Short answer
They apply together. Latvia's Credit Information Bureau Law supplies a specialised dispute workflow: before certain default information is entered, the creditor must address a written objection with reasons and supporting documents; after entry, an objection to either the bureau or supplier triggers an immediate dispute marker and a reasoned supplier review, normally within one month. Confirmed errors must be corrected or deleted, and a continuing rejected objection to a debt's existence or amount remains marked.
The GDPR adds broader, operation-specific duties. Data must be accurate and current; the person may seek access, rectification, completion, erasure on a listed ground, or restriction while accuracy is verified. Rectification, erasure or restriction may require notice to recipients. Objection to processing and safeguards for significant solely automated decisions are separate questions.
A dispute marker does not decide whether the debt exists, and it is not automatically the same as GDPR restriction. The creditor, bureau and lender must distinguish the underlying civil claim from accuracy, legal basis, retention, disclosure and decision use. DVI can supervise processing; a court may still be needed to determine the debt.
Why both regimes apply
Section 3(2) of the , the Credit Information Bureau Law, states the relationship expressly:
Klienta vai iespējamā klienta datu apstrādi un aizsardzību nosaka … regula (ES) 2016/679 … un Fizisko personu datu apstrādes likums, ciktāl šis likums nenosaka citādi.
—
In English, the GDPR and Latvia's Personal Data Processing Law govern customer and prospective-customer data processing and protection to the extent the special bureau law does not provide otherwise. The special statute gives concrete bureau rules; it does not make general data-protection principles disappear.
A dispute before the default is entered
Section 11 first distinguishes uncontested and disputed routes. Outside a final court or arbitral decision and consent route, entry generally requires at least 60 days from the first missed-payment date and at least 30 days from the statutory warning.
If the customer has not objected, the supplier may use the uncontested route after those periods while the debt remains unpaid. If the customer has objected to existence or amount, the supplier must instead send a reasoned response, provide copies of documents supporting the debt's existence and amount, and tell the customer that the information will be entered.
If the supplier receives repeated written objections before entry, Section 11(3) requires the entry to state at least that the customer has objected to the debt's existence or amount. The statute therefore does not treat the supplier's rejection as a judicial finding or allow the dispute context to vanish.
A dispute after the default is in the bureau
Section 22 lets the individual object in writing to either the bureau or the credit-information user that supplied the data. Supporting documents can accompany the objection.
If the supplier receives it, the supplier immediately informs the bureau. If the bureau receives it and its record matches what the supplier sent, the bureau immediately forwards it to the supplier. In either route, the bureau marks the specific information as disputed pending the reasoned response. The supplier has one month to review and respond.
Kamēr nav saņemta kredītinformācijas lietotāja pamatota atbilde, kredītinformācijas birojs savā datubāzē izdara atzīmi, ka ir saņemts klienta iebildums.
—
The mark matters because Section 12 also treats written objections and a pending court dispute over existence or amount as part of the bureau record. A later lender should not receive the adverse event stripped of that qualifying context.
Who checks what?
The law divides responsibility.
The bureau is responsible under Section 20 for ensuring that its database corresponds to the information supplied by the user. The supplier is responsible under Section 21 for complete and true information consistent with the customer agreement and for current updates. A transcription mismatch is bureau-side; an error in the underlying contract, payment, identity or amount is supplier-side.
This allocation routes investigation; it does not remove GDPR responsibility for processing controlled by either organisation.
Correction, deletion and continued disagreement
If the bureau discovers that its record does not match the supplier's data, or the supplier confirms that erroneous data were entered, Section 22(5) requires the bureau to correct or delete the information. It must promptly inform bureau users to whom it supplied that information during the preceding 12 months.
If the supplier rejects the objection and the person continues to dispute the existence or amount of a debt, Section 22(6) requires the bureau to retain a marker that written objections were made. That is not an order to delete an otherwise lawfully retained record, but neither is it permission to label the supplier's position as settled fact.
For payment-obligation information that is not debt information, the statute links a rejected objection to the Section 16(3) deletion-request mechanism. Even there, deletion is unavailable if the supplier still has a lawful basis and statutory purpose for keeping the information.
GDPR accuracy and rectification
GDPR Article 5(1)(d) requires personal data to be accurate and, where necessary, kept up to date. Reasonable steps must ensure that inaccurate data are erased or rectified without delay, having regard to processing purposes. Article 5(2) makes the controller responsible for demonstrating compliance.
Article 15 provides access to data, purposes, recipients, source information, retention criteria and relevant automated-decision information. Article 16 gives a right to rectification without undue delay and to complete incomplete data through a supplementary statement—important where a “default” field omits payment, assignment or litigation context.
Restriction is more than a dispute label
GDPR Article 18(1)(a) provides:
The data subject shall have the right to obtain from the controller restriction of processing where … the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
—
During restriction, storage may continue, but other processing is limited to the grounds Article 18 lists. The individual must be informed before restriction is lifted.
The Latvian dispute marker communicates that an objection exists. The statutory text does not say that every marker automatically performs every consequence of Article 18. A person can therefore frame a request clearly: mark the dispute under Section 22 and, where Article 18 conditions are met, restrict the contested processing during verification. The controller should answer each right invoked rather than treating the marker as a universal substitute.
Erasure is not automatic
GDPR Article 17 contains specified erasure grounds, including data no longer necessary for the purpose or unlawful processing. It also contains exceptions, including legal obligations and legal claims.
Dispute alone does not prove an erasure ground. Nor does later payment necessarily make every historical fact inaccurate. A paid debt should be updated to show current amount, termination method and date; whether historical retention remains lawful is a separate purpose, basis and retention inquiry under the special statute and GDPR.
Conversely, mistaken identity, fabricated debt, incorrect amount or data kept without a lawful basis may require correction or erasure. The requested remedy should match the defect.
Who must learn about the correction?
The special statute creates a concrete minimum: users that received the erroneous information in the preceding 12 months must be told promptly after Section 22 correction or deletion.
GDPR Article 19 separately says a controller communicates rectification, erasure or restriction to each recipient to whom the data were disclosed unless that is impossible or requires disproportionate effort. On request, the controller tells the individual who those recipients are.
Because Section 3 preserves GDPR application unless the bureau law provides otherwise, a controller should not assume without analysis that the special 12-month rule exhausts every Article 19 obligation. It should document which provision governs, which recipients were notified, and any impossibility or disproportionate-effort conclusion.
Effect on a lender's decision
A lender may still have to assess creditworthiness and manage real risk. But a marked default should be evaluated as a disputed assertion with supporting and contrary evidence—not silently converted into an adjudicated fact.
If refusal or another significant effect is based solely on automated processing, GDPR Article 22 requires separate analysis and may require human intervention, an opportunity to express a view and a way to contest the decision.
Complaint and court routes
Datu valsts inspekcija supervises bureau activity. Section 23 allows DVI to inspect, obtain information and order erroneous or unlawfully entered information corrected or deleted. GDPR Article 77 preserves the supervisory-complaint route, and Article 79 preserves an effective judicial remedy.
A civil court may still be needed to decide whether the contract, assignment, payment or debt itself exists and in what amount.
MCP source-quality findings
The production MCP fetched the current Latvian bureau statute and the exact EU GDPR record. An overconstrained Latvian excerpt query gave a transparent no-match warning; a narrower retry succeeded. Latvian structural section retrieval remains tracked in .
The consolidated GDPR record still labels 4 May 2016—the Official Journal publication date—as its effective date and exposes a truncated title, while Article 99 says entry into force occurred 20 days after publication and application began 25 May 2018. The parallel Sector 3 record now gives the correct 24 May 2016 entry date. Fresh production evidence was added to closed .
Conclusion
Latvia's bureau statute makes a dispute visible and assigns an immediate investigation path; the GDPR supplies broader accuracy, restriction, rectification, erasure, recipient-notification and remedy rules. The decisive discipline is to keep the questions separate: what the creditor claims, whether the bureau copied it correctly, whether the data are accurate and complete, whether processing may continue, what later lenders were told, and who has authority to decide the underlying debt.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.