LuxembourgGDPR Articles 82-83 and CNPD Enforcement in Luxembourg
Regulation (EU) 2016/679, Arts. 82-83
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Expect the CNPD to have jurisdiction and administrative fining power over your processing of personal data of a person in Luxembourg, up to the General Data Protection Regulation (GDPR) Article 83 tiers.
- Expect any person who suffered material or non-material damage from an infringement to bring a direct compensation claim against you as controller or processor in the ordinary Luxembourg civil courts, under GDPR Article 82.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 51 of the Act of 1 August 2018 criminalizes wilfully preventing or impeding, in any way, the execution of the CNPD's tasks (obstruction), punishable by imprisonment of eight days to one year and a fine of EUR 251 to 125,000, or one of these punishments alone. This is an obstruction offense protecting the CNPD's own investigative and enforcement work, not a general criminal offense for unlawful processing of personal data as such.
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements including the Article 9 special category rules, the Article 12 to 22 data subject rights, and the Chapter V transfer rules. The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25 to 39 controller and processor obligations. Article 48(1) of the Act of 1 August 2018 grants the CNPD this fining power but exempts the State and municipalities from it entirely, a national carve-out distinct from Ireland's lower public-sector cap.
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Commission Nationale pour la Protection des Donnees (CNPD), Luxembourg's independent supervisory authority under the GDPR.
Enforcement record
Counts the CNPD's own published decisions (deliberations) for calendar year 2025 (7), per the year filter on the CNPD's own decisions register: deliberations 1FR/2025 through 7FR/2025. Six of the seven (1FR, 3FR, 4FR, 5FR, 6FR, 7FR) impose a fine (amende); one (2FR/2025, video surveillance) imposes corrective measures without a fine. A secondary tracker (digitemis.com) reports the six 2025 fines ranged from EUR 1,277 to EUR 175,000, not independently confirmed against the CNPD's own register, which lists decisions without stating each fine amount on the listing page itself, so fines_per_year, median_fine, p90_fine and total_fines are not recorded here.
- As of
- 2 September 2026
- Source link
- https://cnpd.public.lu/fr/decisions-sanctions.html
- Actions per year
- 7
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The CNPD is the supervisory authority for administrative enforcement (General Data Protection Regulation (GDPR) Article 83 fines), while a GDPR Article 82 compensation claim is brought before the ordinary civil courts (tribunal d'arrondissement) rather than the CNPD itself, per secondary commentary read. No Luxembourg-specific fine ceiling beyond the GDPR Article 83 maximum was identified.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisionsprocesses_biometricsprocesses_voice
Read the law
Secondary commentary (CMS) on the CNPD's administrative role and civil-court compensation route
not independently confirmed against the Act's own text for the compensation-forum detail
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.