GDPR
GDPR compliance for a business in Luxembourg: where to start
Quick answer
GDPR compliance starts with the record of processing activities: list the data processed, its purpose and its legal basis. Next come security, informing individuals, regulating processors and, where necessary, appointing a DPO. In Luxembourg, the supervisory authority is the CNPD.
Bringing a business in Luxembourg into GDPR compliance is not a one-off project but a structured process. It starts with mapping the processing operations (record), then secures each processing operation with a valid legal basis, clear information for individuals and appropriate security measures. Added to this are the contractual regulation of processors, the handling of personal data breaches and, where relevant, the appointment of a data protection officer. The supervisory authority is the CNPD. For support, see our GDPR lawyer in Luxembourg page or the contractual aspects of the subject.
In short
- Draw up the record of processing activities: list the data, purposes, legal bases and retention periods.
- Identify a valid legal basis for each processing operation (consent, contract, legal obligation, legitimate interest).
- Draft clear information for individuals and obtain compliant consent where it is required.
- Put in place proportionate security measures (access, encryption, back-ups, incident management).
- Regulate processors with contractual clauses complying with article 28 of the GDPR.
- Prepare for breach management: internal procedure and notification to the CNPD within 72 hours.
| Legal basis | Example of use | Point to watch |
|---|---|---|
| Consent | Newsletter, non-essential cookies | Must be freely given, informed and revocable |
| Contract | Fulfilling an order, subscription | Limited to what is necessary for the contract |
| Legal obligation | Payroll, accounting, returns | Imposed by an applicable text |
| Legitimate interest | Security, regulated direct marketing | Requires a documented balancing test |
| Vital interests | Emergency situations | Exceptional use |
| Task in the public interest | Bodies entrusted with a task | Specific framework |
Does the GDPR apply to my business in Luxembourg?
The General Data Protection Regulation applies as soon as a business processes personal data, that is, any information relating to an identified or identifiable natural person: name, address, e-mail, customer ID, connection or payment data. Almost all businesses are covered, whatever their size.
The GDPR has a broad reach. It covers processing carried out by a business established in Luxembourg, but also that of non-European businesses that target individuals located in the Union, for example through an online shop. Compliance is therefore not reserved for large groups: an SME, a start-up or an online business is fully subject to it.
Understanding its scope is the first step in any compliance process. A law firm helps to characterise the processing operations and to define precisely the obligations that apply, with digital tools serving only to document and organise this legal analysis.
What is the role of the CNPD in Luxembourg?
In Luxembourg, the competent supervisory authority is the National Commission for Data Protection (CNPD). It ensures compliance with the GDPR and with the Luxembourg law of 1 August 2018, supports organisations, handles complaints and has powers of inspection and sanction.
The CNPD publishes guidelines, templates and recommendations that are useful for structuring a compliance project. It is also the point of contact for notifying personal data breaches and for the possible appointment of a data protection officer.
Knowing the CNPD's position makes it possible to anticipate its expectations. A lawyer admitted to the Luxembourg Bar acts as the interface with the authority, prepares responses to any requests and secures the exchanges, in particular in the event of an inspection.
What are the steps to GDPR compliance?
Compliance follows a step-by-step logic. The first step is to map the processing operations: what data, for what purposes, on what legal basis, for how long and with which recipients. This mapping feeds the record of processing activities, the central document of the process.
Next come securing each processing operation legally (legal basis, information, consent), putting in place technical and organisational security measures, regulating processors and defining internal procedures (data subjects' rights, personal data breaches).
Compliance is not static: it has to be maintained over time. Every new processing operation, tool or service provider must be integrated into the process. Support from a business lawyer makes it possible to embed this governance for the long term.
Which legal basis should be chosen for each processing operation?
No data processing is lawful without a legal basis. The GDPR provides for several: the individual's consent, the performance of a contract, compliance with a legal obligation, the protection of vital interests, a task carried out in the public interest or the legitimate interest of the controller.
The choice of legal basis is not free: it depends on the actual purpose of the processing. A marketing newsletter sent to prospects is in principle based on consent (an exception exists for similar products offered to existing customers), payroll management on a legal obligation, fulfilling an order on the contract. A poorly chosen basis weakens the entire processing operation.
Documenting the legal basis of each processing operation is essential, because the business must be able to justify it. This analysis, often underestimated, is a matter of legal characterisation that a lawyer's involvement secures, in connection with the drafting of your contracts.
Do you need to keep a record of processing activities?
The record of processing activities is the cornerstone of compliance. For each processing operation, it lists the purposes pursued, the categories of data and of data subjects, the recipients, the retention periods and the security measures. It is the business's documentary memory.
Although certain record-keeping obligations are lighter for organisations with fewer than 250 employees, the exception remains limited: as soon as a processing operation is not occasional, involves sensitive data or data relating to criminal convictions, or may present a risk, the record is required. In practice, almost all businesses must keep one.
Beyond the obligation, the record is a management tool. It makes it possible to identify risky processing operations, to prepare a data protection impact assessment where necessary and to respond quickly to a request from the CNPD. It is best drafted with legal oversight.
How should individuals be informed and their consent obtained?
Anyone whose data is processed is entitled to transparent information: the identity of the controller, the purposes, the legal basis, the recipients, the retention period and the rights available to them (access, rectification, erasure, objection, portability). This information generally takes the form of a privacy policy.
Where processing is based on consent, that consent must be freely given, specific, informed and unambiguous. A pre-ticked box or blanket consent is not enough. It must be possible to withdraw consent as easily as it was given, and the business must keep proof of it.
Incomplete information or improperly obtained consent are frequent sources of non-compliance. The drafting of information notices and of consent collection mechanisms benefits from a careful legal review.
What data security measures does the GDPR require?
The GDPR requires appropriate technical and organisational measures to ensure data security, according to the risks. These measures include access management, encryption where relevant, regular back-ups, logging and a clear incident management policy.
Security is not only an IT matter: it is also organisational. Staff awareness, management of access rights, rules for remote working and incident procedures are an integral part of the system. The level of requirements is proportionate to the risk for individuals.
A security flaw can lead to a personal data breach and give rise to the business's liability. Combining technical measures with a solid contractual and procedural framework is a joint task for the business, its service providers and its legal adviser.
Processors, DPO, breaches and sanctions: what does the GDPR provide?
When a business entrusts processing to a service provider (hosting, software, payroll), that processor must be bound by a contract complying with article 28 of the GDPR, specifying the obligations of security, confidentiality and assistance. The appointment of a data protection officer (DPO), for its part, is mandatory in certain cases and recommended in others.
In the event of a personal data breach likely to give rise to a risk, the business must in principle notify the CNPD within 72 hours of becoming aware of it and, if the risk is high, inform the data subjects. A pre-established internal procedure makes it possible to meet this deadline and to document the response.
Non-compliance with the GDPR exposes the business to administrative fines of up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher (art. 83 GDPR), as well as to actions by data subjects. That is why the lawyer's role is central: the lawyer characterises the obligations, secures the documentation, frames the contracts and supports the business in its dealings with the CNPD. To get started, you can request a quote or book a consultation.
| Step | Purpose | Deliverable |
|---|---|---|
| Mapping | List the processing operations | Record of processing activities |
| Legal basis | Secure each processing operation | Documented justification |
| Information | Inform individuals | Privacy policy |
| Security | Protect the data | Technical and organisational measures |
| Processors | Regulate service providers | Article 28 clauses |
| Breaches | React quickly | Procedure and CNPD notification |
Depending on your profile
For SMEs
An SME should start with its record of processing activities, identify the legal basis for each use of data (customers, employees, prospects), secure its access controls and regulate its service providers. Appointing a DPO is mandatory only in certain cases, but documentation remains essential.
For start-ups
A start-up benefits from building GDPR compliance into the design of its product (privacy by design): data minimisation, a clear legal basis, transparent information and compliant processor contracts. This avoids costly rework during a fundraising round or a due diligence.
For e-commerce
An e-commerce site processes commercially sensitive data: orders, payments, customer accounts, cookies. It must take care over pre-contractual information, consent to non-essential cookies, payment security and the fit between the privacy policy and the terms and conditions of sale.
For controllers
The controller is the guarantor of compliance: it defines the purposes, chooses the legal bases, regulates processors and answers to the CNPD. It must be able to demonstrate its compliance (accountability) at any time, which requires rigorous, up-to-date documentation.
Official sources
Update history
- : GDPR consent presented without a ranking of legal bases, cookie rule linked to the amended law of 30 May 2005, and the 250-employee threshold and starting point of the 72-hour period clarified.