Business backup solution in Luxembourg: NIS2, DORA, GDPR

A business backup solution is no longer a simple IT safety net in Luxembourg: for a growing share of the country's companies, it has become a legal obligation with a precise deadline. Since 10 May 2026, the law transposing the NIS2 directive has required essential and important entities to put business continuity measures in place, including backups, a disaster recovery plan and tested restoration, according to a press release from the Luxembourg government. For the executives, marketers and IT managers steering this compliance work, the question is no longer whether to back up data, but with which architecture, with which provider, and under which sector rules.

The risk is not theoretical. During the night of 22 to 23 July 2022, the energy operator Encevo, Creos and Enovos, suffered a ransomware attack by the BlackCat/ALPHV group, which exfiltrated around 180,000 files, contracts, invoices and identity documents, according to L'essentiel. Customer portals were out of action for several days, although the energy supply was not interrupted. Yet only 37% of Luxembourg companies used cloud computing services in 2023, compared with 25% in 2018, a level that remained below the European Union average of 45% the same year, according to Eurostat. Many local SMEs are therefore approaching this regulatory obligation without a mature cloud infrastructure already in place.

Business backup solution: what the NIS2 law has required since 10 May 2026

The law of 5 May 2026 transposing the European NIS2 directive in Luxembourg came into force on 10 May 2026, according to gouvernement.lu. It requires entities it classifies as essential or important to apply cyber risk management measures that explicitly include data backup, a disaster recovery plan and restoration procedures tested under real conditions. In practice, owning a backup tool is no longer enough: the company must be able to demonstrate that it can restore its systems within a timeframe compatible with the continuity of its business.

The application thresholds, set out by the ILR in its NIS2 FAQ, distinguish two categories. An entity is classified as essential from 250 employees or more than 50 million euros in annual turnover. It is classified as important from 50 employees or 10 million euros in turnover, in the sectors listed in the annex to the directive. In the event of a significant incident affecting data availability, the law requires an early warning to the ILR within 24 hours, an interim report within 72 hours and a final report within one month. Penalties can reach 10 million euros or 2% of annual worldwide turnover, according to gouvernement.lu.

ILR self-registration: the 10 July 2026 deadline

Entities within the scope of NIS2 must self-register with the Institut luxembourgeois de régulation (Luxembourg Regulatory Institute) by 10 July 2026 at the latest, using the official form available on the ILR website. This formality is separate from technical compliance itself: a company can be behind on its backup solution while having completed its self-registration, and vice versa. For SMEs that discover late that they fall within the scope, since classification by sector and size is not always intuitive, the ILR provides a detailed FAQ for checking their status before starting to choose a provider. Our 4-week plan for Luxembourg SMEs also sets out the practical steps towards cyber compliance, backup included.

DORA and the CSSF: stricter requirements for the financial sector

For Luxembourg financial entities, the obligations come on top of NIS2. The European DORA regulation has been fully applicable since 17 January 2025, and it is the CSSF, together with the Commissariat aux assurances (insurance regulator) for the insurance sector, that supervises compliance. DORA imposes an even tighter notification schedule than NIS2: an initial notification within 4 hours in the event of a major ICT incident, an interim report within 72 hours and a final report within one month. A backup that does not make it possible to document precisely, within this timeframe, what was affected and what was restored is not enough to meet the obligation.

Compliance is not plain sailing: according to a readiness survey conducted by the CSSF in September 2024 among 389 entities, reported by Paperjam, contractual negotiation with IT providers, and in particular backup and continuity clauses, is the main difficulty encountered. This difficulty is all the more concrete because CSSF circular 20/750, as amended by circulars 22/828 and 25/881, requires that for any outsourced IT function deemed critical or important, the redundancy and data backup measures be explicitly specified in the contract signed with the provider. Choosing a good tool is therefore not enough: the contract governing it must also be compliant. We also detail the scope of DORA for third-country branches established in Luxembourg.

GDPR and the CNPD: the restoration obligation that applies to every company

Whether or not your company falls within the scope of NIS2 or DORA, the General Data Protection Regulation applies to all companies that process personal data, that is, practically all of them. Its Article 32 requires security measures proportionate to the risk, and explicitly cites the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident. The CNPD, the Luxembourg supervisory authority, publishes a GDPR preparation guide that details this requirement for data controllers. An SME with ten employees that meets none of the NIS2 thresholds and has no link to the financial sector is therefore still required, under the GDPR alone, to be able to restore its customer files after a breakdown, theft of equipment or accidental data loss. On this point, our article on the obligation to appoint a DPO helps you check whether your organisation needs to go further than technical compliance alone.

Local, cloud or hybrid backup: which model to choose?

Once the regulatory framework is in place, the technical choice remains. Three types of backup are generally distinguished in the sector's reference technical documentation: full backup, which copies all data at each run; incremental backup, which copies only the data changed since the last backup of any kind; and differential backup, which copies the data changed since the last full backup. Each represents a different trade-off between backup time, storage space used and speed of restoration: incremental backup is the fastest to run but the slowest to restore, since several increments have to be replayed in order.

The choice between local, cloud or hybrid backup then depends on three concrete factors: the volume of data and virtual machines to protect, the sensitivity of the data with regard to the GDPR or banking professional secrecy, and the in-house capacity to operate the infrastructure. Against ransomware, the criterion that matters most is not where the backup is located but how isolated it is: an immutable copy, disconnected from the production network, is what was missing for many companies hit by attacks in which the backup itself was encrypted at the same time as the production databases. A hybrid architecture, combining a local copy that is quick to restore with a cloud or off-site copy for disaster recovery, remains the answer most often cited in the sector's technical documentation to cover both day-to-day continuity and resilience in the face of a major disaster.

Support PSF and Tier IV data centres: the data sovereignty option

For companies that prefer to host their backup in Luxembourg rather than with an American cloud provider, Support PSF status (Professionnel du secteur financier, financial sector professional), regulated and supervised by the CSSF, provides a precise legal framework for outsourcing the IT hosting and backup of financial entities. Several Luxembourg providers, such as GITS or POST/EBRC, operate Tier IV certified data centres located on national territory under this status. This choice does not exempt a company from any regulatory obligation, but it makes demonstrating compliance to the CSSF or the ILR simpler: the data remains under Luxembourg law, in an infrastructure already audited by the regulator. For a non-financial company, this is not an obligation, but it is a strong argument at a time when data sovereignty is becoming a purchasing criterion in its own right, including outside the banking sector.

Testing restoration: the box companies forget to tick

The Luxembourg NIS2 law does not merely require a backup: it requires tested restoration, according to the text reported by gouvernement.lu. This is often the weak link. Many companies have a working backup solution but have never timed, or even simply checked, how long it takes to bring a database or a complete virtual machine environment back into service after a disaster. A documented restoration test, carried out at least once a year and at every significant change of infrastructure, is what makes it possible to answer an ILR or CSSF auditor with precise figures rather than a promise. In practical terms, it is also what distinguishes a company able to meet the 24-hour or 4-hour notification deadlines imposed by NIS2 and DORA from one that discovers, on the day of the incident, that restoration actually takes three days.

Which business backup solution to choose for your profile?

The table below summarises, according to your company's profile, the main obligation to meet, the key deadline and the most suitable backup option.

Choosing a business backup solution in Luxembourg in 2026 therefore means answering three questions in order: what is my regulatory status, GDPR only, NIS2 important or essential, or DORA; which deadline applies to me; and which architecture, local, cloud or hybrid, allows me to demonstrate tested restoration rather than a mere promise of backup. Providers operating in Luxembourg under Support PSF status or in local Tier IV data centres offer an answer to the sovereignty question, without ever exempting a company from regulatory compliance itself.

This article provides regulatory guidance drawn from official sources (gouvernement.lu, ILR, CSSF, CNPD) and does not constitute legal advice. To determine precisely your company's status under NIS2 or DORA, and to draft your contractual backup clauses, consult a lawyer or the competent regulator (ILR, CSSF).