News by topic
1. Acceptance of residence permit applications for work and bachelor's studies from 2026-11-01
Status: adopted amendments to the Law on the Legal Status of Aliens take effect on 2026-11-01; the Migration Department published its official explanation on 2026-10-15.
What changes: a foreign national lawfully present in Lithuania may submit an application in Lithuania for a temporary residence permit based on employment or first-cycle (bachelor's) studies if they hold a valid Lithuanian temporary residence permit, a Lithuanian national visa, a residence permit issued by another Schengen or EU state, or the right to stay in Lithuania visa-free. Holders of only a Schengen visa issued by Lithuania or another Schengen state, or a national visa issued by another state, must apply through the external service provider VFS Global. The stated acceptance arrangements for highly qualified workers remain unchanged. The permit-replacement application procedure also remains unchanged: according to the Migration Department, an application is accepted when the applicant holds a valid employment-based temporary residence permit with no more than six months remaining before expiry.
Who is affected: third-country nationals seeking residence permits for work or bachelor's studies and employers planning to hire them.
Practical steps: before submitting a mediation letter, check and document the basis for lawful stay and determine the appropriate application location.
Source: Migration Department.
2. VDAI findings on unlawful access to registry data
Status: the supervisory investigation findings were published on 2026-10-16 and the announcement updated on 2026-10-20; this is not a new legal act. Administrative fine assessment procedures were initiated concerning the Information Technology and Communications Department and the Centre of Registers, while the Migration Department received a reprimand.
What changes: an investigation into unlawful access to the Real Property Register and the Register of Legal Entities through two email accounts identified weaknesses in access controls and data security. VDAI cited shortcomings in multi-factor authentication, access restrictions, user-activity monitoring and breach notifications. These findings illustrate enforcement of existing GDPR obligations, rather than creating an identical new technical obligation for everyone.
Who is affected: data controllers and processors, particularly those using workplace email and having access to registers.
Practical steps: review multi-factor authentication, IP restrictions, access privileges, sign-in monitoring, incident management and compliance with breach-notification deadlines in light of the risks.
Source: State Data Protection Inspectorate.