Digital··4 min
Data protection: does your company need to appoint a DPO?
A two-question test set out by the CNPD tells you in a few minutes whether your company must appoint a data protection officer. This article also covers how to declare one and the penalties already imposed.
Translated from French · Lire l'original en français
In Luxembourg, not every company has to appoint a data protection officer (DPO). It depends on what your business does, not on how big it is. The CNPD has set out a two-question test that settles the matter in a few minutes. If the answer is yes, you then file a free declaration with the authority.
The CNPD's two-question test
The legal basis is three articles of the GDPR, which has applied in Luxembourg since 25 May 2018: Articles 37 to 39. According to the CNPD, a private company must appoint a DPO if its core activity involves either of the following two situations.
| Question to ask yourself | What it covers in practice |
|---|---|
| Does your core activity rely on regular and systematic monitoring of individuals on a large scale? | Profiling, scoring, extensive behavioural tracking, continuous geolocation of customers or users |
| Does your core activity involve large-scale processing of special categories of data (Art. 9 GDPR) or criminal offence data (Art. 10 GDPR)? | Health, ethnic origin, opinions, sexual orientation, criminal convictions, processed in volume |
If either answer is yes, and the processing in question really is central to your business rather than incidental, appointing a DPO is a legal obligation under Articles 37 to 39 of the GDPR, not an option. The key phrase is “activité de base” (“core activity”). A recruitment firm that occasionally handles health data in an HR file is not in the same position as a clinic or an insurer, whose whole business is processing sensitive data.
Test negative? Document your decision anyway
Many managers stop at this point and close the file. That is a mistake, given the principle of accountability on which the whole GDPR rests. Even when the test triggers no obligation, the CNPD expects the company to set out in writing the analysis that led it not to appoint a DPO, so it can produce that analysis in the event of an inspection. A simple internal document, dated and reasoned against the two criteria above, is enough. It is also a good moment to check your other practices: B2B email prospecting, for example, follows separate rules from those on DPOs, but is just as tightly regulated.
How to declare a DPO to the CNPD, step by step
If the test is positive, or if you choose to appoint a DPO anyway, the process is simple. The CNPD and the Guichet.lu portal describe the same procedure:
- The declaration is made using a dedicated form, sent to [email protected].
- The form must be signed by a representative of the company, never by the DPO.
- The declaration must be made as soon as the DPO takes up the role, not afterwards.
- The procedure is entirely free of charge.
There are no fees and no prior approval from the CNPD. The company remains responsible for choosing its DPO, whether internal or outsourced, and for making sure that person has real expertise in Articles 37 to 39.
What CNPD penalties reveal about the mistakes to avoid
The CNPD does more than receive declarations: it checks how they are put into practice. Its public register of decisions and penalties lists several cases between 2021 and 2025 that relate directly to the DPO function. Fines of up to 18,000 euros have already been imposed for failing to involve the DPO in company decisions or for not giving the DPO adequate resources, according to an analysis of these decisions published by the law firm Lexing Avocats on 26 November 2021. In other words, naming a DPO on paper without actually consulting them, or without giving them the time and means to do the job, carries the same risk as not appointing one at all.
Outright failure to appoint a DPO, or to notify the CNPD, has also been penalised, notably in Luxembourg municipalities. In December 2023 the CNPD published a series of decisions on the appointment of DPOs by municipalities, following a first round of findings in 2021. The CNPD's message has been consistent for several years: appointing a DPO is not a cosmetic exercise. It is checked in practice, down to the actual role the organisation gives the DPO. For a manager in Luxembourg, the advice stays the same: rerun the two-question test whenever the business changes significantly, keep a written record of the decision, and if you appoint a DPO, make sure they are genuinely involved in decisions affecting data, not just named on an organisation chart.
