Do we have to consult employee representatives?

Where they exist, yes: information in good time and consultation before decisions that may materially affect working conditions. Consultation is defined as dialogue with the aim of reaching an agreement, which is an objective rather than a condition. There is no veto anywhere in Latvian law.

May we present a Latvian number we do not hold?

No, in practice. The regulator's numbering fraud rules name complete or partial alteration of the calling number as a fraud indicator, along with using a number nobody holds rights in, and require the operator to stop routing the traffic immediately once fraud is established.

May a party to the call record it?

Unresolved, and we say so rather than guessing. The offence is drafted as interception of transmissions or signals in a network, which a party receiving its own call is not obviously doing, and no Latvian instrument or decision settling the point could be found. Latvia has no recording-consent statute.

Compliance

Voice phishing simulations in Latvia

Phone numbers in LatviaProvisioned by Callstrike after approval

Latvia asks less of a voice phishing simulation on paper than almost anywhere else in this portal, because it declined to legislate on employee monitoring at all and Callstrike supplies the number. The constraint moved to the network instead: altering the calling number is a named fraud indicator here, and a Latvian operator that establishes it is obliged to cut the traffic rather than merely permitted to.

Phone numbers

Supplied by Callstrike

Local numbers in Latvia, after a one-time approval.

Running a simulation

Permitted, with an unusually short file

No employment chapter and no monitoring provision, so the Regulation governs alone.

Consent

Evidence of notice

The regulator has published nothing on employee monitoring, so do not borrow its view.

Getting a phone number in Latvia

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Latvian numbers are not released from open inventory, so your workspace is cleared for Latvia once and Callstrike then provisions a dedicated number against that clearance. The carrier's ask is a single address inside Latvia, and the detail that sends filings back is not the address itself but the age of the document proving it: the evidence has to have been issued within the last six months, so a lease or a bank statement from a folder assembled two years ago will not carry the filing. Pull a fresh one before you start.

The rule that decides whether a Latvian campaign runs is the strictest in this batch and it is directed at your operator rather than at you. The regulator's numbering fraud rules define fraud by a list of indicators, the first of which is the complete or partial alteration of the calling number, with a narrow exception for adding a country code to a number received in base format. Others cover calling from a number nobody holds rights in, and using another operator's numbering rights without its agreement. The consequence is immediate rather than discretionary: the operator shall without delay stop routing the traffic once it has established fraud, and must report to the regulator within ten working days. Contrast Slovakia next door, where the equivalent provision merely entitles an operator to block. Same European framework, opposite operational result.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Latvia is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
AddressAddress must be within Latvia Document must be issued within the past 6 months	Utility bill, Bank statement, Lease agreement, Government issued document

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Latvia?

The position in short, before your counsel reads the detail below.

Yes, and Latvia is a genuine negative that is worth establishing carefully rather than assuming, because a page that took every member state to have used the employment opening would invent a Latvian rule that does not exist. The implementing act has thirty-nine sections and no employment chapter; its only surveillance provision is about what an informative sign must say about video, which does not reach audio or telephony on any reading. The labour code contains no monitoring provision at all. There is no Latvian analogue of the provision next door in Slovakia that names the recording of employees' telephone calls in terms.

So you are on the Regulation itself, with the ordinary balancing assessment and no domestic overlay, and that makes the Latvian file genuinely shorter than Romania's, Croatia's or Slovakia's. Be careful about one shortcut, though. The regulator has said something useful about recording, and it said it about merchants recording calls with customers: the controller's legitimate interests as the basis, and recording without prior information not meeting the Regulation's requirements. That is customer-call guidance. It has published nothing on employee monitoring and nothing on the validity of agreement in employment, and moving its customer statement across that boundary and presenting it as an employment rule is the easiest mistake available on this country.

Whether a party may record its own call is unresolved in Latvia and we would rather say so than guess. The relevant offence is drafted around the network: it reaches unlawfully intercepting non-publicly-available data transmissions or signals in electronic communications networks. A party recording audio it is itself receiving is not obviously intercepting a transmission passing through a network, but that is a reading of the text and we found no Latvian instrument or decision settling it. The neighbouring offence about unlawful acts with personal data is easier to rule out because it is gated on motive, biting where the acts were for revenge, gain or blackmail or where substantial harm was caused. What Latvia does not have is the Slovak-style rule requiring a person's permission for a recording of their expressions of a personal nature, and that single absence is why two neighbouring member states working from the same directives give opposite answers on a recorded simulation.

The consultation duty is real and is regularly overstated. Employee representatives have the right to receive information in good time and to consult before you take decisions that may affect employees' interests, in particular decisions materially affecting remuneration, working conditions and employment, which covers a monitoring measure comfortably on the working-conditions limb. The act defines consultation as an exchange of views and dialogue with the aim of reaching an agreement, and that phrase describes the character of the dialogue rather than setting a condition. Nothing makes your decision conditional on assent, and there is no veto anywhere in Latvian law over a monitoring measure. Whether there is anybody to consult is a separate question: representatives may be elected at five or more employees, and where no union operates and none have been elected the article simply has no addressee.

What your company needs to do

6 items, in the order you will need them.

Confirm the number you will present is one you hold rights inLatvia-specificComplete or partial alteration of the calling number is the first named fraud indicator in the Latvian rules, and calling from a number nobody holds rights in is another. The operator's duty on establishing fraud is to stop routing without delay, so this is not an exposure to a later argument. It is the reason a Latvian campaign stops mid-flight with nothing in the report to explain it.
Pull the address evidence freshLatvia-specificThe carrier wants an address inside Latvia evidenced by a document issued within the last six months, which quietly rules out the standard corporate pack that gets reused for every filing. Ask for a current utility bill, bank statement, lease or government-issued document at the point you start rather than discovering the age limit on rejection.
Write the balancing assessment, because nothing else willThere is no domestic overlay to work from here, so the Regulation's own assessment is the whole of the Latvian legal file: the purpose, why a less intrusive method would not achieve it, the effect on the people tested and what you will never use the result for. A lighter regime means less to comply with, not less to write.
Do not borrow the regulator's customer-call guidanceLatvia-specificIts April 2025 statement is about merchants recording calls with customers. It supports the balancing basis and prior information, and it says nothing about employees. Treating it as an employment rule is an extension the regulator has not made, and building a programme on it means building on an authority that does not cover you.
Take the recording question to Latvian counsel, or design around itLatvia-specificThe offence is framed as interception in the network and no Latvian source resolves whether it reaches a party to the call. Latvia has no recording-permission statute of the Slovak kind, so the position is open rather than adverse. If you would rather not open it at all, capture the outcome and the timestamp and leave the audio alone.
Inform and consult where representatives existIn good time, and before the decision rather than before the rollout. Consultation here is dialogue with the aim of reaching agreement, which is an objective and not a condition, so plan to have the conversation and to decide at the end of it. Below five employees, and in the many Latvian workplaces above that which have never elected anyone, the duty has no addressee.

The controls that do the work

How Callstrike is configured, and which provision in Latvia each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Latvia gives you no domestic overlay to lean on, so the balancing assessment under the Regulation is the entire legal case for the programme and it has to carry its own weight. The call ends the instant an employee begins to give up a credential, so the processing you are justifying is a record that somebody was about to disclose rather than the credential itself. That is a materially smaller thing to weigh against an employee's interests, and in a country with nothing else to cite it is the strongest fact the assessment has.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The consultation duty here is about decisions that may materially affect working conditions, and what representatives will want to know is what the exercise does to the person on the other end of the call. A second voice that breaks character the moment the call ends, with vishing training in writing the same day, is the concrete thing to put in front of them, and it makes the working-conditions conversation about learning rather than about catching people out.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Latvia has published nothing on the validity of employee agreement, so this is not a permission and nobody should present it as one. Its job is the transparency notice the balancing assessment depends on and the record that the information duty to representatives was discharged in good time: a dated per-employee trail, or a hashed copy of the policy you already rely on with a signed attestation of its scope.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the answer to the Latvian delivery problem rather than to a Latvian legal one, and here that is the binding constraint. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module, and a browser call presents no calling number to a Latvian operator at all, so the fraud indicators that oblige it to stop routing have nothing to match against.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

A statute book that says nothing about watching employees

Latvia is a genuine negative and it is worth establishing carefully, because a page that assumes every member state took the employment derogation would invent a Latvian rule that does not exist.

The Latvian implementing act has thirty-nine sections. Their headings run from terms and purpose, through the constitution of the supervisory authority, its inspection powers, the qualification of data protection officers, accreditation and appeals, into processing rules for research, official publications, statistics and archiving, freedom of expression, child consent and law enforcement processing, and out through public registers, linking of databases, professional supervision and penalties. The word for employees appears only in provisions about the authority's own staff. There is no employment chapter to find.

The one surveillance rule in the act is confined to video. It provides that where a controller uses an informative sign to inform data subjects about video surveillance, the sign must state at least the controller's name, contact details and the purpose of processing, and must indicate how to obtain the rest of the transparency information. That is a rule about a sign on a wall. It does not reach audio or telephony on any reading.

The labour code is the same story. We counted the consolidated text through for the Latvian words for surveillance, video surveillance, control mechanism and personal data, and every one of them returns nothing. Latvia has no analogue of the provision next door in Slovakia that names the recording of employees' telephone calls in terms. So an employer running a security test in Latvia is on the Regulation itself, and the assessment is the ordinary balancing one with no domestic overlay.

The regulator has said one useful thing about recording and we are going to quote it with its scope attached. In April 2025 it explained what merchants must bear in mind when recording telephone conversations with customers, naming the pursuit of the controller's legitimate interests as the basis and stating that recording conversations without prior information does not meet the requirements of the Regulation. That is customer-call guidance. The regulator has published nothing on employee monitoring and nothing on the validity of consent in employment, and we are not going to move its customer statement across the boundary and present it as an employment rule.

An offence about pulling data off the network, and nothing else

The Latvian criminal provision is drafted around the network rather than around the conversation, and that shape decides most of the analysis.

It is an offence, punishable by deprivation of liberty of up to two years or lesser measures, intentionally to violate the secrecy of a person's correspondence. It is a separate offence, punishable by up to three years, unlawfully to intercept non-publicly-available data transmissions or signals in electronic communications networks, or unlawfully to acquire non-publicly-available electromagnetic data from such a network. Where either is committed for purposes of gain the ceiling rises to five years.

The word doing the work in the second limb is interception, and it is framed as interception in the network. A party to a call who records audio it is itself receiving is not obviously intercepting a transmission passing through a network. That is a reading of the text rather than an answer, and we did not find any Latvian instrument or decision that settles it, so we are leaving it open rather than telling you something we cannot support.

The neighbouring offence about unlawful acts with personal data is easier to rule out, because it is gated on motive. It bites where the acts were committed for purposes of revenge, gain or blackmail, or where substantial harm was caused. An authorised, documented internal exercise satisfies none of those on its face.

What matters most about Latvia here is what is absent. Slovakia has a civil code provision requiring a person's permission to make or to use a recording of their expressions of a personal nature, with only three statutory licences, none of which an employer can use. Latvia has no equivalent anywhere in its statute book. That single difference is why two neighbouring member states, working from the same directives, produce opposite answers on a recorded simulation, and it is why a Latvian page must not be written as a Slovak one with the names changed.

The constitutional backdrop remains: everyone has the right to inviolability of private life, home and correspondence. That is where a civil claim would start, and it is the reason the absence of a specific statutory rule is not the same as permission.

The rule is not in the telecoms act, and it is about advertising

Two currency traps sit on the road to this answer and both would read as clean passes.

The first is the act itself. The electronic communications act of 2004 that most sources still cite is repealed, and the official portal titles it as having lost force. The act in force was adopted in July 2022, and the regulator links exactly that text from its own sector page, so the identification is independent rather than inferred.

The second is where the rule lives. The European rule on unsolicited communications is not transposed in the telecoms act at all: we counted it through for the Latvian words for marketing and commercial and both return nothing. It sits instead in the information society services act, which prohibits using, for the sending of a commercial communication, automatic calling systems operating without human intervention, electronic mail or fax machines by which individual contact with the recipient is possible, unless the recipient has previously given free and unambiguous consent.

The gate is therefore the phrase commercial communication, and that phrase is defined in the same act as any communication in electronic form intended for the direct or indirect advertising of goods or services, or for advertising the image of a merchant, organisation or person carrying on commercial, economic or regulated professional activity. An authorised internal security test advertises nothing, so the prohibition is not engaged. A further paragraph confines the prohibitions to commercial communications sent to natural persons.

The transparency duty in Article 50 of the EU AI Act applies here directly and needs no national act. Since 2 August 2026 a provider must design a system intended to interact directly with people so that they are informed they are dealing with an AI system, and a deployer of a system generating or manipulating audio constituting a deep fake must disclose that the content is artificially generated, in each case at the latest at the first interaction or exposure. The exceptions cover uses authorised by law for criminal law purposes and evidently artistic work, and an employer's own authorisation is neither.

The companion prohibition is worth reading before adding analytics. Using AI systems to infer emotions of a natural person in the workplace has been prohibited since 2 February 2025, at up to thirty-five million euros or seven per cent of worldwide turnover, outside a narrow medical or safety exception whose key phrase is defined nowhere in the binding text. What gates the prohibition is a definition confined to inference from biometric data, with readily apparent expressions and a raised voice excluded by the recitals.

Latvia has not designated a national authority for any of this in binding law so far as we could establish. We searched the official legislation portal for an instrument on artificial intelligence and found none, and the European Commission's own page listing national competent authorities returns an error, so the obvious way to check the negative is itself broken. We report it as not established rather than as certainly absent. The duties bind either way.

Altering the number is a named fraud indicator, and routing stops

This is the one place where Latvia is stricter than most of its neighbours, and the drafting is unusually direct.

The regulator's rules on preventing numbering fraud define fraud as an action, using a service or numbering intended for an end user, that meets at least one of a list of indicators. The first indicator is the complete or partial alteration of the calling number, with a narrow exception for adding a country code to a number received in base format. Another is making a call from, or routing or receiving a call to, a number for which numbering rights of use have not been granted to any operator. Another is the use of a number's rights of use by a third person without the consent of the operator to which those rights were granted.

Then the consequence, and it is immediate: the operator shall without delay stop routing traffic from the electronic communications network or terminal equipment where it has established fraud. Operators must report to the regulator within ten working days.

Two honest qualifications. The duty is on the operator rather than on you: the instrument does not itself create an offence for the originating caller. And we could not establish the currency of that decision, because the portal surfaced no validity banner or amendment table for it; we read the text as published in September 2022 and are telling you that rather than implying more.

The practical effect is the same whichever way the duty runs. Presenting a number you do not hold rights in matches the first and second indicators, and a Latvian operator that establishes it is obliged to cut the traffic rather than merely permitted to. Contrast the position in Slovakia, where the equivalent provision says only that an operator is entitled to block presentation of the calling identity to protect users against fraudulent calls. Same European framework, opposite operational consequence.

The telecoms act itself is about suppression rather than authenticity. The end user of the calling connection has the right, free of charge, to prevent identification of the calling number on a per-call basis, and those rights are disapplied where the called party is the fire and rescue service, the police, the emergency medical service, the gas emergency service or the maritime search and rescue coordination centre. We looked for a caller-side offence of presenting a number one does not hold and found none.

What the country matrix holds for Latvia

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

Dialogue aimed at agreement, which is not the same as agreement

Latvia has no monitoring-specific consultation duty, because it has no monitoring provision. What it has is the general representatives' right, and reading it precisely matters because its wording invites overstatement.

Employee representatives have the right to receive information in good time and to consult with the employer before the employer takes decisions which may affect employees' interests, in particular decisions which may materially affect remuneration, working conditions and employment in the undertaking. That covers a monitoring measure comfortably on the working-conditions limb.

The act then defines both modes, which is helpful. Information is a process in which the employer transmits information to the representatives, allowing them to acquaint themselves with the matter and to examine it. Consultation is an exchange of views and dialogue between the representatives and the employer with the aim of reaching an agreement.

That last phrase is where pages go wrong. With the aim of reaching an agreement describes the character of the dialogue; it is an objective, not a condition. Nothing in the article makes the employer's decision conditional on the representatives' assent, and there is no veto anywhere in Latvian law over a monitoring measure.

Whether there is anyone to consult at all is a separate question. Authorised representatives may be elected where the undertaking employs five or more employees, and where no trade union operates and no representatives have been elected, the consultation article simply has no addressee. Below that threshold, and in the many Latvian workplaces above it that have never elected anyone, the duty does not bite.

So the Latvian file is short by the standards of this portal: a documented legitimate interests assessment under the Regulation, a transparency notice to employees, and, where representatives exist, timely information and a consultation before the decision. That is genuinely lighter than Romania, Croatia or Slovakia, and the reason is structural rather than accidental. Latvia declined to legislate here.

Darba likums, §§ 10 and 11 (likumi.lv, Spēkā esošs; § 11 stamped 13.10.2005 with 16.06.2011 amendments)

A training plan, an annual course for the manager, and nothing else

Latvia transposed the European network and information security directive by a national cybersecurity act in force since 1 September 2024. It has already been amended: one of its sections was removed by a law of June 2026, so the text to read is the current consolidation rather than the version published in 2024.

Its human-layer duty is a plan plus training. The entity must develop a cyber-risk management and information and communications technology business continuity plan, and must ensure regular training for employees so they can effectively implement the measures included in the plan. A separate provision requires the cybersecurity manager to attend, at least once a year, training on cybersecurity matters organised by the national cyber incident response institution.

We counted both the act and its implementing regulation on minimum cybersecurity requirements through for the Latvian words for phishing, for social engineering, for simulation and for imitation, and for the English word phishing. Every one of them returns zero in both instruments. Testing appears twice in the act and twice in the regulation; training appears six times in the act and eighteen times in the regulation.

The conclusion is the ordinary one for this cluster and it should be stated without hedging. Neither Latvian instrument mandates, mentions or contemplates a vishing simulation. What exists is a generic training duty, and a vendor telling a Latvian buyer that the cybersecurity act requires simulated attacks is describing something the text does not contain.

For financial entities the European digital operational resilience Regulation applies directly, and the Latvian act routes them explicitly: it applies to financial entities within the meaning of that Regulation only in so far as the Regulation or other legislation does not lay down other requirements on cybersecurity, testing, action in the event of a cyber incident, incident reporting and supervision, and it names the central bank as the body it cooperates with on financial entities' cybersecurity. The Regulation itself requires compulsory awareness and resilience training modules for all staff and senior management and threat-led penetration testing on live production systems for identified entities, and names neither phishing nor social engineering anywhere.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in LATVIA. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance.

Verify or correct each proposition below against primary Latvian sources:

1. ⚠ Latvia declined the Art 88 opening: the Fizisko personu datu apstrades likums has 39 sections, no employment chapter, and its only surveillance rule (§ 36) is VIDEO signage. Confirm by enumerating the headings rather than by search.
2. ⚠ The Darba likums contains NO monitoring provision at all, and there is no Latvian analogue of Slovak Zakonnik prace § 13(4) or of OZ § 12. Confirm both negatives.
3. KL § 144(2) is framed as 'partversana' of transmissions or signals IN a network. Does it reach a party recording its own call? We have left this open; resolve it if you can, and say so if you cannot.
4. ⚠ The 2004 Elektronisko sakaru likums is repealed ('Zaudejis speku'); the act in force is the 2022 one. The ePrivacy Art 13 transposition is NOT in it at all: it is Informacijas sabiedribas pakalpojumu likums § 9, gated on 'komercialais pazinojums' as defined in § 1(1)(3) and confined to natural persons.
5. ⚠ SPRK lemums Nr. 1/27 point 2.1 names complete or partial alteration of the calling number as a fraud indicator and point 4 obliges the operator to stop routing 'nekavejoties'. ⚠ We could not establish its currency: no 'Redakcija speka no' banner or amendment table surfaced. Check it.
6. Darba likums § 11 gives representatives information in good time and consultation before decisions materially affecting working conditions, defines consultation as dialogue 'ar merki panakt vienosanos', and creates no veto. Representatives may be elected at 5+ employees.
7. The DVI's April 2025 guidance is about merchants recording CUSTOMER calls. Confirm it has published nothing on employee monitoring or on consent validity in employment, and advise whether it may be relied on by analogy.
8. Nacionalas kiberdrosibas likums and MK noteikumi Nr. 397 require a plan, regular employee training and annual training for the cybersecurity manager, and contain zero occurrences of phishing, social engineering, simulation or imitation.

Flag anything that has changed since September 2026, and identify any obligation in a sectoral instrument this analysis omits.

Common questions

Does Latvian law regulate employee monitoring?: Not specifically. The implementing act has no employment chapter and its only surveillance rule is about video signage, and the labour code contains no monitoring provision at all. An employer is on the Regulation's own balancing test with no domestic overlay, which is unusually light for this region.
Do we have to consult employee representatives?: Where they exist, yes: information in good time and consultation before decisions that may materially affect working conditions. Consultation is defined as dialogue with the aim of reaching an agreement, which is an objective rather than a condition. There is no veto anywhere in Latvian law.
May we present a Latvian number we do not hold?: No, in practice. The regulator's numbering fraud rules name complete or partial alteration of the calling number as a fraud indicator, along with using a number nobody holds rights in, and require the operator to stop routing the traffic immediately once fraud is established.
May a party to the call record it?: Unresolved, and we say so rather than guessing. The offence is drafted as interception of transmissions or signals in a network, which a party receiving its own call is not obviously doing, and no Latvian instrument or decision settling the point could be found. Latvia has no recording-consent statute.

Elsewhere in Northern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.