Short answer
Legalcode currently indexes exactly four English-language pages from Latvia's , or Data State Inspectorate (DVI). One is a general guide to data-subject rights under GDPR Articles 15–22. Two explain rights and procedures in the Schengen Information System (SIS) and Visa Information System (VIS). The fourth is a short navigation page linking to those two EU-system guides.
The most broadly useful record is . It addresses access and copies, rectification, erasure, restriction, notification, portability, objection, direct marketing, automated decision-making and the ordinary one-month response period. The SIS and VIS pages add detailed, system-specific routes for requesting access, correction or deletion and for complaining to DVI.
This is a selected collection, not the whole DVI publication surface. It contains no indexed Latvian-language material and no guidance specifically devoted to credit reporting, credit information bureaux, debtor data or credit-history retention. Legalcode Discovery labels it “selected guidance” and reports only four records. Conclusions about what DVI has published generally must not be drawn from this subset.
The complete four-record collection
The production MCP source profile reports LV_DVI as one source inside Latvia's guidance collection and gives it an exact count of four documents. A source-scoped Search with no topical query returned all four, and each exact Search sourceRef was then fetched in full.
The inventory is:
- , published 15 September 2023;
- , published 25 September 2023;
- , published 8 August 2023; and
- , published 8 August 2023.
Three are classified as guidelines. The EU-information-systems page is correctly classified as reference material because it is essentially a link hub rather than an independent legal explanation.
General GDPR rights
The general Rights of the data subject page says that a controller should inform an individual of action taken on a request under GDPR Articles 15–22 without undue delay and ordinarily within one month of receiving it. It then gives short explanations and links for the principal rights.
The access section says that, where an organization processes a person's data, the person may request access to all personal data and receive copies. The next section explains that inaccurate personal data must be corrected without undue delay. The page then covers erasure in the circumstances specified by the GDPR and restriction where accuracy is disputed, processing is unlawful, the controller no longer needs the data but the person needs it for a legal claim, or an objection requires balancing.
You have the right to access your personal data.
—
The page also describes the notification duty associated with rectification, erasure or restriction. If data was disclosed to third parties and later corrected, deleted or restricted, the individual should be informed about that disclosure context. For a person contesting an adverse record, this can matter as much as correcting the controller's own copy.
Portability is presented for consent- or contract-based processing; its legal and technical scope is narrower than access.
The objection section explains the need to balance an individual's data-protection rights against an organization's legitimate interests. It separately notes that a person may object at any time to processing for direct marketing, including requesting removal from the marketing database.
The automated-processing section says individuals may express their view and must receive safeguards where Article 22 applies. It is not a complete credit-scoring policy.
SIS rights and procedure
The page is much more procedural. It explains the SIS and SIRENE structures, identifies the Latvian authorities, and then describes an individual's right to be informed about their data, subject to legal restrictions for national security, defence and criminal-law purposes or restrictions imposed by another Member State.
The page states the core correction principle:
Everyone has the right to request that their personal data be supplemented, corrected, interrupted, or deleted from SIS II.
—
The listed grounds include data that is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the collection purpose. Requests may be sent to the State Police's SIRENE Latvian National Unit, a local police unit, or a Latvian diplomatic or consular mission. The page lists identity details, the requested information and delivery method, accepts Latvian or English submissions, and requires identity verification.
The process is free, and the SIRENE unit ordinarily replies within one month. Incomplete or inaccurate identifying information can lead to refusal, as can legally protected disclosure restrictions. If access, correction or deletion is denied, the individual may ask DVI to verify compliance with their rights. The indexed page also contains updated model letters for access, rectification, erasure and a DVI complaint.
Those forms and routes are specific to SIS/SIRENE. They are not templates for a credit-bureau dispute merely because both situations involve personal data.
VIS rights and retention
The page explains that VIS contains visa-application information, including fingerprints and photographs. Authorized access must be necessary, appropriate and proportionate to official tasks.
It says that VIS data is retained for five years, calculated from the visa's expiry or the relevant negative, modification or other decision date. It then identifies the right to be informed about one's VIS data and to request correction of inaccurate data or deletion of unlawfully recorded data.
If a request is not handled within one month or is rejected, the individual may complain to DVI. National processing is overseen by the relevant national supervisory authority—DVI in Latvia—while European-level activity is monitored by the European Data Protection Supervisor.
The five-year period is a VIS rule. It is not a general Latvian personal-data retention period and must never be reused as a credit-history or debtor-data limit. Retention follows the legal regime governing the actual system.
The navigation page
contains links to the SIS and VIS pages but almost no independent substantive guidance. Treating it as a third full EU-system guide would overstate the collection's depth. Its REFERENCE_MATERIAL classification now reflects its real function.
This distinction matters in corpus analysis. Four records do not equal four independent explanations: one is a general GDPR overview, two are system-specific guides, and one is a navigation layer.
What is not available in this indexed slice
No indexed DVI document in the collection specifically explains:
- credit information bureau access or dispute procedures;
- accuracy and evidential standards for reported debts;
- retention of repaid or disputed credit-history data;
- data-source permissions for credit scoring;
- automated credit decisions in the Latvian lending context; or
- DVI enforcement practice concerning creditors or bureaux.
The general rights page can help formulate an access, correction, restriction or objection request. It cannot supply the sector-specific legal basis, retention period or allocation of responsibility. Those questions require the GDPR, Latvia's Personal Data Processing Law, the Credit Information Bureau Law and the facts of the particular processing operation.
The narrow coverage is tracked in . A zero-result DVI search for a credit-specific topic is therefore evidence only that the four-page indexed slice lacks the material—not that DVI has never published relevant guidance.
MCP source-quality findings
The collection behaved consistently in this audit. Discovery's count of four matched source-scoped Search, every result had a fetchable full text, and the source labels openly described the collection as selected guidance.
A previously reported metadata defect also passed regression testing. The SIS record now reports its source publication date of 8 August 2023 rather than promoting a later model-letter update to the document date. The EU-systems hub is now reference material rather than a guideline. That closed defect is recorded in .
One source-language warning remains. The English general-rights page contains awkward wording—for example, a heading saying that the reader has a right to “access an organization.” Its surrounding text and Article 15 link show that it means access to personal data held by an organization. Researchers should paraphrase the legal point accurately and avoid presenting the awkward heading as a precise formulation of the right.
Practical use of the collection
An individual can use the indexed materials in this order:
- Start with Rights of the data subject to identify the relevant GDPR right and ordinary response period.
- Identify the actual controller and the particular data, processing purpose, recipients and disputed fact.
- If the record is in SIS or VIS, follow the authority, form and identity-verification route on the system-specific page.
- If the matter concerns credit or debt data, move to the applicable Latvian legislation rather than importing SIS or VIS procedures.
- Preserve the request and response, and complain to DVI where the applicable right is refused or not handled in time.
Conclusion
Legalcode's indexed DVI collection contains one useful general guide to GDPR data-subject rights, two detailed guides for SIS and VIS, and one short EU-systems navigation page. It explains access, copies, correction, erasure, restriction, recipient notification, portability, objection, automated decisions, system-specific retention and complaint routes. Its utility is real but bounded: all four records are English, three concern general or border-and-visa contexts, and none supplies credit-reporting-specific guidance. The collection should be cited as a selected four-page slice, never as a complete statement of DVI publications.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.