LuxembourgGDPR Articles 82-83 and CNPD Enforcement in Luxembourg
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 51 of the Act of criminalizes wilfully preventing or impeding, in any way, the execution of the CNPD's tasks (obstruction), punishable by imprisonment of eight days to one year and a fine of EUR 251 to 125,000, or one of these punishments alone. This is an obstruction offense protecting the CNPD's own investigative and enforcement work, not a general criminal offense for unlawful processing of personal data as such.
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements including the Article 9 special category rules, the Article 12 to 22 data subject rights, and the Chapter V transfer rules. The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25 to 39 controller and processor obligations. Article 48(1) of the Act of grants the CNPD this fining power but exempts the State and municipalities from it entirely, a national carve-out distinct from Ireland's lower public-sector cap.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Commission Nationale pour la Protection des Donnees (CNPD), Luxembourg's independent supervisory authority under the GDPR.
Enforcement record
Counts the CNPD's own published decisions (deliberations) for calendar year 2025 (7), per the year filter on the CNPD's own decisions register: deliberations 1FR/2025 through 7FR/2025. Six of the seven (1FR, 3FR, 4FR, 5FR, 6FR, 7FR) impose a fine (amende); one (2FR/2025, video surveillance) imposes corrective measures without a fine. The register's listing page does not state the amount of each fine.
- As of
- Source link
- https://cnpd.public.lu/fr/decisions-sanctions.html
- Actions per year
- 7
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Luxembourg rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation, and Article 83 sets the administrative fines. Neither states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation. Articles 48 to 55 of the Act of set fines, periodic penalties and appeals and name no record.
- Kind
- None
- As of
What this law does
Under Article 48(1) of the Act the CNPD imposes administrative fines as set out in General Data Protection Regulation (GDPR) Article 83, save against the State and municipalities. A CNPD decision taken under the Act can be appealed to the Administrative Tribunal, which rules on the merits (Article 55).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .