Does Lithuania restrict automated calling?

Not as such. The 2021 re-enactment removed the automated calling provisions entirely, leaving a single rule scoped to direct marketing. We searched both the current text and the re-enactment for the automatic calling wording and found none. The purpose decides, and a security test is not marketing.

How do we give employees notice in Lithuania?

Against signature, or by another method that proves the notification happened. Lithuanian law requires that for workplace audio processing and for monitoring of employee behaviour, and a simulation is both. An intranet page nobody acknowledged does not discharge it. Give the notice generically and in advance.

Can the works council stop our programme?

It can delay it. An employer with twenty or more employees must inform and consult the council ten working days before approving monitoring rules, and a reasoned written request suspends action during consultation. If no opinion arrives in the period, the employer may close the procedure and proceed.

Why are our Lithuanian calls being blocked?

Because they originate abroad. The regulator has required operators to block Lithuanian fixed numbers where calls are initiated outside Lithuania, and mobile numbers where the subscriber has not left the country. Originate on a Lithuanian network with a properly assigned number, and confirm the current position with your carrier.

Compliance

Voice phishing simulations in Lithuania

Phone numbers in LithuaniaProvisioned by Callstrike after approval

Lithuania has no automated dialler rule for a voice phishing simulation to worry about, and Callstrike places the Lithuanian number order for you once one clearance is through. What is stricter here than anywhere else in this region is how you tell people: notice has to be taken against signature, or by another method that proves it happened, and an intranet page nobody acknowledged does not discharge it.

Phone numbers

Supplied by Callstrike

Local numbers in Lithuania, after a one-time approval.

Running a simulation

Permitted, once the notice is evidenced

Signed or otherwise provable, in advance, and covering the programme generically.

Consent

Acknowledgement, not authorisation

What the statute wants is proof the notification happened, not agreement to it.

Getting a phone number in Lithuania

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Your company files its regulatory details once for this country. Local rules require the order to be placed by the provider of record, so Callstrike provisions the number on your behalf once the filing is approved. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Lithuania is a country where the order has to be placed by the provider of record, so your administrator files the company's regulatory details once in the console and Callstrike places the order against the approval. The carrier's evidence is ordinary: who the business is, from its registration, and an address inside Lithuania. The step worth confirming before you file is that the address you are claiming is the one the registration or the bill actually shows, because a mismatch between the two is the common reason a filing comes back.

The rule that will actually stop a Lithuanian campaign is a blocking regime, and we are going to be precise about how well it can be sourced. The regulator has published its own account of obligations it imposed on operators: block Lithuanian fixed-line numbers where the calls on them are initiated abroad; block Lithuanian mobile numbers where the operator determines calls are initiated abroad while the subscriber has not left Lithuania; and block and refuse to carry in transit calls from numbers for which no permits were issued. Its own figures describe one operator blocking millions of such calls in a single quarter, so this runs at scale. We could not locate the underlying order in the register of legal acts, so treat the detail as indicative and the effect as real. Either way the design consequence is fixed: a call presenting a Lithuanian number has to originate on a Lithuanian network with that number properly assigned, and geographic numbers stay inside the area their own code covers.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Lithuania is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Business name	Business registration
Business addressMust be within Lithuania	Utility bill, Tax notice, Rent receipt, Title deed, Business registration showing lithanian address

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Lithuania?

The position in short, before your counsel reads the detail below.

Yes, and Lithuania is the clearest case in this region of a country whose law does not say what a reader would expect. There is no automated dialler rule at all. The 2021 re-enactment of the electronic communications law collapsed the old European enumeration into a single technology-neutral provision, and neither the current consolidated text nor the re-enactment contains any mention of automatic calling and communication systems without human intervention. What exists instead is purpose based: using electronic communications services for direct marketing needs prior agreement, direct marketing is defined by statute, and an authorised test of your own workforce is not it. The trigger is the purpose, so neither a synthetic voice nor a live operator changes the answer. Anyone reasoning across from a neighbouring country's device prohibition gets Lithuania wrong.

The Lithuanian obligation with no counterpart on most of these pages is about the form of your notice rather than its content. Where audio data are processed at the workplace, and where personal data relating to the monitoring of employees' behaviour are processed, those employees must be informed against signature or by another method proving the fact of the notification, and given the information the Regulation requires. A recorded and scored simulated call is audio at the workplace and it is monitoring of behaviour, so both limbs bite at once. Plan for a signed or otherwise evidenced acknowledgement covering the programme, given in advance and generically, because the statute does not require and the exercise does not survive notice that a particular call is coming. Note also that the provision people expect to find in the labour code moved into the data protection act, so a policy citing the old labour code article is citing something that no longer says it.

Consultation is real, has a published clock, and can hold you up without stopping you. At an average of twenty or more employees you must inform the works council and consult it before approving or amending local normative acts on the use of information and communication technologies and on the monitoring and control of employees, on measures capable of infringing private life, and on the employee data retention policy, which is precisely the set of documents a testing programme produces. The council is informed ten working days before the planned approval, may demand consultation within three working days, and consultation runs for at least five. Where the council submits a reasoned written request you may not take the action during the consultation period, so there is a genuine standstill attached to what is otherwise a consultation duty. If no opinion arrives in the period you may close the procedure and adopt the act. It can delay you and it cannot stop you, which is a different position from both Germany and Ireland and one to plan to rather than discover.

Two things to settle before you build. The impact assessment is not a judgement call here, because the supervisory authority's list names both the recording of telephone conversations and employee monitoring outright, so a recorded and scored simulation is caught by two entries at once. And recording itself is genuinely unsettled: the electronic communications law prohibits listening to, recording or otherwise intercepting the content of communications without the agreement of the actual recipients, but that article sits in a chapter addressed to confidentiality in the communications sector and no official Lithuanian source says whether it binds an ordinary participant. The criminal and civil provisions turn on unlawfulness rather than on who was on the call and none contains a participant exception. What is clear is the exposure, and it is worth knowing who carries it: criminal liability for unlawful recording extends to legal persons, so this is the company's risk and not only an individual's.

What your company needs to do

6 items, in the order you will need them.

Take the notice against signature, in advance and genericallyLithuania-specificThis is the Lithuanian requirement and an ordinary intranet policy does not meet it. What the statute wants is a signature or another method proving the notification happened, for workplace audio processing and for monitoring of employee behaviour alike. Cover the programme rather than the individual call, and keep the evidence per employee rather than as a single distribution list.
Start the works council clock ten working days outLithuania-specificInform the council ten working days before you plan to approve the monitoring documents. It has three working days to demand consultation, consultation runs for at least five, and a reasoned written request suspends the action for that period. Build that into the schedule, because discovering it in the launch week costs you the launch week.
Treat the impact assessment as owed twice overLithuania-specificThe supervisory authority's list names the recording of telephone conversations and employee monitoring as separate entries, so a recorded and scored simulation is caught by both. That removes the usual argument about whether one is required and leaves only the question of how good it is, which is the better place to spend the effort anyway.
Decide the recording question at company levelLithuania-specificThe participant point is unresolved in Lithuanian law and the criminal exposure reaches legal persons, so this is not a decision to leave to whoever configures the campaign. Take it to Lithuanian counsel, and in the meantime consider whether the outcome and the timestamp would do everything the programme actually needs.
Cite the current provision, not the old labour code articleThe workplace monitoring provision moved out of the labour code into the data protection act. A policy or a supplier proposal still pointing at the labour code article is pointing at something that no longer says it, and that is a cheap thing to check and an awkward one to be caught on.
Originate inside LithuaniaLithuania-specificThe regulator has required operators to block Lithuanian fixed numbers where the calls are initiated abroad and mobile numbers where the subscriber has not left the country, and geographic numbers may be used only in the area their own code indicates. Routing a Lithuanian caller identity in from a foreign platform is the exact pattern that regime exists to kill.

The controls that do the work

How Callstrike is configured, and which provision in Lithuania each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Lithuania forces an impact assessment through two separate entries on the supervisory authority's own list, so the necessity and proportionality of the exercise are written down and reviewable from the start. The call ends the instant an employee begins to give up a credential, so what the assessment describes is a measurement of susceptibility rather than a store of credentials obtained by deception. That is also the sentence that makes the works council conversation shorter, because the council's first question is what you will be holding.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The council is consulted specifically on measures capable of infringing employees' private life, and it holds a standstill it can invoke by a reasoned written request, so what happens to the person who fails is the fact most likely to decide how that week goes. A second voice that breaks character the instant the call ends, with vishing training in writing the same day, is a concrete commitment to put in the local normative act itself rather than in a covering note.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Lithuania is the country where this stops being paperwork and becomes the statutory requirement, because the duty is to inform against signature or by another method proving the notification happened. A per-employee trail with a date and an acknowledgement is exactly the proof that provision asks for, and the alternative mode covers the employer that already has a policy: hash it, attest to the scope, and keep the timestamp. It is evidence that the notice was given, not agreement to be tested.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the route around the delivery problem rather than around any Lithuanian rule, and here the delivery problem is the real one. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner opens themselves after working through the module, and a browser call presents no Lithuanian number and originates on no Lithuanian network, so the blocking obligations that decide whether a telephone campaign connects have nothing to act on.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

Notice against signature, and a standstill you can be held to

The basis is legitimate interests under Article 6(1)(f), because the Lithuanian act is supplementary to the Regulation rather than a substitute for it. The supervisory authority's own guidance for employers says employee consent is applicable rather rarely, for the reason that recurs everywhere in this cluster. An impact assessment is not a judgement call here: the authority's list of processing requiring one names both the recording of telephone conversations and employee monitoring outright, so a recorded, scored simulation is caught by two entries at once.

The Lithuanian obligation with no counterpart on most of these pages is about how you tell people. Where audio data are processed at the workplace, and where personal data relating to the monitoring of employees' behaviour are processed, those employees must be informed against signature or by another method proving the fact of the notification, and given the information Article 13 of the Regulation requires. A recorded and scored simulated call is audio at the workplace and monitoring of behaviour, so both limbs bite. An intranet policy nobody acknowledged does not discharge that duty. Plan for a signed or otherwise evidenced acknowledgement covering the programme, given in advance and generically, because the statute does not require, and the exercise does not survive, notice that a particular call is coming.

Note that the provision people expect to find in the Labour Code is not there any more. It moved to the data protection act, and a page still citing the old Labour Code article is citing something that no longer says it.

Consultation is real, has a deadline, and can stop you temporarily. An employer with on average twenty or more employees must inform the works council and consult it before approving or amending local normative acts on the use of information and communication technologies and the monitoring and control of employees at the workplace, on measures capable of infringing employees' private life, and on the employee data retention policy. Those are precisely the documents a testing programme needs. The council is informed ten working days before the planned approval, may demand consultation within three working days, and consultation must run for at least five working days.

The classification matters and it is a consultation duty rather than a veto, but with a temporary standstill attached: where the works council submits a reasoned written request, the employer may not take the action in question during the consultation period. Consultation must genuinely aim at a solution satisfying both sides. If no opinion is delivered within the period the employer may close the procedure and adopt the act. So the council can delay you and cannot stop you, which is a different thing from both the German and the Irish position and worth planning to rather than discovering.

Recording, unsettled, with the company itself exposed

We could not resolve this one, and saying so is more useful than a confident answer would be.

The electronic communications law prohibits listening to, recording, storing or otherwise intercepting the content of communications and traffic data, or acquainting oneself with them, without the consent of the actual recipients of the public communications services, save where specified provisions allow it. On its plain words that points toward needing everyone's agreement for the content of a call carried over a public network. But the article sits in a chapter addressed principally to confidentiality in the electronic communications sector, and we found no official Lithuanian source saying whether it binds an ordinary participant to a conversation.

The criminal and civil provisions do not settle it either. All of them turn on unlawfulness rather than on who was on the call, and none of them contains a participant exception of the kind Sweden's offence has on its face. What is clear is the exposure: criminal liability for unlawful recording extends to legal persons, so this is the company's risk and not only an individual's.

The one statutory analogue is instructive about direction. The law permits recording in the course of lawful business practice to evidence the conclusion or performance of a commercial transaction, but only where the recipients are informed of the recording and its purpose before recording begins, and only for as long as the transaction can be challenged. That does not cover awareness testing, and its condition is advance notice.

So the design that follows is the same one the transparency rule already requires: notify before you record, at the programme level and against signature, which satisfies the employment notice duty at the same time. Take the participant question itself to Lithuanian counsel, and consider whether the audio is needed at all when the outcome and the timestamp would do.

The rule that does not exist, and the one that does

Lithuania is the clearest case in this cluster of a country whose law does not say what a reader would expect, so it is worth stating as a negative finding rather than leaving to inference.

There is no automated dialler rule in Lithuanian law. The 2021 re-enactment of the Law on Electronic Communications collapsed the old European enumeration into a single technology-neutral provision, and we read both the current consolidated article and the 2021 re-enactment and searched each for the phrase used for automatic calling. There is no mention of automatic calling and communication systems without human intervention anywhere in the current Law. Anyone reasoning from a neighbouring country's device prohibition gets Lithuania wrong.

What exists instead is purpose-based. Using electronic communications services for the purpose of direct marketing is permitted only with the prior consent of the subscriber or registered recipient, with a carve-out and an opt-out route where the subscriber is a legal person. Direct marketing is defined by statute, and an authorised security test of an employer's own workforce is not it. So the trigger is the purpose, not the technology, and neither a synthetic voice nor a live operator changes the answer.

The rule that does reach an AI voice in Lithuania is European. Article 50 of the AI Act has applied since 2 August 2026. It requires a system built to interact directly with people to be designed so the person is informed they are interacting with an AI system, and requires whoever deploys a system generating or manipulating audio constituting a deep fake to disclose that the content is artificially generated, both at the latest at the first interaction or exposure. The exceptions on the face of the text are use authorised by law to detect, prevent, investigate or prosecute criminal offence, and evidently artistic or fictional works, where the duty is narrowed rather than removed. An employer's own authorisation for a test is not authorisation by law, and merging those two senses of the word is the most likely false step available on any European page in this cluster.

One element the text leaves genuinely open, and we will not close it for you: whether a synthetic voice resembling no identifiable individual satisfies a definition that requires resemblance to existing persons, objects, places, entities or events. Where the voice imitates a specific real person it is inside on any reading. And note that using a live operator does not take you outside, because the definition covers content that is generated or manipulated.

One further provision of that Regulation bears on any plan to analyse the audio rather than the outcome, and its reach turns on a definition that is broader than it first appears. Inferring emotions of a natural person in the workplace by an AI system is prohibited, since 2 February 2025, at up to thirty-five million euros or seven per cent of worldwide turnover, excepted only for medical or safety reasons. The prohibition is gated by the definition of an emotion recognition system, which requires inference from biometric data, and biometric data is defined to include behavioural characteristics on a list the text does not close. Voice is not named in that list and is not excluded from it either, which is precisely why this should be settled with counsel before a feature ships rather than after.

Geographic numbers stay in their area, and foreign origination is blocked

Two constraints shape a Lithuanian campaign, and the second is the one that will actually stop it.

The first is simple and absolute in the regulator's rules: geographic numbers may be used only in the geographic area indicated by the number's own area code. So a Vilnius number is a Vilnius number, and presenting one from a service operating elsewhere is outside the rule.

The second is a blocking regime, and we are going to be precise about how well we can source it. The regulator has published its own account of obligations it imposed on operators: to block Lithuanian fixed-line numbers where calls on those numbers are initiated abroad; to block Lithuanian mobile numbers where the operator determines that calls are initiated abroad while the subscriber has not left Lithuania; and to block and refuse to carry in transit calls initiated from numbers for which the regulator has issued no permits and which are not assigned to specific providers. The regulator's own figures in the same publication describe one operator blocking millions of such calls in a single quarter, so this is running at scale rather than on paper.

The provenance caveat matters and we are not going to bury it. That account is the regulator describing obligations it imposed, and we could not locate the underlying order in the register of legal acts: the current general conditions for electronic communications activity no longer contain those blocking conditions, and searches returned nothing. Either the obligations now sit in an instrument we did not find, or they were imposed by individual binding directions to operators. So treat the detail as indicative and the effect as real, and confirm the current position with your carrier before you design around it.

The practical consequence is the same one as in Ireland, Italy and Sweden, reached by a different route. A call presenting a Lithuanian number has to originate on a Lithuanian operator's network with that number properly assigned. Routing a Lithuanian caller identity in from a foreign platform is the exact pattern the blocking regime exists to kill.

What the country matrix holds for Lithuania

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

No Lithuanian presence required, and what is asked for instead

This is a clean negative and it is worth stating precisely, because the assumption runs the other way.

The regulator's rules require an applicant for numbers to submit copies of documents confirming lawful establishment, except for entities already registered in the Lithuanian register of legal entities or which have notified electronic communications activity. Read that carefully: the exemption from filing establishment documents is for entities already on the Lithuanian register, which means the rules contemplate a foreign applicant and simply ask it to evidence its lawful establishment wherever that is. There is no local address requirement, no local director requirement and no local presence requirement.

That is a statement about the regulator's own numbering rules, and it is worth separating from what the panel above the seam is doing. That panel is the carrier deciding what evidence it needs before it will hand a number over, generated from its own current onboarding rules, and it does ask for a Lithuanian address. Both are true at the same time: the condition is the carrier's rather than the regulator's, and treating the second as the first is how a local-presence requirement gets attributed to Lithuanian law.

What Lithuania asks for instead, of a provider applicant, is a network connection: documents confirming interconnection with, or access to, at least one other public fixed or mobile network established in Lithuania. That is a nexus to the network rather than to the company register, and it fits with the blocking regime above.

One rule that is easy to transplant wrongly: the requirement that participants be registered in or nationals of an EU, NATO, OECD or EFTA state applies to radio frequency competitions and auctions only. It does not apply to number assignment, and importing it into a numbering conversation would be inventing a condition.

No end-user identification requirement is published. What exists instead is a rule making the provider responsible for the use of the numbers it has assigned. So if your Lithuanian carrier asks you for onboarding documents, it is discharging its own obligation rather than passing on one imposed on you, which is a useful distinction when you are asked to produce something and want to know why.

Training as a named statutory duty, on a two-year cycle

Lithuania's cybersecurity law is unusually specific about people, and that is useful when a testing budget needs defending.

The cybersecurity requirements the Government approves must cover, among their listed elements, cyber hygiene practices and regular cybersecurity training. Separately, and more pointedly, members of the management bodies of a cybersecurity entity, its head and the head's authorised person must attend cybersecurity training at least once every two years in the manner the national cyber security centre establishes, and must ensure the continuous education of the entity's employees in the field. A named cadence and a duty that lands on the management body is a stronger hook than most European transpositions offer.

The usual limit applies and is worth repeating: the law requires training and the assessment of measures, and it does not name voice phishing as a required technique. Testing whether people can be talked into something is one way of assessing effectiveness rather than asserting it, which is the honest argument for doing it.

For financial entities DORA applies directly, with compulsory awareness and resilience training modules for all staff and senior management, a testing programme, and threat-led penetration testing for entities in scope. We were unable to reach the central bank's own material on its designation for that testing during this research, so we are pointing at the Regulation rather than at a national page we did not read.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in LITHUANIA. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance at the programme level.

Verify or correct each proposition below against primary Lithuanian sources, and tell us how the notice must be taken:

1. ⚠ ADTAI art 5(4) requires employees to be informed of workplace AUDIO processing and of monitoring of employee BEHAVIOUR 'pasirasytinai', against signature or another method proving the notification. Confirm that a generic, advance, programme-level notice satisfies it and that an intranet policy does not.
2. The workplace monitoring provision moved OUT of the Darbo kodeksas into ADTAI. Confirm, and identify anything still live in the labour code.
3. Darbo kodeksas arts 203 to 206: inform the works council 10 working days before approving local normative acts on ICT use and employee monitoring, 3 working days to demand consultation, minimum 5 working days of consultation, and a STANDSTILL on a reasoned written request. It is not a veto. Confirm the 20-employee threshold.
4. ⚠ There is NO automated-calling rule in Lithuanian law: the 2021 re-enactment collapsed the ePrivacy Art 13(1) enumeration into a single provision scoped to direct marketing. We searched both texts for 'automatinio skambinimo' and found nothing. Confirm the negative.
5. ⚠ Whether ERI art 73 binds a PARTY to the call is unresolved and we have published it as unresolved. Resolve it if you can. Note that criminal liability for unlawful recording extends to legal persons.
6. VDAI order No 1T-35 names BOTH the recording of telephone conversations AND employee monitoring, so a DPIA is owed on two independent grounds.
7. RRT resolution No TN-339 item 205 confines geographic numbers to their own area, and items 225 to 243 impose no local address, director or presence requirement, requiring instead evidence of lawful establishment and, for a provider applicant, interconnection with a Lithuanian network.
8. ⚠ The blocking obligations are sourced to RRT's own published account and we could NOT locate the underlying order in the register: the current general conditions no longer contain them. Find the instrument, or confirm they were imposed by individual binding directions.

Flag anything that has changed since September 2026, and confirm the Lietuvos bankas position on DORA threat-led testing, which we could not reach.

Common questions

Does Lithuania restrict automated calling?: Not as such. The 2021 re-enactment removed the automated calling provisions entirely, leaving a single rule scoped to direct marketing. We searched both the current text and the re-enactment for the automatic calling wording and found none. The purpose decides, and a security test is not marketing.
How do we give employees notice in Lithuania?: Against signature, or by another method that proves the notification happened. Lithuanian law requires that for workplace audio processing and for monitoring of employee behaviour, and a simulation is both. An intranet page nobody acknowledged does not discharge it. Give the notice generically and in advance.
Can the works council stop our programme?: It can delay it. An employer with twenty or more employees must inform and consult the council ten working days before approving monitoring rules, and a reasoned written request suspends action during consultation. If no opinion arrives in the period, the employer may close the procedure and proceed.
Why are our Lithuanian calls being blocked?: Because they originate abroad. The regulator has required operators to block Lithuanian fixed numbers where calls are initiated outside Lithuania, and mobile numbers where the subscriber has not left the country. Originate on a Lithuanian network with a properly assigned number, and confirm the current position with your carrier.

Elsewhere in Northern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.