Lithuania

• Lawful basis for processing personal data of EU residents
• Data subject rights: access, rectification, erasure, portability, objection
• Data Protection Impact Assessments (DPIAs) for high-risk processing
• +4 more requirements

• Risk management measures for network and information systems
• Incident reporting: 24h early warning, 72h notification to CSIRT
• Supply chain security assessments
• +3 more requirements

• Double materiality assessment (impact materiality + financial materiality)
• Report against ESRS (European Sustainability Reporting Standards) - 12 standards
• Digital tagging in XHTML with iXBRL markup
• +4 more requirements

noyb has filed a complaint with the Lithuanian Data Protection Authority against Whitebridge AI for multiple GDPR violations, including scraping and selling personal data without a legal basis and charging for access to data that should be free under Article 15. This enforcement action signals increased regulatory scrutiny of AI companies processing personal data and highlights the need for compliance with GDPR requirements for data scraping and subject rights.