Luxembourg

A controller must notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Luxembourg, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Act of 1 August 2018 derogation from this timeline is identified.

Luxembourg's private-sector regime is the General Data Protection Regulation (GDPR) plus the Act of 1 August 2018 on the organisation of the National Data Protection Commission (CNPD) and the general data protection framework, in effect from 20 August 2018, which repealed the prior 2 August 2002 data protection law. The Act supplies domestic derogations and procedural rules and establishes the CNPD's own organisation.

Its chapter on special categories of personal data prohibits processing genetic data for the controller's rights in labour law and insurance (Article 66); see the sensitive-categories instrument below.

An employer may process personal data to monitor employees in the employment relationship only in the cases of General Data Protection Regulation (GDPR) Article 6(1)(a) to (f) and in accordance with the article.

The employer must first inform the joint committee or, failing it, the staff delegation or, failing that, the Labour and Mines Inspectorate, and for statutory staff the staff representation bodies, with a detailed description of the purpose, how the system works, any retention period or criteria and a formal commitment not to use the data for another purpose.

Where the monitoring serves safety and health needs, production or performance control that is the only means to determine exact pay, or flexible working hours, Articles L.211-8, L.414-9 and L.423-1 apply unless a legal obligation requires the processing.

The staff delegation or, failing it, the employees concerned may within fifteen days of the prior information ask the Commission nationale pour la protection des données for an opinion on the project, which suspends the project during the month the Commission has to reply. Employees may complain to the Commission, and a complaint is neither a serious nor a legitimate ground for dismissal.

Transferring personal data of a person in Luxembourg outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. The Act of 1 August 2018 exempts processing carried out for the sole purpose of journalism or academic, artistic or literary expression from Chapter V of the General Data Protection Regulation (GDPR) (Article 62).

General Data Protection Regulation (GDPR) Article 22 gives a person in Luxembourg the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Loi du 1er aout 2018 adds no rule of its own on automated decisions.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Luxembourg can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

The Loi du 1er aout 2018 narrows these rights for research: a controller processing for scientific or historical research or for statistics may depart from the rights of access, rectification, restriction and objection to the extent they would make that purpose impossible or seriously impair it, provided it takes the additional safeguards Article 65 lists.

Under Article 48(1) of the Act the CNPD imposes administrative fines as set out in General Data Protection Regulation (GDPR) Article 83, save against the State and municipalities. A CNPD decision taken under the Act can be appealed to the Administrative Tribunal, which rules on the merits (Article 55).

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. The Act of 1 August 2018 has a chapter headed "Processing of special categories of personal data" that consists of one article, which prohibits processing genetic data for the controller's rights in labour law and insurance (Article 66). A voiceprint or faceprint captured for identification purposes is therefore governed in Luxembourg by GDPR Article 9 alone.

Processing of health data other than genetic data is lawful, under General Data Protection Regulation (GDPR) Article 9(2)(g), when necessary for pre-contractual measures in insurance or reinsurance or for performing an insurance or reinsurance contract, subject to professional secrecy and to appropriate measures.

The measures are a data protection officer, impact assessments, anonymization or pseudonymization or functional separation, encryption in transit with state-of-the-art key management, access restrictions, logging of the reason, date, time and person for each access, staff awareness, regular independent audit, sectoral codes of conduct and an internal policy on the principles of GDPR Article 5.

Each controller and processor must document and justify internally any exclusion of the data protection officer, impact assessment, anonymization, audit or code of conduct measures and keep the documentation available to the Commission nationale pour la protection des données. In no case may a controller or processor derogate from the measures in letters d), e), f), g) and j).

Article 509-1 punishes fraudulently accessing or remaining in all or part of an automated or non-automated data-processing or transmission system with two months to two years of imprisonment and a fine of 500 to 25,000 euros, rising to four months to two years and 1,250 to 25,000 euros where data is suppressed or modified or the system's functioning is altered.

A second paragraph, added by the Loi du 29 juillet 2023, punishes with the same penalties a person who holds authorisation to access a system processing personal data but processes that data for purposes other than those for which the access was granted. Because the offence's trigger is fraudulent access, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Article 509-2 punishes intentionally interfering with or falsifying the functioning of an automated or non-automated data-processing or transmission system, and article 509-3 punishes intentionally introducing, suppressing or altering its data, each with three months to three years of imprisonment and 1,250 to 12,500 euros.

Article 509-3 also punishes, with the same penalties, intentionally intercepting data during non-public transmissions to, from or within such a system, a paragraph the Loi du 18 juillet 2014 added.

Article 509-4 raises the penalty to four months to five years and 1,250 to 30,000 euros where any of these offences causes a transfer of money or monetary value for economic gain, and a 28 February 2024 amendment added the same penalty for committing any of the article 509-1 to 509-3 offences against an information system of a critical infrastructure, or causing serious harm to such a system by committing them; article 509-5 punishes producing, selling, holding or distributing a device or electronic key intended to commit these offences at the same level.

Attempt and participation in an association formed to commit these offences are punished the same as the completed offence, under articles 509-6 and 509-7. Article V of the Loi du 15 juillet 1993 inserted into the Code penal a section on certain computer offenses, Articles 509-1 to 509-7. That Law took effect on 21 August 1993.

Article 10, point 16, added by the Loi du 1er avril 2022 transposing the Digital Single Market Directive, permits reproductions and extractions of lawfully accessible works for text and data mining without the rightholder's authorization, unless the rightholder has expressly and appropriately reserved that use, including by machine-readable means for content made available online.

Article 10, point 15 gives research organizations and publicly accessible libraries, museums, archives and film or sound heritage institutions the same permission for scientific research text and data mining, without being subject to that reservation. The statute defines text and data mining as any automated analytical technique to analyze text and data in digital form in order to generate information such as patterns, trends and correlations.

A database producer may forbid extraction or reuse of the whole, or a qualitatively or quantitatively substantial part, of the database's contents, and may also forbid the repeated and systematic extraction or reuse of insubstantial parts where that conflicts with normal exploitation of the database or unreasonably prejudices the producer's legitimate interests.

Extraction is defined as the permanent or temporary transfer of all or a substantial part of the contents to another medium by any means, and reuse as any form of making the contents available to the public, excluding public lending in both cases. The right is part of the original Loi du 18 avril 2001, which transposed the EU Database Directive.

The Loi du 1er avril 2022, which transposed the Digital Single Market Directive, added to article 68 new paragraphs 2 to 4, the first of which applies the exceptions of article 10, points 15 and 16, among others, to the rights of a database producer.

The Commission de surveillance du secteur financier (CSSF) and the Commissariat aux assurances (CAA) are the competent authorities in Luxembourg under Article 46 of the DORA Regulation (Regulation (EU) 2022/2554), each for the persons it supervises (Article 20-22).

CRR institutions must have adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, which they establish, manage and test in accordance with Article 11 of the DORA Regulation (Article 5, inserting Article 53-21(2)).

For a breach of the DORA Regulation provisions the law lists, the CSSF and the CAA may order the person to stop and not repeat the conduct, order the cessation of a practice, fine a legal person up to 5,000,000 euro or up to 10 percent of its annual turnover, fine a natural person up to 5,000,000 euro, and make a public statement (Article 20-24).

They may fine from 250 to 250,000 euro a person who obstructs their supervisory powers, ignores their orders or knowingly gives them inaccurate or incomplete information (Article 20-24(3)). Their decisions may be challenged within one month before the administrative tribunal, which rules on the merits (Article 20-25). The law entered into force on 17 January 2025 (Article 26).

Article 12 requires an entité essentielle (essential entity) or entité importante (important entity) to take technical, operational and organisational measures appropriate and proportionate to the risks threatening the security of the network and information systems it uses for its activities or services, and to eliminate or reduce the impact of incidents on the recipients of its services and on other services.

The measures must follow an all-hazards approach and cover at least ten categories: risk-analysis and information-system-security policy, incident handling, business continuity including backup and crisis management, supply-chain security, security in the acquisition, development and maintenance of systems including vulnerability handling and disclosure, evaluating the measures' own effectiveness, basic cyber-hygiene and training, cryptography and encryption policy, human-resources security, access control and asset management, and multi-factor or continuous authentication and secure communications, transposing NIS2 Article 21.

Annexe II point 6 names an online-marketplace provider, an online-search-engine provider and a social-networking-services-platform provider among the digital providers this duty reaches expressly. Annexe I point 10 separately reaches public-administration entities, as defined by Article 2. Article 13 requires the entity's management body to approve these measures and oversee their implementation, and states that the body may be held liable for the entity's violation of Article 12.

Article 1(8) disapplies the relevant provisions of this Law, including supervision and enforcement under Chapter 6, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify significant incidents with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

ILNAS is designated as the national cybersecurity certification authority responsible for the supervision tasks under Article 58 of the Cybersecurity Act (Regulation (EU) 2019/881) and for certification tasks for European cybersecurity certificates at the high assurance level (Article 1).

Holders of European cybersecurity certificates, issuers of EU declarations of conformity and conformity assessment bodies must inform the authority in writing within 72 hours of learning of a vulnerability or irregularity that may affect compliance with the security requirements of the certification of a product, service or process (Article 5(2)).

They must give the authority access to any document, person, equipment, premises, installation, site and means of transport it needs for its tasks (Article 5(1)). An accredited conformity assessment body must inform the authority of its accreditation, and of the certificates it issues, within 72 hours (Article 6). The law entered into force on 31 December 2024.

Article 14 requires an entité essentielle or entité importante to notify the competent authority, without undue delay, of any incident with a significant impact on the provision of its services (an incident important), and, where appropriate, to notify the recipients of its services of a significant incident likely to affect the supply of those services.

An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss to the entity, or has affected or is capable of affecting other natural or legal persons through considerable material, physical or moral damage.

The notification runs on a graduated clock: an early warning within 24 hours of becoming aware of the incident, a fuller notification within 72 hours giving an initial assessment of its severity and impact and any indicators of compromise, an intermediate report on request, and a final report within one month of the 72-hour notification (or a progress report followed by a final report if the incident is still ongoing at that point), transposing NIS2 Article 23.

A trust-service provider, by derogation from the 72-hour notification, notifies a significant incident affecting its trust services within 24 hours of becoming aware of it. The mere act of notifying an incident does not itself increase the notifying entity's liability, and the competent authority forwards the notification to the relevant computer security incident response team (CSIRT) and the single point of contact upon receiving it.

Article 1(8) disapplies the relevant provisions of this Law, including supervision and enforcement under Chapter 6, to an essential or important entity that a sector-specific Union legal act requires to adopt cybersecurity risk-management measures or to notify significant incidents with at least equivalent effect.

Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

Article 11, paragraph 1 of the Act of 30 May 2005 allows the use of automated calling and communication systems without human intervention, fax machines or electronic mail for direct marketing only where it targets a subscriber or user who has given prior consent.

Under paragraph 2, a provider that obtained its customers' electronic contact details in the course of a sale of a product or service may use them for direct marketing of its own similar products or services, provided that the customers are clearly and expressly given the right to object, free of charge and in a simple manner, when the details are collected and in each message, unless they refused such use from the outset.

Paragraph 4 prohibits sending electronic messages for direct marketing that disguise, conceal or misrepresent the identity of the sender on whose behalf the communication is made, or that give no valid address to which the recipient can send a request to stop such communications. Paragraph 5 applies paragraphs 1 and 3 to a subscriber who is a natural person.

Article 4, paragraph 3, point (e) of the Act of 30 May 2005 provides that the prohibition on interception in paragraph 2 does not apply to storing information in, or obtaining access to information already stored in, the terminal equipment of a subscriber or user, on condition that the subscriber or user has given consent after receiving clear and complete information, among other things on the purposes of the processing.

Where technically possible and effective, the consent may be expressed through the appropriate settings of a browser or another application. The provision does not prevent technical storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network, or that is strictly necessary for the provider to supply an information society service expressly requested by the subscriber or user. The Act of 28 July 2011 replaced point (e) with the consent wording. That Act entered into force on 1 September 2011.

Article 4, paragraph 1 of the Act of 30 May 2005 requires every service provider or operator to guarantee the confidentiality of communications made over a public communications network and publicly available electronic communications services, and of the related traffic data.

Paragraph 2 prohibits any person other than the user concerned from listening to, intercepting or storing the communications and the related traffic data, or subjecting them to any other means of interception or surveillance, without the consent of the user concerned. Paragraph 2 does not prevent the technical storage necessary for the routing of a communication.

Paragraph 2 does not affect the recording of communications and the related traffic data when it is carried out in lawful professional practice to provide proof of a commercial transaction or of any other commercial communication. The parties to the transactions or other commercial communications must be informed beforehand that recordings may be made, of the reason or reasons for recording, and of the maximum retention period of the recordings.

Recorded communications must be deleted as soon as the purpose is achieved and in any event when the legal period for challenging the transaction expires.

Article 11, paragraph 1 of the Act of 30 May 2005 allows the use of automated calling systems without human intervention for direct marketing only where it targets a subscriber or user who has given prior consent. Paragraph 3 allows the sending of unsolicited communications for direct marketing by means other than those in paragraphs 1 and 2 only if the subscriber or user concerned has given prior consent. Paragraph 5 applies paragraphs 1 and 3 to a subscriber who is a natural person.

Article 70 bis(2) treats a provider of online content-sharing services that gives the public access to protected works uploaded by its users as communicating those works to the public, and requires it to obtain authorization from the rights holders.

Article 70 bis(5) makes the provider liable for unauthorized communication to the public unless it shows its best efforts to obtain authorization, to ensure the unavailability of specific works for which rights holders supplied information, and to act promptly on a sufficiently substantiated notice.

Article 70 bis(7) limits those conditions for a new provider whose services have been available to the public in the Union for less than three years and whose annual turnover is below a stated threshold. Article 70 bis(9) states that the article creates no general obligation to monitor, and requires the provider to give rights holders adequate information on its cooperation on request.

Article 70 bis(10) requires the provider to put in place an effective and expeditious complaint and redress mechanism for users whose uploads are blocked or removed, with human review of the decisions. Article 41, point i) defines the online content-sharing service provider and excludes services such as non-profit online encyclopedias, open source software platforms, online marketplaces and business-to-business cloud services. The article was inserted by the Loi du 1er avril 2022 and took effect on 9 April 2022.

Article 1 makes the minister responsible for the Grand-Ducal Police competent to issue the removal or blocking order provided for in Article 3(1) and (4) of Regulation (EU) 2021/784. Article 3 makes the Haut-Commissariat à la protection nationale (HCPN) competent to decide under Article 5(4)(a) of the Regulation that a hosting service provider is exposed to terrorist content.

Article 5 requires every communication between a hosting service provider and the competent authorities to be made by electronic means in French, German or English, and gives the provider three working days to confirm receipt of any communication from them.

Article 6(1) punishes a hosting service provider that fails to remove terrorist content or block access to it within one hour of receiving an order, or fails to inform the competent authorities immediately of content presenting an imminent threat to life, with imprisonment of one to five years and a fine of EUR 25,000 to 350,000, or either penalty alone.

Article 6(2) lets the rate of that fine rise to 4 percent of the provider's worldwide turnover for the preceding year where the failure to meet the one-hour obligation is systematic or persistent. Article 7(1) lets the minister impose an administrative fine of EUR 5,000 to 350,000 on a provider that, after a formal notice, still fails to meet the obligations in Article 3(6), Article 4(7) and Articles 11, 15 and 17 of the Regulation.

Article 7(2) lets the HCPN impose an administrative fine of EUR 5,000 to 350,000 on a provider that, after a formal notice, still fails to meet the obligations in Article 5(1), (2), (3) and (5) and Articles 6, 7 and 10 of the Regulation, or a decision under Article 5(6). The Act took effect on 29 July 2024.

Article 2(1) designates the Autorité de concurrence (Competition Authority) as the competent authority and the digital services coordinator for the purposes of Regulation (EU) 2022/2065. Article 6(1) lets the Authority require a provider of intermediary services, and any other person acting for the purposes of a trade, business, craft or profession who is reasonably likely to know of relevant information, to provide information without delay.

Article 7(1) requires the Authority to apply to the investigating judge of the Luxembourg district court for authorization before it carries out an inspection. Article 14(1) lets the Authority order the management body of a provider of intermediary services to examine the situation, adopt and submit an action plan, ensure the measures are taken and report on them.

Article 15(2) sets the maximum fine at 6 percent of worldwide turnover in the last closed financial year for a breach of the listed provisions of Regulation (EU) 2022/2065. Article 15(3) sets the maximum fine at 1 percent of worldwide turnover where a provider or other person gives incorrect, incomplete or misleading information, fails to answer an information decision, fails to rectify information or refuses an inspection.

Article 16(1) lets the Authority impose daily penalty payments of up to 5 percent of average daily worldwide turnover to compel a provider to supply information, submit to an inspection, appear, or respect a cessation order or interim measures. Article 30 repeals title VI of the amended Act of 14 August 2000 on electronic commerce. The Act took effect on 11 April 2025.

The Loi du 21 avril 1989 relative à la responsabilité civile du fait des produits défectueux transposes Directive 85/374/EEC, according to the Legilux record of the Act. Article 1 makes the producer liable for the damage caused by a defect in its product. Article 2, point 1 defines a product as any movable good, even one incorporated into another movable or into an immovable, and the term also covers electricity.

Article 2, point 2 treats as producer the manufacturer of a finished product, the producer of a raw material, the manufacturer of a component and anyone who presents itself as producer by putting its name, trade mark or another distinguishing mark on the product. Article 2, point 2 also treats as producer a person who imports a product into the European Economic Community for sale, hire, leasing or another form of distribution in the course of its business.

Article 2, point 2 treats each supplier as the producer where the producer cannot be identified, unless the supplier names the producer or its own supplier to the victim within a reasonable time. Article 2, point 2 applies the same rule to a product imported from a State outside the Community that does not name its importer, even if the producer is named.

Article 2, point 3 defines a defect as the failure of a product to offer the safety that one can legitimately expect, taking all circumstances into account. Article 2, point 4 excludes damage to the defective product itself from the damage the Act covers. In the text published in Mémorial A n° 25 of 1989, Article 2, point 4 repairs damage to things only after deduction of an amount of 500 Ecus, converted into Luxembourg francs at the rate on the day the damage occurred.

The Law of 6 July 2020 on civil liability for nuclear accident damage replaced Article 2, point 4, letter a, so that the exclusion of nuclear accident damage refers to that Law. Article 3 puts on the victim the burden of proving the damage, the defect and the causal link between them. Article 4(a) frees the producer who proves that it had not put the product into circulation.

Article 4(b) frees the producer who proves that the defect did not yet exist when it put the product into circulation or arose afterwards. Article 4(c) frees the producer who proves that the product was neither made for sale or another form of distribution with an economic purpose nor made or distributed in the course of its professional activity. Article 4(d) frees the producer who proves that the defect is due to the product complying with mandatory rules issued by the public authorities.

Article 4(e) frees the manufacturer of a component who proves that the defect is attributable to the design of the product into which the component was incorporated or to the instructions of the manufacturer of that product. Article 5 limits the producer to liability for the extent to which the defect contributed to the damage where the fault of the victim, or of a person for whom the victim is responsible, also caused it.

Article 5 does not let the producer escape liability by proving that the damage was caused jointly by a defect and by the intervention of a third party. Article 5 bars limiting or excluding the producer's liability toward the victim by a limiting or exonerating clause. Article 6 makes several persons liable for the same damage jointly and severally.

Article 7 sets a limitation period of three years from the day the victim knew or should have known of the damage, the defect and the identity of the producer. Article 7 also extinguishes the victim's right to compensation ten years after the producer put the defective product into circulation, unless the victim started court proceedings against the producer within that period.

Article 8 leaves untouched the victim's rights under the general law of contractual or non-contractual liability or under another special liability regime. Article 10 excludes products put into circulation before the Act entered into force. The Act entered into force on 2 May 1989.

A provider of audiovisual media services must ensure that programs likely to harm minors' physical, mental or moral development are made available only under conditions that normally prevent minors from seeing or hearing them. A grand-ducal regulation sets the specific measures, which may include age-verification tools.

A provider of a video-sharing platform within Luxembourg's jurisdiction must take proportionate measures to protect minors from harmful programs, user-generated videos and audiovisual commercial communications. Those measures include systems to verify the age of users for content likely to cause such harm. Minors' personal data collected under either duty may not be processed for commercial purposes such as profiling or targeted advertising.

Article 56 bis gives press publishers the reproduction and making-available rights of articles 43 and 44 for the online use of their press publications by information-society service providers. The right does not reach private or non-commercial use by individual users, acts of hyperlinking, or the use of isolated words or very short extracts of a press publication.

It expires two years after publication, counted from the January 1 following the date of first publication, and does not apply to a press publication first published before 6 June 2019.

Authors of works integrated in a press publication are entitled to an appropriate share of the revenue the publisher receives from information-society service providers, and article 56 ter makes any transfer or licence of an author's rights to a publisher a sufficient legal basis for the publisher to claim a share of statutory-exception compensation for uses of the work.

Article 10, point 16 permits reproductions and extractions of lawfully accessible works, including news articles, for text and data mining without the rightholder's authorization, unless the rightholder has expressly reserved that use by an appropriate means, including a machine-readable reservation for content made available online.

Article 10, point 15 gives research organizations and public libraries, museums, archives and film or sound heritage institutions the same permission for scientific-research text and data mining, without being subject to that reservation. Point 16 is not mandatory, and it does not affect the application of point 15.