GDPR & data
GDPR and data protection lawyer in Luxembourg
The firm guides your GDPR compliance: records of processing activities, privacy policies, data processing agreements (DPAs) and dealings with the CNPD.
In short
The GDPR applies to any organisation processing personal data; in Luxembourg, the supervisory authority is the CNPD. A GDPR lawyer prepares the record of processing activities, drafts the privacy policies and processing agreements (DPA), and represents you before the CNPD if needed.
Responsible for legal content: Maître Cora Maglo, Avocate à la Cour, Liste I du Barreau de Luxembourg depuis 2009. · Updated on · Applicable law: Luxembourg
What is the GDPR and who does it apply to in Luxembourg?
GDPR — The GDPR, or Regulation (EU) 2016/679, governs any processing of personal data by an organisation established in the Union or targeting people located there. It has applied since 25 May 2018, whatever the size of the company. In Luxembourg, the National Commission for Data Protection (CNPD) supervises compliance.
Source: Regulation (EU) 2016/679, EUR-Lex
- Notification of a data breach
- To the authority within 72 hours of becoming aware of it (Art. 33)
- GDPR, Art. 33
- Reply to a data subject request
- One month, extendable by two months if the request is complex (Art. 12)
- GDPR, Art. 12
- Maximum fine
- EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83)
- GDPR, Art. 83
| Document | Purpose | Who requires it |
|---|---|---|
| Record of processing activities | Lists processing, purposes and retention periods | The CNPD, in the event of an inspection |
| Privacy policy | Informs people how their data is used | Customers, employees and site visitors |
| Data processing agreement (DPA) | Governs the provider that processes data on your behalf | Article 28 of the GDPR |
| Breach procedure | Organises the internal alert and the notification within 72 hours | Article 33 of the GDPR |
The GDPR applies to any organisation processing personal data. In Luxembourg, the supervisory authority is the CNPD.
The firm turns a complex regulatory obligation into a clear approach, proportionate to your activity.
GDPR and data protection lawyer in Luxembourg: when should you call on the firm?
Websites, customer files, HR and marketing tools: most businesses process personal data without any formal framework.
Information notices, the record of processing and contracts with service providers are often missing.
What happens if you do nothing?
The GDPR provides for fines that can reach very high amounts, together with a reputational risk in the event of a data breach.
The absence of a legal basis or of valid information makes a processing activity unlawful.
How does the firm step in?
Mapping of your processing activities, drafting of the record of processing, privacy policies and data processing clauses, and support in the event of an inspection.
The firm prioritises actions according to your real level of risk. Our digital tools only help gather and qualify information; the legal analysis is provided by a lawyer admitted to the Luxembourg Bar.
Practice areas
When to call on the firm
- Bringing your website and files into GDPR compliance.
- Drafting a privacy policy and information notices.
- Framing the relationship with a processor (DPA).
- Handling a data subject request or a CNPD inspection.
Start online
Start your case in under 5 minutes
A simple, transparent process supervised by a lawyer admitted to the Luxembourg Bar.
Today, most cases can be initiated entirely online. Our digital tools streamline administrative steps so the lawyer can focus on the legal analysis of your situation.
Step 1 of 5 · 3 to 5 minutes
Describe your need
Select your issue, answer a few simple questions and share your documents if needed.
What you get
- Initial qualification of the case
- List of useful documents
- Secure transmission
What reassures our clients
Confidentiality
Lawyer’s professional secrecy.
Speed
Start your case online 24/7.
Transparency
Fees communicated before engagement.
Expertise
Review by a lawyer of the Luxembourg Bar.
Simplicity
Under 5 minutes to open your case.
Documents required : GDPR and data protection lawyer in Luxembourg
- • A description of your processing activities and tools
- • Existing policies and notices
- • Contracts with your service providers
Deliverables : GDPR and data protection lawyer in Luxembourg
- • A record of processing activities
- • A privacy policy and information notices
- • Data processing clauses (DPA)
Indicative timing : GDPR and data protection lawyer in Luxembourg
Basic compliance can be achieved within a few weeks, depending on the scope.
Fixed fee or ongoing support
Depending on the scope (audit, documentation, ongoing support), costed in advance, from EUR 1,500.
Does my company need to comply with the GDPR?
Direct answer. Yes, as soon as you process personal data: customer files, payroll, a contact form, a newsletter or a recruitment tool. Company size does not exempt you from the GDPR; it mainly influences the documentation required and the level of formality.
The first step is to map what you collect, why, and from whom. This map then serves as the basis for the record, the information notices and the contracts with providers.
Is a record of processing activities mandatory?
Direct answer. In principle yes, but Article 30 of the GDPR provides an exemption for organisations with fewer than 250 people. The exemption falls away if the processing is not occasional, poses a risk to people's rights, or concerns sensitive data. In practice, most companies keep a record.
An up-to-date record is also the first document the CNPD asks for during an inspection.
What should you do in the event of a data breach?
Direct answer. Document the incident immediately and, unless the breach is unlikely to result in a risk to people, notify the CNPD within 72 hours of becoming aware of it. If the risk is high, the people concerned must also be informed.
The firm prepares an internal procedure before any incident, with roles and notification templates, so that the deadline can be met.
Is a DPO mandatory for my company?
Direct answer. A data protection officer is mandatory only in specific cases under Article 37: a public authority, regular and systematic large-scale monitoring of individuals, or large-scale processing of sensitive data. An ordinary SME is generally not required to appoint one, but may do so voluntarily.
The firm reviews your activity and tells you in writing whether appointment is required.
FAQ
Frequently asked questions
Does the GDPR apply to my small business?
Yes, the GDPR applies to your small business as soon as you process personal data (customers, employees, prospects), whatever your size.
Do I need to appoint a DPO?
Appointing a data protection officer is only mandatory in certain cases. The firm tells you whether a DPO is required for your organisation.
Who enforces the GDPR in Luxembourg?
The GDPR is enforced in Luxembourg by the Commission nationale pour la protection des donnees (CNPD), the competent supervisory authority.
What fine does a company face for GDPR non-compliance?
The fine can reach EUR 20 million or 4% of worldwide annual turnover for the most serious breaches, and EUR 10 million or 2% for other obligations. The amount depends on the gravity, the duration and the company's cooperation.
How long do I have to reply to a data access request?
One month from receipt of the request, extendable by two months if complex, with the person informed within the first month.
GDPR and data protection lawyer in Luxembourg: which documents should you prepare?
The firm usually asks for: (1) A description of your processing activities and tools; (2) Existing policies and notices; (3) Contracts with your service providers. Further documents may be requested once your situation has been reviewed.
GDPR and data protection lawyer in Luxembourg: what does the firm’s support include?
The firm’s support usually includes: (1) A record of processing activities; (2) A privacy policy and information notices; (3) Data processing clauses (DPA). The exact scope is set out in the quote, before any engagement.
Member of
Affiliations & professional networks
Free guide · PDF
The practical guide to secure your next step
Checklists, key steps and points to watch, prepared by the firm. Get it instantly, no strings attached.
- The key steps, explained simply
- The documents to prepare
- The common mistakes to avoid
Free diagnostic
A compliance review? Take stock in 2 minutes.
A few questions are enough to identify your need and the right legal answer, with no sign-up and no commitment.
Founded in 2013; Maître Cora Maglo has been admitted to the Luxembourg Bar since 2009
- 2013
- independent firm
- 2009
- at the Bar since 2009
- 4,7/5
- 81 Google reviewsRead reviews
Expertise & authority
Ongoing review and analysis of Luxembourg and European case law
Avocate à la Cour, List I of the Luxembourg Bar since 2009
Trained at the London School of Economics, formerly at Clifford Chance and Bonn Steichen & Partners
Member of international networks: EILN, AEA, Cross Border Advisory Solutions
Every matter handled and approved by a lawyer admitted to the Bar
Support in French and English
Testimonials
What our clients say
Selected excerpts from public reviews. Consult the Google listing for all ratings and comments; a testimonial does not guarantee a legal outcome.
Had a consultation with Me Cora Maglo about my Luxembourg Blue Card application. She explained everything clearly: the process, timeline and documents I need, and helped me with my wife’s family reunification too. Honest and practical advice. I felt confident after talking to her.F. P.J’ai beaucoup apprécié le service de Maître Maglo : son sérieux, sa sympathie, son professionnalisme et sa disponibilité. Toujours répondu rapidement et clairement, avec des conseils pragmatiques, sans pousser à des procédures longues et coûteuses lorsqu’elles ne sont pas justifiées.N. W.Super assistance and great support! Highly recommend. All my questions were answered, Cora and her team kept me updated all the time. I will definitely reach out to them next time for my residency.T.They talk about us
The firm referenced and cited
Professional directories, business press and legal publications where Cerno Law Firm and Maître Cora Maglo are referenced.
Let’s talk about your matter
Describe your situation: you receive an initial analysis and a transparent quote, with no obligation. One dedicated lawyer, from start to finish.
Why contact us?
- Response within 48 working hours
- Professional secrecy guaranteed
- Fees announced in advance
- A single dedicated lawyer
- Companies, investors and individuals
It only takes a few minutes to submit your matter.