Tech··4 min
GDPR in Luxembourg: what the CNPD checks and how to prepare
The CNPD received 846 complaints in 2025, 40% more than a year earlier. Here is what it actually checks and the 7-step method it recommends to Luxembourg companies.
Translated from French · Lire l'original en français
The CNPD received 846 complaints in 2025, up 40% year on year. For a Luxembourg business leader, this signals that an inspection or a complaint is no longer a distant possibility. Here is what the authority actually checks, and the method it recommends for getting ready.
What the CNPD can check in your company
The Commission nationale pour la protection des données (National Commission for Data Protection) has supervisory powers over compliance with the GDPR by data controllers established or operating in Luxembourg, according to the missions published on cnpd.public.lu. In practice, an inspection or the investigation of a complaint most often focuses on three points: an up-to-date record of processing activities, the appointment of a data protection officer (DPO) where it is mandatory, and the company's ability to notify a data breach within the required deadlines. The CNPD does not accredit DPOs, but it can check compliance with Articles 37 to 39 of the GDPR, which govern their appointment, position and tasks. Further reading on this topic: The CNPD checklist on cookies.
The CNPD method in 7 steps
To structure a compliance project, the CNPD publishes a preparation guide setting out seven steps. The advantage of this method is that it is designed for teams without an in-house lawyer, which reflects the reality of many Luxembourg SMEs.
- Understand the changes introduced by the GDPR
- Identify the personal data processing carried out in the company
- Appoint a data protection officer if the company is required to
- Draw up a compliance action plan
- Manage risks, with a data protection impact assessment (DPIA) where necessary
- Organise internal processes
- Document compliance
The details of each step are set out in the CNPD's GDPR preparation guide, the only source to follow when applying these steps to your own business.
Am I required to appoint a DPO?
According to the CNPD, appointing a DPO is mandatory in three specific cases: the processing is carried out by a public authority; the company's core activity consists of regular and systematic monitoring of data subjects on a large scale; or the core activity involves large-scale processing of special categories of data, such as health data (Articles 9 and 10 of the GDPR). Outside these three cases, a DPO may be appointed on a voluntary basis.
As soon as a DPO is in post, their appointment must be notified to the CNPD at dé[email protected], as stated on the dedicated page at cnpd.public.lu/fr/professionnels/dpo.html. A company unsure about its own situation would do well to document its reasoning: this is often one of the first items requested during a complaint investigation.
The 72-hour reflex in the event of a data leak
Any data breach likely to result in a risk to the rights and freedoms of the individuals concerned must be notified to the CNPD within 72 hours of its discovery, at [email protected]. This deadline runs at weekends as well as on weekdays, and it is cut to 24 hours for providers of electronic communications services, the CNPD states on its page on data breach notification. In practice, this means a business leader must know, before any incident occurs, who triggers the procedure internally and with what minimum information.
The risk of inspection is rising
The CNPD's annual report for 2025 shows the scale of the trend. The rise in complaints is not a statistical detail: it reflects growing vigilance among employees, customers and prospects in Luxembourg about how their data is used.
| 2025 indicator | Value |
|---|---|
| Complaints received | 846 (+40% year on year) |
| Total cases handled | 1,909 |
| Data breach notifications | 425 |
| Investigation cases conducted | 59 |
According to figures reported by L'essentiel and Le Quotidien, complaints in 2025 related primarily to the right of access (25%), the right to erasure (22%) and the general compliance of processing (21%). These are precisely the three areas that an up-to-date record of processing activities and a procedure for responding to requests can secure in advance. For the most serious breaches, the GDPR framework provides for fines of up to 20 million euros or 4% of annual worldwide turnover, whichever is higher.
This article is for information purposes only and does not replace legal advice. For any question about your situation, the CNPD's official guides and contacts remain the reference to consult. On a related subject, companies covered by the NIS2 directive will find similar guidance in our article NIS2 in Luxembourg: which companies are concerned and where to start.
