Short answer
The controlling Latvian statute is the , translated here as the Credit Information Bureau Law. Legalcode's production MCP returned one exact current result for that Latvian title. The indexed consolidated version has been effective since 1 July 2020, is identified by official publication number 2014/199.2, and remains marked as the current version as of 13 September 2026.
The Act is not merely a licensing statute. It defines credit information, creditworthiness and credit risk; limits the purposes and sources for which a licensed bureau may process information; regulates entry, disclosure, retention, access and correction of debt information; and places licensing and supervision with Datu valsts inspekcija, Latvia's data-protection authority.
It must nevertheless be read with the GDPR and Latvia's Personal Data Processing Law. It also draws explicit boundaries around the separate Credit Register and out-of-court debt-recovery databases. Those regimes may concern similar facts, but they are not interchangeable. A record in a bank-operated credit register, a debt collector's history database and a licensed credit information bureau record do not derive their legal basis from the same statute.
The controlling Act and current version
The Act's Latvian title is decisive: Kredītinformācijas biroju likums. A phrase search confined to the current Likumi.lv law collection returned exactly one result. Fetching that result produced the complete consolidated text rather than a search snippet. The source itself labels the instrument as in force and the displayed version as running from 1 July 2020 onward.
The law first identifies the regulated operator. Section 1 defines a credit information bureau as a joint-stock company carrying out one or more licensed bureau activities under the Act. This means that the label describes a legally regulated activity, not any business that happens to collect corporate or payment information.
Section 3 gives the clearest answer to the scope question:
Likums regulē kredītinformācijas biroju darbību un kredītinformācijas apstrādes kārtību šajā likumā noteikto licencējamo kredītinformācijas biroju darbību ietvaros.
—
In substance, the Act regulates both the operation of credit information bureaux and the processing of credit information within the licensed activities it defines.
Purpose and permitted use
Section 2 frames the system around responsible lending and borrowing, formation of a person's credit history, protection of individuals' rights, and the use of truthful and complete information when creditworthiness is evaluated. A bureau therefore cannot justify unlimited collection merely because more data might improve a commercial score.
Section 4 turns that purpose into an operational boundary. A licensed bureau processes credit information so that an authorized user can obtain it for one of two purposes: assessing a customer or prospective customer's creditworthiness, or managing the user's own credit risk. Reuse for unrelated advertising, employment screening or general profiling is not authorized simply because the information already sits in a bureau database.
The Act also limits sources. Under Section 6, information may come from authorized bureau users, another bureau in circumstances provided by law, permitted state information systems, and eligible EU or EEA foreign credit-information sources. The existence of a technically accessible website or dataset does not automatically make it a lawful bureau source.
Licensing and supervision
Section 7 identifies the activities for which a licence is needed. They include processing credit information about individuals for disclosure to third parties for the statutory purposes, and obtaining restricted information from state systems for a person who has a legal basis to receive it.
The licensing requirement is expressed directly:
Kredītinformācijas birojam ir nepieciešama licence, lai sniegtu kādu no šādiem pakalpojumiem.
—
Datu valsts inspekcija issues a licence for five years under Section 8. The Act requires the authority to publish identifying, contact, ownership and licence-status information about licensed bureaux. If a bureau ceases operating or loses its licence, accumulated credit information must generally be deleted, archived as legally required, or transferred to another licensed bureau within the authority's deadline.
Section 23 confirms the supervisory allocation:
Kredītinformācijas biroja darbību uzrauga Datu valsts inspekcija.
—
The authority may audit bureaux, obtain information and documents, order correction or deletion of inaccurate or unlawfully entered information, suspend or revoke licences, hear complaints and impose administrative penalties within its competence.
What the Act regulates beyond licensing
The statute contains a substantial data-governance regime. Sections 11 and 12 specify when debt information may be entered and what the database may contain. The ordinary non-judgment route generally requires at least 60 days from the first default and at least 30 days after a prescribed warning, with separate treatment where the customer has objected. The database records not only identity and amount information but also relevant dates, repayment or termination information and whether the debt is disputed.
Section 16 governs retention. Debt-related information is generally kept for five years after payment or another qualifying end to the debt, subject to a ten-year outer limit from the first default. Unpaid debt information may be kept for ten years from the first default. Different rules apply to request logs, other fulfilled payment obligations and information obtainable from public registers.
Sections 18 and 19 regulate lawful access. A bureau user needs consent, a right arising from the customer agreement, or another GDPR-compatible basis. The individual may obtain information processed about them, free online or in person, with postal access subject to delivery costs.
Sections 20–22 divide responsibility between the bureau and the user that supplied the information. They require a written-objection process, a dispute marker while the matter is examined, correction or deletion where an error is established, and notification to bureau users that received the corrected information during the preceding 12 months.
Related laws are not substitutes
Section 3 expressly connects the special Act to the GDPR and the , Latvia's Personal Data Processing Law. Those general rules apply to a customer or prospective customer's data unless the special Act provides otherwise. The special statute supplies sector-specific purposes, actors, source rules, retention rules and procedures; the general framework supplies the wider data-protection principles and rights.
The Act also says that it does not govern the debt-history databases regulated by the . A debt collector's database therefore cannot be treated as though it were necessarily a licensed credit information bureau database.
Likewise, the governs the separate Credit Register. The Credit Information Bureau Law may address how a bureau intermediary obtains register information, but it does not replace the register's own legal regime.
Currentness and source quality
The current Legalcode record is internally coherent. It identifies one current consolidated version, four historical versions and two linked amendments. That is an improvement over an earlier metadata defect, now closed, in which the same family reported no amendments despite its version history.
The retrieval test did expose an existing search limitation. The exact Latvian phrase found the controlling Act uniquely. The English query credit information bureau returned 21 results, but its first ten were largely unrelated postal instruments containing generic English words and did not include the controlling Act. This cross-language and diacritic recall problem is already tracked in . Until that is resolved, a null or noisy English search must not be treated as proof that Latvian authority is absent.
Practical identification checklist
Before treating a Latvian dataset or provider as operating under this Act, check:
- whether the provider performs one of the licensed activities in Section 7;
- whether Datu valsts inspekcija has issued a current licence;
- whether the data concerns an individual customer or prospective customer;
- whether the processing purpose is creditworthiness assessment or credit-risk management;
- whether the data comes from a source permitted by Section 6; and
- whether a different regime—particularly the Credit Register or an out-of-court debt-recovery database—actually governs the record.
The answer depends on function and legal basis, not merely on a product name containing “credit”, “risk” or “information”.
Conclusion
The current Latvian law governing licensed credit information bureaux is the Kredītinformācijas biroju likums. Its current consolidated Likumi.lv version has applied since 1 July 2020. It combines licensing and supervision with detailed rules on permitted purposes, sources, debt entry, retention, disclosure, individual access, accuracy and correction. It operates alongside the GDPR and Latvia's Personal Data Processing Law, while expressly separating credit-bureau processing from the Credit Register and out-of-court debt-recovery history databases.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.