Privacy and data protection is one of the nine subjects on the A1/A3 theory exam, and it is the one most pilots skim. It feels soft next to airspace, weight classes and weather. But the moment your drone carries a camera, you are one step away from processing other people's personal data — and the law that governs that is not aviation law at all. This is when filming with a drone in Latvia actually triggers the GDPR, and what to do about it.
Two regulators, two separate jobs
The drone you fly answers to two authorities that do not overlap. The Civil Aviation Agency (CAA Latvia) cares about flight safety — where you may fly, how high, how far from people. Personal data is a different office's job: the Data State Inspectorate (Datu valsts inspekcija, the DVI), which enforces the GDPR in Latvia.
A flight that is perfectly legal under the Open-category rules can still breach data protection law, and clearing one regulator says nothing about the other. EASA frames it the same way: any drone operation that collects personal data carries its own legal obligations, separate from the rules on where and how you fly.
What counts as "personal data" from the air
Personal data is broader than most pilots assume. EASA's guidance is explicit — it is not only a recognisable face. A house front, a vehicle registration plate, a person's location, even a thermal (infrared) image can be personal data when it can be linked to an identifiable individual. The A1/A3 syllabus puts faces, licence plates and voice in the same category.
If your footage lets a specific person be singled out, you are in scope. EASA adds a warning worth keeping in mind: this can happen unintentionally, simply because a drone captures more than you meant it to.
The line the DVI draws: identifiable or not
The Latvian DVI published a plain-language explainer on drone use in September 2025, and its test is practical. Processing of personal data happens only when a specific person can be recognised in the material. By the DVI's own examples, you are usually not processing personal data when:
- the drone records from a long distance;
- visibility is poor and people cannot be distinguished;
- you film a private property, but the person themselves is not visible in the frame.
So a high, wide shot of a forest or a stretch of coastline is not a data-protection problem. A low pass that captures a recognisable neighbour in their garden is a different matter.
Personal use is exempt — but the exemption has edges
Here is the part that lets most hobbyists relax. If you film purely for yourself — keeping nice shots in your own archive, with no plan to share them — the GDPR does not apply, even if other people appear in the frame. This is the "purely personal or household activity" exemption written into Article 2 of the GDPR, and the DVI confirms it covers private drone footage.
The edge is publication, and the EU Court of Justice has already tested where it lies. In the Ryneš case (C-212/13), a home camera that also recorded a public footpath was held to fall outside the household exemption. The lesson transfers directly to drones: the moment your footage stops being a private keepsake and starts being shared — posted, sold, used to show "how the event went" — you can no longer lean on personal use.
If you publish, you need a basis the law accepts
Once the household exemption falls away, you need a lawful basis under the GDPR to share footage that contains identifiable people. The DVI points to the realistic ones for drone work:
- Legitimate interests — the usual basis for, say, an aerial clip of an event — but only after a balancing test that weighs your purpose against the privacy of the people filmed.
- Public interest, in narrow cases.
- Journalism, which has its own carve-outs.
Whichever basis you rely on, the people you film in a public space have rights — starting with the right to know it is happening. The DVI's suggested fix is refreshingly practical: put up an information sign in the area where you are filming. And a basis is not the end of it — the GDPR's Article 5 principles still apply. Collect only what you need, keep it no longer than necessary, and be able to explain what you did and why.
A separate trap: critical infrastructure
Data protection is not the only non-aviation rule on filming. Around critical infrastructure in Latvia you will see the sign "BEZ SASKAŅOŠANAS FOTOGRAFĒT, FILMĒT AIZLIEGTS" — photographing or filming without authorisation is prohibited. That restriction stands on its own, whether or not any person is in the shot. It is on the A1/A3 syllabus for a reason: pilots forget that "no people, no problem" does not cover protected sites.
Before you publish: a short check
- Can a specific person be identified in the footage? If not, you are likely clear.
- Is it only for your private archive? Personal use is exempt.
- Are you sharing it publicly? Pick a lawful basis and run the balancing test.
- Did you film people in a public place on purpose? Inform them — a sign is enough.
- Were you near critical infrastructure? Look for the no-filming sign first.
What matters now
For most recreational pilots the answer is reassuring: filming for yourself is fine, and distant or unidentifiable footage is not personal data at all. The risk concentrates in one move — publishing footage in which real people can be recognised. Treat that as the moment the GDPR switches on: give yourself a lawful basis and inform the people in frame. It is also a genuine exam subject, so the same reasoning earns you marks on the A1/A3 theory test.
Want the rest of the theory? Our guide to the A1/A3 exam covers all 9 A1/A3 subjects, and the A1/A3 licence guide walks the whole path from registration to certificate. Drill the wider syllabus in the practice sets.
