Lithuania:
What customers expect from suppliers

Lithuania as a market for South America

Lithuania has a strong food and logistics sector. Many importers and retail chains also supply Latvia and Estonia from Vilnius or Kaunas. For a wine exporter from Mendoza or a fruit trader from the Aconcagua Valley, a Lithuanian wholesaler can therefore open the door to three markets.

Klaipėda is the country's only seaport. Containers from South America usually arrive via a transshipment port in Western Europe and then by feeder vessel. Customs clearance takes place where the goods enter the EU.

In March 2026 the Lithuanian Ministry of Foreign Affairs welcomed the founding of a Lithuanian-Brazilian Chamber of Commerce, an initiative of Lithuania's honorary consul in Brazil.

What is the same across the EU and what is national

Customs and product law are the same across the EU. Since May 1, 2026, the trade part of the EU-Mercosur Agreement has applied provisionally, and the tariff preference also covers goods shipped to Lithuania. The basics are in the guide to exporting to the EU.

What is regulated nationally: the language of consumer information (Lithuanian), VAT (standard rate 21%) and the registration of packaging. Producers and importers of packaging and certain other goods must register in the state information system GPAIS and report their volumes there. Foreign companies can register through a representative. In most cases your Lithuanian importer takes care of this, because it is the one placing the goods on the market. Since August 12, 2026, the EU Packaging Regulation (EU) 2025/40 applies as well.

NIS2 in Lithuania

Lithuania revised its Cybersecurity Law (Kibernetinio saugumo įstatymas No. XII-1428) through Law No. XIV-2902. The revised version has applied since October 18, 2024, and the latest amendment (No. XV-1076) since July 2026. The details are in Government Resolution No. 945 of 2024, which includes a description of cybersecurity requirements that refers to ISO/IEC 27002.

The competent authority is the National Cyber Security Center (Nacionalinis kibernetinio saugumo centras, NKSC) under the Ministry of National Defense. It keeps the register of entities in scope, receives incident reports and imposes fines. One feature stands out: the obligations only apply once a company is entered in the register. From then on it has twelve months to implement them, or 24 months for some technical requirements.

Significant incidents must be reported to the NKSC as an early warning within 24 hours and as a notification within 72 hours, with the final report after one month. Management bodies must complete cybersecurity training every two years, and an independent audit is due every three years.

Until the EU sets more precise rules, Lithuania defines its own thresholds for when an incident counts as significant. They include an outage of two hours or more, 1,000 affected users or 25% of users (whichever is lower), and financial damage of €500,000 or more or 5% of the previous year's turnover. These thresholds are low. An outage of your service lasting a few hours can already trigger a report from your customer to the NKSC, and your customer will want to know when you informed them.

Important for suppliers: the description of requirements contains its own rules on the supply chain and on contract content. Your Lithuanian customer has to carry these over into its contract with you. Because the description refers to ISO/IEC 27002, controls you have documented for ISO 27001, for example in Sightadel, map onto it closely. More on the directive on the NIS2 page.

Data protection and supply chain

The data protection authority is the Valstybinė duomenų apsaugos inspekcija (VDAI, State Data Protection Inspectorate). It enforces the GDPR and, under the Cybersecurity Law, also has a role in cybersecurity policy. The usual obligations apply to you: a data processing agreement, a list of security measures, and standard contractual clauses if your country has no adequacy decision. The EU has adopted adequacy decisions for Argentina, Brazil and Uruguay, so data can flow there without standard contractual clauses. There is no decision for Chile, Colombia, Peru, Ecuador, Paraguay or Bolivia.

Lithuania has no supply chain law of its own. Human rights and environmental requirements come through large buyers and, in the future, through the CSDDD. For wood, coffee, soy and beef, the EUDR applies.

What Lithuanian customers typically ask for

In food retail, the large chains require a GFSI-recognized standard such as IFS, BRCGS or FSSC 22000, certificates of analysis and full traceability. Mandatory information has to appear on the packaging in Lithuanian. Decide before the first shipment whether you supply the label or the importer applies a sticker.

IT service providers receive contract annexes based on the Lithuanian description of requirements and on ISO 27001: access rights, multi-factor login, backups, reporting channels. If you supply Lithuanian banks or payment institutions, you will also get clauses under DORA. Sightadel covers DORA alongside ISO 27001, so you can manage both sets of requirements in one place.

How to proceed:

1. Ask your Lithuanian customer whether, and since when, it is entered in the NKSC register; its deadlines depend on that.
2. Agree on who reports the packaging in GPAIS.
3. Supply labels in Lithuanian or agree on stickers in writing.
4. For IT services, have evidence ready on access rights, backups and reporting channels.

Contacts

FAQ