Customer data protection in Luxembourg: GDPR, not Loi 25

Customer data protection is once again a board-level issue in Luxembourg. The CNPD received 846 new complaints in 2025, up 40% year on year, and imposed a record €746 million fine on Amazon from its base in Esch-sur-Alzette. Business leaders can no longer treat the subject as an administrative formality. This guide is for SMEs and mid-sized companies established in Luxembourg. It explains what the applicable regulation actually says. That regulation is not the Quebec “Loi 25”, which Google often wrongly associates with this search.

Customer data protection in Luxembourg: GDPR, not “Loi 25”

Many business leaders come across “Loi 25” when looking for information on their company's compliance. It is a Quebec law, phased in between 2022 and 2024, that governs the protection of personal information in Canada's private sector. It does not apply to any Luxembourg company. The framework that applies in Luxembourg is the EU General Data Protection Regulation (GDPR, or RGPD in French), directly applicable since 25 May 2018 according to EUR-Lex. It is supplemented by the law of 1 August 2018, which organises the Commission nationale pour la protection des données (national data protection commission) and implements the GDPR, published in Mémorial A n°686 according to Legilux. This law repeals the law of 2 August 2002 and makes the CNPD, headquartered in Esch-sur-Alzette, the supervisory authority for any question relating to the protection of customer, employee or prospect data. The GDPR applies as soon as a company processes data of residents of the European Union. This includes companies established outside the EU, provided they target this market. To understand exactly what the CNPD checks, see our guide to the GDPR in Luxembourg.

Which legal bases should you use for your customers' data?

According to the compliance guide published by the CNPD, the GDPR requires every processing of personal data to rest on one of six legal bases: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a task carried out in the public interest, or the legitimate interest of the controller. In everyday commercial practice, managing customer data (invoicing, contract follow-up, fraud prevention) most often falls under contract or legitimate interest. An email marketing campaign, by contrast, generally requires explicit consent that can be withdrawn. Choosing the legal basis is more than a formality. It determines the exact rights available to the customer, such as withdrawing consent or the right to object, as well as the information that must appear in your privacy policy. A frequent mistake observed by the CNPD is relying on legitimate interest for advertising processing without documenting the balancing test against the rights of the data subjects. This is exactly the issue that cost Amazon Europe Core €746 million in 2021.

Record of processing activities: the exemption available to SMEs

In principle, the GDPR requires every controller to keep a record of processing activities. However, a derogation set out in the CNPD guide exempts companies with fewer than 250 employees, on three conditions. Their processing must be occasional. It must not involve special categories of data such as health or political opinions. It must not pose a risk to the rights of the data subjects. In practice, few Luxembourg SMEs genuinely meet all three conditions once they process customer data on a recurring basis through a CRM, invoicing or a newsletter. The derogation mainly covers one-off, marginal processing, not day-to-day commercial activity. Before dispensing with the record, it is therefore safer to check each processing operation individually to see whether it really falls within this narrow scope.

Do you need to appoint a data protection officer (DPO)?

According to the CNPD, appointing a data protection officer is mandatory in three cases:

• the company is a public body;
• its core activity involves regular and systematic monitoring of individuals on a large scale;
• it processes so-called sensitive data (such as health or origin) or criminal data on a large scale.

Outside these three cases, appointing a DPO remains optional. It can, however, reassure B2B customers that are themselves subject to stricter compliance requirements. When a DPO is appointed, their contact details must be sent to the CNPD. Our guide details the criteria and the appointment procedure.

Retaining customer data: GDPR versus the 10-year accounting obligation

The GDPR principle of data minimisation means personal data must not be kept longer than the purpose of the processing requires. In Luxembourg, however, Article 16 of the Code de commerce (Commercial Code) also requires accounting documents to be kept for 10 years from the end of the financial year, according to Guichet.lu. This covers books, invoices and supporting documents linked to the customer relationship. Data strictly needed as accounting evidence, such as identity, amounts and invoice dates, may be kept for ten years on that ground alone. Ancillary data, such as preferences, browsing history or marketing data, must be deleted much earlier, as soon as the commercial purpose that justified collecting it no longer exists. In practice, a customer data retention policy should document which of the two periods applies to each processing operation.

Data breaches: the 72-hour notification procedure with the CNPD

According to the dedicated section of the CNPD website, any data breach that poses a risk to the rights and freedoms of the data subjects must be notified to the CNPD within 72 hours of the controller becoming aware of it. Notification is made using the official form, sent to [email protected]. When the risk to the data subjects is high (theft of bank details, passwords or health data), they must also be informed without undue delay, in addition to the notification to the authority. The 72-hour period starts when the incident is discovered, not when the investigation is complete. It is better to notify with information that is still partial and complete it later than to miss the deadline while waiting for an exhaustive investigation. According to the CNPD's 2025 annual report, nearly one breach in two (49%) stems from simple human error rather than hacking. Typical examples are a customer file sent to the wrong recipient, a badly configured backup, or access left active after an employee leaves. A properly sized backup and access control policy remains the first line of defence, even before the notification procedure.

What a company risks if it neglects customer data protection

In Luxembourg, penalties exist at two levels: those set by the GDPR itself and those added by the law of 1 August 2018. The table below summarises the amounts in force.

These fines under Luxembourg law specifically penalise breaches of certain articles, including Articles 3 to 15, 18 to 30 and 34 to 38 of the law. The State and the municipalities are exempt. According to Paperjam, the Amazon Europe Core case shows that even the highest amounts are not merely theoretical. In July 2021 the CNPD penalised advertising processing based on legitimate interest that it found non-compliant. In March 2025 the Administrative Tribunal confirmed the main infringements found and sent the case back to the CNPD for a fresh analysis. For an SME, the real risk lies less in the theoretical maximum penalty than in the activity figures: the CNPD handled 1,909 cases and recorded 425 breach notifications in 2025. Supervision has become a statistical reality, not a distant possibility. A free cybersecurity diagnostic is available to Luxembourg SMEs and often helps identify weaknesses before they become a breach that has to be notified.

Financial sector: professional secrecy on top of the GDPR

For financial sector institutions, customer data protection is not limited to the GDPR. Article 41 of the law of 5 April 1993 on the financial sector imposes a separate banking professional secrecy obligation. According to CSSF circular 06/240, using a cloud provider or an unregulated subcontractor requires the customer's explicit consent to waive this secrecy, on top of the GDPR requirements that apply to processors. This dual constraint explains why the Luxembourg financial centre remains particularly cautious about outsourcing its customer data, in contrast to some practices seen in other sectors.

In short, customer data protection in Luxembourg comes down to a few simple habits. Rely on the GDPR and the law of 1 August 2018 rather than foreign references such as “Loi 25”. Document the legal basis for each processing operation. Check whether the record exemption really applies. Reconcile GDPR retention with the 10-year accounting obligation. Prepare the CNPD notification procedure before a breach occurs. The figures in the CNPD's 2025 annual report show the issue is not going away. It is better to prepare calmly than to discover the gaps under 72 hours of pressure.