Data protection & privacy law in Luxembourg (2026)

Legal framework

EU General Data Protection Regulation (Regulation 2016/679) directly applicable, implemented nationally by the Law of 1 August 2018 on the organisation of the Commission nationale pour la protection des données (CNPD) and the Law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data in criminal and national security matters; sector rules in the Law of 30 May 2005 (ePrivacy). Supervisory authority: Commission nationale pour la protection des données (CNPD).

GDPR & data protection in Luxembourg

In Luxembourg, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the National Commission for Data Protection (CNPD).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the National Commission for Data Protection (CNPD)

Applies to

any organisation processing the personal data of people in Luxembourg, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Luxembourg supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Luxembourg

1. 01Primary legal framework

   GDPR (Regulation (EU) 2016/679) applies directly; the Law of 1 August 2018 organising the CNPD and implementing the GDPR, together with the companion Law of 1 August 2018 on data processing in criminal/national-security matters (transposing the LED), forms the national backbone and replaced the 2002 data-protection law.

   legilux.public.lu cnpd.public.lu

2. 02Supervisory authority (CNPD)

   The Commission nationale pour la protection des données is Luxembourg's independent DPA; it supervises GDPR compliance, issues binding corrective measures and fines, participates in the European Data Protection Board, and will host the European Case Handling Workshop in autumn 2026.

   cnpd.public.lu cnpd.public.lu

3. 03Enforcement and the Amazon case

   The CNPD imposed a record €746 million fine on Amazon Europe Core S.à r.l. in July 2021 for GDPR breaches linked to advertising-related data processing; the Luxembourg Administrative Court annulled the sanction in March 2026 for insufficient reasoning on seriousness and culpability, remanding the case so the CNPD may issue a new, properly reasoned penalty.

   hunton.com linari-law.lu

4. 04Workplace surveillance (national specificity)

   The 2018 implementing law preserves Luxembourg-specific rules on employee monitoring: the staff delegation (or affected employees) may, within 15 days of notification, ask the CNPD for a prior opinion on the surveillance's lawfulness, which has suspensive effect; lodging a complaint cannot constitute grounds for dismissal.

   csl.lu loyensloeff.com

5. 05Data Protection Officer (DPO)

   Under the GDPR as applied in Luxembourg, DPO appointment is mandatory for public bodies and for controllers/processors whose core activities consist of large-scale regular and systematic monitoring or large-scale processing of special-category or criminal-conviction data; contact details must be notified to the CNPD.

   cnpd.public.lu guichet.public.lu

6. 06ePrivacy and retention

   The Law of 30 May 2005 on the processing of personal data in the electronic-communications sector transposes the ePrivacy Directive and governs cookies, confidentiality of communications, and retention of traffic/location data (six months for law-enforcement purposes); the EU-level ePrivacy Regulation was withdrawn from the Commission's 2025 work programme, so this national regime continues to apply.

   linklaters.com cms.law

7. 072025–2026 supervisory priorities

   In 2025 the CNPD focused inspections on records of processing activities (Article 30 GDPR) and GDPR compliance of video-surveillance systems, issuing seven corrective measures including six fines ranging from €1,277 to €175,000, chiefly for data-minimisation and retention-limitation breaches.

   cms.law cnpd.public.lu

GDPR in Luxembourg: FAQ

Timeline of decisions

1. 1 Apr 2026Guidance · official
   CNPD marks 10 years of the GDPR as cornerstone of Luxembourg data protection

   Luxembourg's data protection authority published a reflection on a decade of the GDPR, reaffirming its role enforcing the regulation and supporting compliance. It signals continuity of the GDPR-based framework as the country's core privacy regime.

   CNPD

2. 13 Mar 2026Decision · official
   Administrative Court annuls Amazon's €746M GDPR fine, refers case back to CNPD

   Luxembourg's Administrative Court overturned the record €746 million fine, finding the CNPD had not analysed Amazon's intent/negligence nor whether a fine was proportionate, while upholding that Amazon's 'legitimate interests' basis and information practices breached the GDPR. The case was sent back to the regulator for reassessment.

   CNPD

3. 6 Jan 2025Enforcement
   CNPD fines a major credit institution for late data-subject access responses

   The CNPD sanctioned a major bank for failing to meet GDPR deadlines for handling access requests; an initial €493,560 penalty was reduced to €175,000. It underscored the authority's focus on enforcing data-subject rights timelines.

   INPLP

4. 16 Jul 2021Enforcement
   CNPD imposes record €746 million GDPR fine on Amazon

   The CNPD fined Amazon Europe Core S.à r.l. €746 million for processing personal data for targeted advertising without valid consent, the largest GDPR fine ever at the time, stemming from a 2018 complaint by La Quadrature du Net. It established Luxembourg's regulator as a major enforcer for the EU-headquartered tech sector.

   ICLG

5. 16 Jul 2021Enforcement
   CNPD issues record €746M GDPR fine against Amazon

   Luxembourg's data protection authority fined Amazon €746 million over consent for personalised advertising, the largest GDPR penalty to date, underscoring the CNPD's role enforcing data-security and privacy obligations; the fine was later overturned by a Luxembourg court in 2026 and remanded.

   National Law Review (reporting CNPD decision)

6. 1 Aug 2018Law · official
   Law of 1 August 2018 establishes the modern CNPD and GDPR framework

   This law reorganised the CNPD and laid down the national rules complementing the GDPR, repealing the 2002 Act. It is the foundation of Luxembourg's current data-protection regime, granting the CNPD investigative and fining powers (up to €20M or 4% of global turnover).

   CNPD / Official Gazette

7. 25 May 2018Law · official
   GDPR becomes directly applicable in Luxembourg

   EU Regulation 2016/679 (GDPR) took direct effect across the EU, replacing the 2002 Act as the principal data-protection instrument in Luxembourg. It introduced expanded data-subject rights, accountability obligations, and far higher sanctions.

   CNPD

8. 30 May 2005Law · official
   Law of 30 May 2005 on privacy in the electronic communications sector

   Transposing the ePrivacy Directive 2002/58/EC, this Act set sector-specific rules on cookies (consent), direct marketing, traffic/location data, and breach notification by communications providers. It remains the basis for cookie and electronic-marketing rules in Luxembourg.

   CNPD

9. 5 Jul 2004Law · official
   E-Commerce Law Amended: Mandatory Opt-In for Unsolicited Commercial Email

   The Law of 5 July 2004 updated Luxembourg's 2000 e-commerce framework by replacing an opt-out regime for unsolicited commercial emails with a mandatory opt-in requirement, aligning with EU Directive 2002/58/EC. It also clarified rules on electronic contract formation and consumer protection for online transactions.

   Institut Luxembourgeois de Régulation (ILR)

10. 2 Aug 2002Law · official
    Law of 2 August 2002 creates the CNPD and Luxembourg's first modern data-protection regime

    Transposing the EU Data Protection Directive 95/46/EC, this Act (in force 1 December 2002) established the National Commission for Data Protection (CNPD) as an independent authority and set general processing rules. It was the country's first comprehensive privacy law in the modern sense.

    EU Agency for Fundamental Rights (FRA)

11. 31 Mar 1979Law · official
    Law of 31 March 1979 regulating computerised use of personal data

    Luxembourg's earliest data-protection statute governed the digital identification of natural and legal persons and the use of nominative data in automated processing. It marked the country's first legal recognition of data-protection concerns, later repealed by the 2002 Act.

    CNPD

Sources

1. 1.cnpd.public.lu/en.html
2. 2.cnpd.public.lu/fr/legislation/droit-lux.html
3. 3.legilux.public.lu/eli/etat/leg/loi/2018/08/01/a686/jo
4. 4.cnpd.public.lu/en/actualites/international/2026/04/rgpd-10-ans.html
5. 5.cnpd.public.lu/en/professionnels/dpo.html
6. 6.guichet.public.lu/en/entreprises/ressources-humaines/conditions-travail/protection-donn
7. 7.csl.lu/en/your-rights/employees/workplace-monitoring/
8. 8.loyensloeff.com/luxembourg-employee-monitoring-guidance-note.pdf
9. 9.linklaters.com/en/insights/data-protected/data-protected---luxembourg
10. 10.cms.law/en/lux/legal-updates/eprivacy-newsletter-february-2025
11. 11.hunton.com/privacy-and-information-security-law/luxembourg-dpa-fines-amazon-756-
12. 12.linari-law.lu/luxembourg-court-of-appeal-cancels-eur-746-million-cnpd-fine-against-
13. 13.cms.law/en/alb/publications/gdpr-enforcement-tracker-report/luxembourg
14. 14.cnpd.public.lu/en/actualites.html