Données et confidentialité: Luxembourg (2026)
Luxembourg has a mature, comprehensive personal-data protection regime based on the directly applicable EU GDPR, implemented domestically by the twin Laws of 1 August 2018, which repealed the former 2002 data-protection act and define the CNPD's enlarged tasks and corrective powers plus national specifics (notably workplace surveillance). An independent supervisory authority (the CNPD) actively enforces the GDPR, cooperates in the EDPB, and has issued major decisions, including a record €746m fine against Amazon in 2021 that the Luxembourg Administrative Court annulled in March 2026 and remanded to the CNPD for a new reasoned decision. The ePrivacy Directive is transposed by the 2005 Electronic Communications Act and continues to apply (the planned EU ePrivacy Regulation was dropped from the Commission's 2025 work programme).
Cadre principal
EU General Data Protection Regulation (Regulation 2016/679) directly applicable, implemented nationally by the Law of 1 August 2018 on the organisation of the Commission nationale pour la protection des données (CNPD) and the Law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data in criminal and national security matters; sector rules in the Law of 30 May 2005 (ePrivacy). Supervisory authority: Commission nationale pour la protection des données (CNPD).
Points clés
Primary legal framework
GDPR (Regulation (EU) 2016/679) applies directly; the Law of 1 August 2018 organising the CNPD and implementing the GDPR, together with the companion Law of 1 August 2018 on data processing in criminal/national-security matters (transposing the LED), forms the national backbone and replaced the 2002 data-protection law.
Supervisory authority (CNPD)
The Commission nationale pour la protection des données is Luxembourg's independent DPA; it supervises GDPR compliance, issues binding corrective measures and fines, participates in the European Data Protection Board, and will host the European Case Handling Workshop in autumn 2026.
Enforcement and the Amazon case
The CNPD imposed a record €746 million fine on Amazon Europe Core S.à r.l. in July 2021 for GDPR breaches linked to advertising-related data processing; the Luxembourg Administrative Court annulled the sanction in March 2026 for insufficient reasoning on seriousness and culpability, remanding the case so the CNPD may issue a new, properly reasoned penalty.
Workplace surveillance (national specificity)
The 2018 implementing law preserves Luxembourg-specific rules on employee monitoring: the staff delegation (or affected employees) may, within 15 days of notification, ask the CNPD for a prior opinion on the surveillance's lawfulness, which has suspensive effect; lodging a complaint cannot constitute grounds for dismissal.
Data Protection Officer (DPO)
Under the GDPR as applied in Luxembourg, DPO appointment is mandatory for public bodies and for controllers/processors whose core activities consist of large-scale regular and systematic monitoring or large-scale processing of special-category or criminal-conviction data; contact details must be notified to the CNPD.
ePrivacy and retention
The Law of 30 May 2005 on the processing of personal data in the electronic-communications sector transposes the ePrivacy Directive and governs cookies, confidentiality of communications, and retention of traffic/location data (six months for law-enforcement purposes); the EU-level ePrivacy Regulation was withdrawn from the Commission's 2025 work programme, so this national regime continues to apply.
2025–2026 supervisory priorities
In 2025 the CNPD focused inspections on records of processing activities (Article 30 GDPR) and GDPR compliance of video-surveillance systems, issuing seven corrective measures including six fines ranging from €1,277 to €175,000, chiefly for data-minimisation and retention-limitation breaches.
Cette page est une traduction fournie à titre indicatif ; la version anglaise fait foi et ne constitue pas un avis juridique.