6 November 2026 · Regmio.eu · 8 min read

Personal identity codes in public registers: where the line is — and how Regmio respects it

Publishing a personal identity code is not absolutely prohibited in Latvia, but it requires a legal basis. Without one, it is a data protection violation, and the Data State Inspectorate (DVI) has already acted against both a government body and a private data portal over it. Regmio, the Baltic company-check platform, does not display full personal identity codes at all: they are not needed to check a business partner.

Business owners, accountants and lawyers check their business partners every day: who sits on the board, who owns the company, whether a board member may sign alone. This data has to be available. The question is how much of officials' personal data must be shown for a check to be reliable, and where it becomes excessive.

What the law says

A personal identity code is personal data, and it may be processed and published only if one of the grounds in Article 6 of the General Data Protection Regulation (GDPR) applies. These include, for example, consent, a legal obligation or legitimate interests. Data minimisation must also be observed: only what is genuinely necessary for the purpose may be processed.

Latvia used to have a separate rule. Section 13.1 of the former Personal Data Protection Law listed the cases in which personal identity codes could be processed. That law is no longer in force; the general principles of the GDPR and the Personal Data Processing Law now apply.

Why personal identity codes are in the register — and where the law hides them

The Commercial Law requires the commercial register to record the name, surname and personal identity code of members of the management and supervisory boards, the auditor and the authorised representative (prokurist). The register is public because a business partner must be able to establish with certainty exactly who the official is. A name and surname alone may not be enough for that.

In certain cases, however, the legislator has deliberately restricted publication. Section 18.18 of the Law "On the Enterprise Register of the Republic of Latvia" provides that when the list of public persons and institutions is published on the Enterprise Register website, officials' personal identity codes are not published. The register itself also minimises data: since 1 October 2021, its open data shows only part of the personal identity code of board members, shareholders and beneficial owners (Section 4.10), while the initial search results on the register's website show only the first four digits of the code (Cabinet Regulation No. 23).

The conclusion is simple: the fact that data sits in a public register does not mean it may be disseminated to any extent. Anyone who reuses the data becomes a controller in their own right and is responsible for what they show and to whom.

What changed in 2025–2026

The direction is clear: the state is increasingly limiting how much personal data is visible to everyone, and DVI fines are growing.

Beneficial owner data can be hidden. On 3 December 2025 the Saeima adopted amendments to the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, which entered into force on 1 April 2026 (law). If public access poses a threat to a person or their family, the person may ask the Enterprise Register to hide the information. The register does so within one working day, and the procedure must be applied to existing entries by 31 December 2026.
The reason is EU requirements. The amendments transpose EU Directive 2024/1640 (iFinanses), and they rest on a 2022 judgment of the Court of Justice of the EU finding that general public access to this data is a serious interference with the right to privacy (CJEU).
DVI fines are growing. In 2025 the DVI imposed fines totalling €326,400, ranging from €150 to €300,000 per case (DVI 2025 annual report).

Regmio's approach is in line with this direction: it shows only the part of the code that the register itself publishes, and nothing more.

How the DVI views it

The DVI has acted against both a government body and a private re-user of register data.

Date	Who	What happened	Outcome
2025	DVI overall	Fines imposed during the year for GDPR violations	€326,400 in total, the largest €300,000 in a single case (DVI report)
2025	Senate (case in the DVI report)	An entry in the official gazette about a person's constitutional complaint could disclose information about their criminal record to an unlimited audience	Case referred back for re-examination (DVI report)
20 March 2024	National Electronic Mass Media Council (NEPLP)	Published a person's name, surname and personal identity code in a decision on its website. The Council itself acknowledged that the code had been published by mistake and that there was no legal basis.	Binding DVI order to delete the names and surnames of parties to administrative proceedings from published decisions (decision)
Published February 2021	SIA "Lursoft IT"	GDPR violations in processing personal data held in the Enterprise Register's registers	DVI fine of €65,000 (LV portāls)

At the time, the Enterprise Register stressed that SIA "Lursoft IT" is a private company unconnected to the register, one of the businesses that reuse register information. Both cases show the same principle: responsibility lies with whoever publishes the data, not only with the source it was taken from.

How Regmio handles it

Regmio, which checks Latvian, Lithuanian and Estonian companies on a single platform, has built privacy into the design of the product. Regmio does not show full personal identity codes to any user, including paying ones (privacy policy).

Only as much as the source publishes. Officials and owners are shown with part of the personal identity code or year of birth — exactly as much as the official source publishes.
Search without sending the code. When searching by personal identity code, only the first part reaches the server. The second part stays in the user's browser: it is not sent to the server, not stored and not logged. Search volume is limited so that data cannot be extracted in bulk.
A clear legal basis. Regmio processes data on the basis of legitimate interests (GDPR Article 6(1)(f)) and has carried out a balancing-of-interests assessment.
Only business-related data. Private individuals' addresses and contact details are not shown, and no data is collected from social networks or private databases.
The right to object works. If a person objects to their data being shown and the objection is justified, Regmio stops the processing and the person no longer appears in search results.
No tracking. Regmio does not use analytics or advertising tools and does not accumulate users' search history.

A full personal identity code is not needed to check a business partner. To determine whether a board member may sign a contract, who owns the company and whether it has tax debts, the name, position, representation rights and the part of the code published by the register itself are sufficient.

What to do if your personal identity code has been published

Write to the website owner as the data controller. Exercise your right to object to the processing (GDPR Article 21) or to request erasure or restriction (Articles 17 and 18).
If the response is unsatisfactory, file a complaint with the Data State Inspectorate. Unlawful dissemination of personal data may give rise to administrative or criminal liability (LV portāls).

This article is not legal advice. In a specific dispute, we recommend consulting a data protection specialist or the DVI.

About Regmio

Regmio is an online platform for checking companies in Latvia, Lithuania and Estonia. It brings together official registry, tax, financial, sanctions and politically exposed persons data in one place and automatically highlights risk indicators. Data is stored and processed in the European Union. The service is provided by SIA "Mobinet", Riga. regmio.eu · [email protected]