia conducted in Latvian or English?
The audit language is agreed with the certification body when you apply. Latvian is the official language under the Constitution, so say early whether auditors must read your records and controlled documents in Latvian, in English or in both. A customer contract or regulator's procedure may set its own language rule, and that rule comes first.
Who supervises the GDPR in Latvia?
The Data State Inspectorate, Datu valsts inspekcija. The Personal Data Processing Law makes it the data supervisory authority, independent in its operation, with powers to inspect processing and run administrative offence proceedings. It may answer in English when examining complaints from non-residents. For a particular processing question, ask the Inspectorate or your own counsel.
Is the Latvian NIS2 law in force?
Yes, as the official text records. The National Cybersecurity Law was adopted on 20 June 2024 and has been in force from 1 September 2024, and it lists the NIS2 Directive among the acts its norms arise from. The National Cybersecurity Centre supervises it. Whether your organisation is covered turns on the Law's size and sector tests, so confirm with the Centre or counsel.
Which body accredits certification bodies in Latvia?
The Latvian National Accreditation Bureau, LATAK. A Cabinet regulation gives it the national accreditation body's functions under the Law On Conformity Assessment. EA's directory lists it as an MLA signatory with management system certification among its scopes. Accreditation is by scope, so ask the certification body for its certificate and check the standard is covered.
Can Latvian public buyers ask suppliers for ISO certificates?
They can, within limits set by the Public Procurement Law. If a contracting authority asks for a quality assurance certificate it must refer to systems approved by accredited authorities and accept certificates from accredited authorities elsewhere in the EU. Environmental management certificates follow a similar rule, and the Law ties both to price thresholds. Read the tender documents for what a given authority requires.
Do large Latvian companies need an energy management system?
Not necessarily. The Energy Efficiency Law offers a large enterprise a choice: a regular energy audit, or a certified energy management system, or a certified supplemented environmental management system, each covering at least 90 per cent of final energy consumption. The State Construction Control Bureau is the responsible institution. Check with it or your counsel which option fits.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Personal Data Processing Law — likumi.lv; eur-lex.europa.eu (accessed 18 Oct 2026)
- Data protection officers: official list and qualification examination — likumi.lv (accessed 18 Oct 2026)
- Accreditation of GDPR certification bodies and code-of-conduct monitoring bodies — likumi.lv (accessed 18 Oct 2026)
- The National Cybersecurity Law (Nacionālās kiberdrošības likums), adopted by the Saeima on 20 June 2024 and in force from 1 September 2024; the Law lists Directive (EU) 2022/2555 (NIS2) among the Union acts its norms arise from. It applies to providers of essential and important services and owners of critical ICT infrastructure. The NCSC's site says Cabinet Regulation No. 397 on minimum cybersecurity requirements entered into force on 2 July 2025. The Regulation names ISO/IEC 27001 Lead Auditor only as an example of a certificate showing an external cybersecurity auditor's knowledge; it does not require an entity to hold ISO/IEC 27001. — likumi.lv; cyber.gov.lv (accessed 18 Oct 2026)
- Cabinet regulation on requirements for hosting information systems and data centre security, which the NCSC says came into force on 1 October 2026. It sets uniform requirements for hosting systems of entities under the cybersecurity law in data centres, for data centre security and for conformity assessment; conformity can be shown by a data centre auditor's opinion, a certificate recognised in the regulation or another conformity document. The NCSC says using a cloud service does not remove the entity's duty to check the data centres behind it. — cyber.gov.lv (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025. The National Cybersecurity Law gives way to DORA and other sector acts where their cybersecurity risk-management and incident-reporting duties are at least equal. Neither text names ISO/IEC 27001. — eur-lex.europa.eu; likumi.lv (accessed 18 Oct 2026)
- The Law on the Supervision of the Handling of Food (Pārtikas aprites uzraudzības likums), adopted on 19 February 1998 and in force from 20 March 1998, with Regulation (EC) No 852/2004, which requires operators after primary production to maintain procedures based on HACCP principles. Neither text requires a third-party certificate. — likumi.lv; eur-lex.europa.eu (accessed 18 Oct 2026)
- The Agency's site covers licensed pharmaceutical activity, wholesalers, vigilance for medical devices, clinical investigations and performance studies, and a list of authorised institutions for compliance assessment. For manufacturers, Regulation (EU) 2017/745 says all manufacturers should have a quality management system and a post-market surveillance system; the text does not name ISO 13485. — zva.gov.lv; eur-lex.europa.eu (accessed 18 Oct 2026)
- The Labour Protection Law (Darba aizsardzības likums), adopted on 20 June 2001 and in force from 1 January 2002, defines internal supervision of the working environment and the evaluation of working environment risks, and puts the employer's duties and the Inspectorate's role in law. The State Labour Inspectorate Law took effect on 10 July 2008. Neither names ISO 45001. — likumi.lv (accessed 18 Oct 2026)
- The Energy Efficiency Law (Energoefektivitātes likums), adopted on 3 March 2016 and in force from 29 March 2016. A large enterprise on the Central Statistical Bureau's list must conduct an energy audit and repeat it regularly, or introduce and maintain a certified energy management system in line with the energy management standard, or a certified supplemented environmental management system, in each case covering at least 90 per cent of its final energy consumption. Large electricity consumers face a similar choice. The Law does not name ISO 50001 or ISO 14001. — likumi.lv (accessed 18 Oct 2026)
- The Whistleblowing Law (Trauksmes celšanas likums), adopted on 20 January 2022 and in force from 4 February 2022. Public bodies, and private legal persons above the Law's headcount threshold, must set up an internal whistleblowing system; the Law lets a third party run it, and exempts the headcount threshold for financial and capital market firms and those in anti-money laundering fields. The Law does not name ISO 37001 or ISO 37301. — likumi.lv (accessed 18 Oct 2026)
- Cabinet Regulation No. 12 on the procedure by which the Artificial Intelligence Centre organises the special regulatory environment and data processing, in force from 16 January 2026. Project implementers can receive free consultations from competent authorities on whether an AI system meets legal requirements. Regulation (EU) 2024/1689 (the Artificial Intelligence Act) applies beside it; neither is a certification scheme. — likumi.lv; eur-lex.europa.eu (accessed 18 Oct 2026)
- Latvijas Nacionālais akreditācijas birojs (the Latvian National Accreditation Bureau, LATAK) — european-accreditation.org; likumi.lv (accessed 18 Oct 2026)
- SIA "Latvijas standarts" — national standardisation body — likumi.lv (accessed 18 Oct 2026)
- Public Procurement Law (Publisko iepirkumu likums) and Directive 2014/24/EU — likumi.lv; eur-lex.europa.eu (accessed 18 Oct 2026)
- Free ports and special economic zones: Riga, Ventspils, Liepāja, Rēzekne and Latgale — likumi.lv (accessed 18 Oct 2026)
- Latgale Special Economic Zone — likumi.lv (accessed 18 Oct 2026)
- Export manufacturing and trade base — stat.gov.lv (accessed 18 Oct 2026)
- Artificial intelligence regulatory environment — likumi.lv (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice