Welcome to the latest edition of RegRally Insights, where we explore key developments shaping data protection, cybersecurity, and ICT regulation across the EU and Lithuania. This month’s update highlights significant enforcement trends, evolving GDPR compliance expectations, and practical regulatory guidance impacting businesses operating in digital and data-driven environments.
From expanding supervisory scrutiny and increased enforcement activity to new expectations in direct marketing, DPIAs, and access rights handling, organisations are facing a steadily maturing regulatory landscape that demands both stronger governance and operational discipline.
Stay informed, stay compliant, and ensure your organisation is prepared for the next wave of regulatory change.
Amendments to Lithuanian Electronic Communications Law introduce an opt-out regime for B2B direct marketing and reinforce strict consent rules for individuals (effective 1 July 2026)
On 16 April 2026, Seimas adopted amendments to Article 81 of the Law on Electronic Communications, updating rules on electronic direct marketing. The changes apply from 1 July 2026 and concern only marketing via electronic communications (email, SMS), not other marketing channels.
Main points:
B2B direct marketing (legal entities)
- Prior consent is no longer required (opt-out model applies).
- Each message must include a clear, functional, and easy unsubscribe option (e.g., one-click link).
- Opt-out must be immediate or completed within a reasonable time.
- Risk area: ineffective, formal, or technically flawed opt-out mechanisms may constitute violations under both the national law and GDPR (transparency, lawfulness, data subject rights).
Marketing to natural persons
- Prior consent remains mandatory.
- Consent must be freely given, specific, informed, and unambiguous (typically via affirmative action such as a checkbox).
- Soft opt-in exception (existing customers).
Marketing without consent is allowed only if:
- contact data was obtained in a sales context;
- marketing relates to similar products or services;
- the customer was informed about opt-out at the time of data collection;
- every message includes an opt-out option.
Key compliance takeaway
- Regulatory focus shifts in B2B from consent to effectiveness of opt-out mechanisms.
- For individuals, strict consent requirements remain unchanged.
- GDPR principles remain central to assessing compliance, especially transparency and effective exercise of rights.
Following the entry into force of the amendments to the Law on Electronic Communications on 1 July 2026, organisations will need to adjust their direct marketing practices to ensure compliance with the updated requirements.
Marketing compliance recommendations:
Apply different rules for B2B and B2C customers, typically implemented at checkout or registration stage.
B2B (legal entities):
- No consent required for newsletters or marketing emails.
- Marketing may be sent to general business contact details.
- Must provide a clear and easy opt-out option in every communication.
- Privacy information on direct marketing must be included in the Privacy Policy.
- Avoid excessive or intrusive communications.
B2C (natural persons):
- Use two separate checkboxes:
→ Consent for marketing (“I agree to receive newsletters and offers”).
→ Refusal of marketing (“I do not agree to receive newsletters and offers”). - If consent is given, marketing is based on GDPR consent.
- If opt-out is selected, no marketing is permitted.
Essential compliance requirements
- Maintain a clear Privacy Policy covering direct marketing and legal bases.
- Ensure technical capability to record consent and opt-out choices.
- Include a clear unsubscribe option in every email
- Ensure internal systems properly reflect these categories.
Read our article here: https://ecovis.lt/tiesiogine-rinkodara-po-pakeitimu-daugiau-lankstumo-bet-grieztesni-praktiniai-reikalavimai/
EDPB introduces DPIA template to harmonise GDPR risk assessments and strengthen consistency of data protection impact analysis across the EU (public consultation open until 9 June)
The European Data Protection Board (EDPB) has launched a standardised template to support organisations in conducting Data Protection Impact Assessments (DPIAs) under the GDPR. The tool aims to improve clarity, comparability, and compliance quality across EU jurisdictions by providing a structured approach to documenting data processing risks and safeguards.
Key elements of the initiative:
• Standardised DPIA template to support consistent GDPR compliance across Member States.
• Public consultation open until 9 June; stakeholders can provide feedback before final adoption.
• Data Protection Authorities may adopt it as a common EU standard or align it with national frameworks.
When a DPIA is mandatory:
A DPIA is required for high-risk processing activities, including:
• Automated decision-making and profiling with legal or similarly significant effects.
• Large-scale processing of sensitive data or criminal offence data.
• Large-scale monitoring of publicly accessible spaces.
• Processing biometric data for identification or monitoring.
• Recording telephone conversations or video surveillance with audio.
• Systematic employee monitoring (e.g., workplace tracking systems).
• Other processing is likely to result in a high risk to individuals’ rights and freedoms.
Core DPIA requirements:
A DPIA must:
• Describe processing purpose, scope, context, and nature.
• Assess necessity, proportionality, and GDPR compliance.
• Identify and evaluate risks to data subjects.
• Define mitigation measures and security safeguards.
Practical benefits of DPIA use:
• Demonstrates GDPR accountability and compliance.
• Identifies and reduces privacy and security risks early.
• Optimises data processing and reduces unnecessary collection.
• Supports cost-efficient integration of data protection measures in system design.
A DPIA should be conducted where personal data processing is likely to result in a high risk to individuals’ rights and freedoms, particularly when using new technologies, carrying out large-scale processing, or implementing systematic monitoring. Conducting a DPIA helps identify and mitigate risks at an early stage and supports compliance with GDPR requirements.
We recommend:
- assess whether a DPIA is required under the GDPR;
- include legal, technical, and organisational measures in the assessment;
- establish internal DPIA procedures and documentation processes;
- regularly review DPIAs where processing activities or associated risks change.
DPIAs are commonly required for biometric data processing, employee monitoring, CRM systems, large-scale personal data processing, data transfers to third countries, and other complex processing activities.
https://ecovis.lt/duomenu-apsauga/darbuotoju-asmens-duomenu-apsauga/
EDPB 2025 Annual Report highlights intensified GDPR enforcement, stronger cross-border cooperation, and continued focus on emerging technologies with €300 million in fines issued EU-wide
The European Data Protection Board (EDPB) Annual Report for 2025 outlines key enforcement, supervisory, and policy developments under the GDPR across the EU, reflecting increased regulatory maturity and cross-border coordination.
Main developments in 2025:
1. Stronger cross-border enforcement
• Over 1,200 cross-border GDPR cases processed.
• Enhanced cooperation between national Data Protection Authorities (DPAs).
• Improved consistency in interpretation and enforcement of GDPR rules across Member States.
• Greater legal certainty for businesses operating in multiple EU jurisdictions.
2. Focus on emerging technologies
• Increased attention to artificial intelligence, big data, and automated decision-making.
• Continued emphasis on GDPR principles of data protection by design and by default.
• EDPB guidance supports organisations in managing compliance risks in new technology environments.
3. Enforcement outcomes
• Approximately €300 million in GDPR fines issued in 2025.
• Continued emphasis on accountability, transparency, and effective deterrence of non-compliance.
4. Regulatory priorities
• Strengthening consistent application of GDPR across the EU.
• Supporting harmonised supervisory practices.
• Promoting proactive compliance and early risk mitigation by organisations.
Core takeaway
The 2025 report confirms a stable but active enforcement environment, with increased coordination between EU regulators, sustained financial penalties for breaches, and a strong policy focus on regulating emerging technologies while reinforcing GDPR compliance standards.
Source: https://www.edpb.europa.eu/our-work-tools/our-documents/annual-report/edpb-annual-report-2025_en
UAB “SMAGUS” direct marketing breach: Lithuanian Data Protection Authority finds unlawful email marketing without consent, but issues only a warning due to isolated human error and prompt remediation
Core findings and outcome:
• Complaint received on 3 June 2025 regarding unsolicited promotional email sent on 27 May 2025.
• Email promoted family-oriented park activities and was classified as direct marketing under the Law on Electronic Communications (Article 81(1)).
• The company claimed the email originated from the visitor lottery forms and was incorrectly entered due to human error.
• Inspectorate confirmed the email was sent without the prior consent of the recipient.
Regulatory assessment:
• Violation established: direct marketing sent without valid consent.
• Breach attributed to an isolated operational mistake (data entry error).
• No evidence of systematic misuse or large-scale unlawful processing.
Mitigating factors considered:
• One-off incident rather than structural compliance failure.
• Immediate corrective action: email address deleted and apology issued.
• No significant harm or adverse consequences identified.
Final decision:
• Complaint upheld as well-founded.
• No fines or corrective sanctions imposed.
• Acknowledgement of infringement deemed proportionate and sufficient.
Practical takeaway:
Even in cases of confirmed GDPR-adjacent direct marketing breaches, supervisory authorities may opt for proportional enforcement where the infringement is isolated, promptly corrected, and not indicative of systemic non-compliance.
As of 1 July, Article 81 of the Republic of Lithuania Law on Electronic Communications will be amended, introducing updated requirements for the use of electronic communications services for direct marketing purposes.
From that date, direct marketing via electronic communications (e.g. email, SMS) will be subject to updated requirements:
- B2B marketing (legal entities) may be carried out without prior consent, provided that recipients are given a clear, free, and easily exercisable opt-out option in every communication. The opt-out mechanism must be functional and easy to use in practice.
- B2C marketing (natural persons) will continue to require prior, explicit, informed, and unambiguous consent.
- The “soft opt-in” exception remains available only for existing customers and applies strictly under defined conditions.
- All marketing messages must include a clear unsubscribe mechanism, and opt-out requests must be implemented promptly.
- Organisations should review and document their marketing processes and update their procedures and documentation accordingly to ensure that direct marketing activities comply with GDPR and the Republic of Lithuania Law on Electronic Communications.
Vinted GDPR access rights breach: Lithuanian DPA finds failures in handling Article 15 requests and transparency obligations, issues a reprimand despite prior data deletion
Case background
• Complaint transferred from German supervisory authority to Lithuanian State Data Protection Inspectorate.
• The individual’s Vinted account was blocked due to suspected unfair activity, allegedly based on automated decision-making.
• User exercised GDPR Article 15 right of access, requesting:
– explanation of decision logic (automated decision-making),
– information on recipients of personal data.
Key compliance failures identified
• First access request:
– Not properly recognised or processed as a GDPR access request.
– Company redirected user to the general privacy policy instead of providing specific Article 15 disclosures.
– Violation of Article 15(1) GDPR (right of access) and Article 12(3) GDPR (timely response obligation).
• Second access request:
– Identity verification process lacked transparency and clear structure.
– No clear deadlines communicated.
– Refusal/mishandling of request not properly explained.
– Failure to inform data subject of:
→ right to lodge a complaint,
→ right to seek judicial remedy.
– Violation of Articles 12(1) and 12(4) GDPR (transparent communication and handling of requests).
Systemic issues highlighted
• Weak internal classification of GDPR requests (misidentification of Article 15 requests).
• Insufficient procedural safeguards for handling access requests.
• Inadequate communication standards in identity verification and refusal handling.
Outcome
• Account and personal data had already been deleted at the time of decision.
• Supervisory authority issued:
– formal reprimand,
– in order to provide a proper explanation to the complainant regarding the second request.
Key takeaway
GDPR compliance risk here was not substantive data misuse but procedural failure: misclassification of access requests, lack of structured response workflows, and insufficient transparency under Article 12 GDPR—areas that remain high-risk for large digital platforms handling automated decisions and account restrictions.
Our recommendations:
1. Implement a clear DSAR procedure
• Define how requests are identified, logged, and processed.
• Ensure all channels (e.g. shared inboxes) are covered.
2. Train staff to recognize GDPR requests
• Requests do not need to explicitly mention “GDPR”.
• Any request for personal data access must be treated accordingly.
3. Set clear timelines and communication standards
• Always respond within 1 month.
If identity verification is needed:
• explain why,
• set a clear deadline,
• keep the request open until resolved
4. Ensure transparency when refusing or closing requests
Clearly explain:
• reasons for refusal or inaction
• the right to complain to a supervisory authority
• available legal remedies.
5. Maintain a request register
• Track all requests, actions taken, and deadlines
• This is essential to demonstrate accountability (Article 5 GDPR) .
6. Assign clear responsibility
• Designate a responsible person or team
• Avoid situations where requests “sit” in a general inbox
UAB DELSKA Lithuania fined for GDPR security failure following cloud breach affecting ~3,000 individuals
Incident background
• Investigation initiated by Lithuanian State Data Protection Inspectorate (VDAI) in March 2025.
• Triggered by notification of a cybersecurity incident involving a public cloud services platform used by UAB “Rakrėjus” (later merged into UAB DELSKA Lithuania).
• Breach impacted personal data of approximately 3,000 data subjects.
• Some data could not be restored; temporary disruption of services, including financial services.
Regulatory assessment
• Breach classified as medium severity.
• Authority found insufficient technical and organisational safeguards to protect personal data.
• Violation of Article 32(1)(b) GDPR (security of processing – ensuring ongoing confidentiality, integrity, availability, and resilience of systems).
Key compliance issue
• Failure to implement adequate security measures appropriate to the risk level of cloud-based processing.
• Insufficient resilience leading to both data loss and operational disruption.
Enforcement outcome
• Administrative fine: EUR 4,500.
• Liability imposed on UAB DELSKA Lithuania as legal successor of the merged entity UAB “Rakrėjus”.
Key takeaway
This decision reinforces that GDPR Article 32 obligations extend to cloud-based infrastructures and survive corporate restructuring events such as mergers. Even medium-severity incidents involving partial data loss and service disruption can result in regulatory sanctions where security controls are deemed insufficient relative to processing risks.
Organisations should ensure appropriate technical and organisational safeguards, including access controls, encryption, regular risk assessments, and secure backup solutions.
We recommended to:
• assess the security standards of cloud service providers and clearly allocate responsibilities in data processing agreements;
• implement continuous monitoring, software updates, and incident detection mechanisms;
• maintain reliable backup and recovery systems to ensure business continuity and prevent data loss;
• provide regular staff training and establish internal security policies to reduce risks related to human error;
• establish clear incident response procedures to ensure timely identification, containment, and reporting of personal data breaches in accordance with GDPR requirements.
About the Author:
Loreta Andziulytė is an Attorney at Law and Partner at ECOVIS ProventusLaw. Having more than 20 years’ experience, she is ranked in FinTech Legal by Chambers and Partners FinTech (2020, 2023, 2024, 2025, 2026), ranked in Employment Law by Chambers and Partners (2023, 2024, 2025, 2026), recognised in Employment, TMT, Dispute Resolution, Tax and FinTech by The Legal 500 (2019–2025).
Loreta is a Certified Information Privacy Professional (CIPP/E) and head of the firm’s technology team. She specializes in FinTech licensing, regulatory affairs, and data protection, guiding international financial institutions through complex compliance frameworks.
Newsletter Subscription
Get in touch