Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
49 articles found · #luxembourg · Expertise Luxgap
DORA: TLPT RTS now in force — what the CSSF expects
Delegated Regulation (EU) 2025/1190 sets TLPT under DORA. In Luxembourg, the CSSF is the TLPT authority and aligns TIBER‑LU. Who gets designated, how testing works, and cadence: a practical brief.
NIS 2: ILR frames directors’ accountability
ILR issues NIS 2 Guidelines for governing bodies: approval, oversight and training become verifiable and sanctionable.
CJEU 10/02/2026 — GDPR: EDPB binding decisions are challengeable
The CJEU held that an EDPB binding decision (Art. 65 GDPR) is a challengeable act directly concerning the company. The EDPB’s fine methodology can now be contested before EU courts.
Legitimate interest vs consent: French Supreme Court, 17 June 2026
On 17 June 2026, the French Supreme Court (commercial chamber) required strict Article 14 GDPR information when relying on legitimate interest for data collected indirectly, including in litigation contexts.
Recording calls: the SWDE case and what the CNPD expects in Luxembourg
Belgium’s DPA fined SWDE €86,000 for non-compliant call recordings. In Luxembourg, the CNPD strictly frames recordings: point-of-contact notice, clear legal basis, short retention, and Article 28 DPAs.
CNIL fines IQVIA €5M: health data warehouses under high scrutiny
On May 26, 2026, the CNIL fined IQVIA €5M for breaching authorizations and Articles 14 and 25 GDPR across two health data warehouses. Clear message: effective notice, operational opt-out, and privacy by design are non-negotiable.
NIS 2: EU adopts the supply chain Toolbox — what ILR will check
On 13/02/2026, the EU adopted the EU ICT Supply Chain Security Toolbox. Under NIS 2 and Implementing Regulation 2024/2690, supplier management becomes prescriptive and must be evidenced in Luxembourg before the ILR.
NIS 2 in Luxembourg: scope, categories and self‑registration
Luxembourg’s law of 5 May 2026 transposing NIS 2 has been in force since 10 May 2026. The ILR clarifies scope, the “essential/important entity” categorization, and self‑registration.
CJEU C‑312/24 — Erasure vs legal obligation: a relative right
The CJEU clarifies that erasure (Art. 17 GDPR) yields when a clear, foreseeable and proportionate legal obligation justifies retention, including for criminal data in HR files. Once no longer necessary, erasure becomes mandatory again.
NIS 2: common 24h/72h/1‑month templates — what ILR expects
On 26 May 2026, the EU adopted common incident reporting templates (24h/72h/1 month). In Luxembourg, ILR confirms this sequencing and sets out the expected content for entities.
CJEU C‑414/24 (18 June 2026): parallel GDPR remedies are not exclusive
The CJEU confirms that GDPR complaints to the authority (Art. 77) and judicial actions (Art. 79) are parallel and not mutually exclusive. An authority may not dismiss a complaint solely because a court action is pending.
DORA Art. 28: Register of Information — CSSF expectations for 2026
The CSSF opened eDesk and set a DORA Register of Information submission window from 11 February to 31 March 2026. Content is standardized by ITS (EU) 2024/2956 and subject to strict validation rules.