Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
55 articles found · #rgpd · Veille Luxgap
NIS 2 Luxembourg: ILR releases incident guide via SERIMA
The ILR, with HCPN/ANSSI-GOVCERT.LU, CIRCL and CSSF, releases rulebooks to handle NIS 2 incidents and meet the 24h/72h/1-month milestones via SERIMA.
EDPB harmonizes GDPR fines: a unified EU methodology
On 21 September 2026, the EDPB adopted guidelines aligning how GDPR fines are decided and calculated. Luxembourg companies gain predictability—alongside stricter enforcement.
40 medical practices hit: cyberattack at an IT provider
On 22 August 2026, a cyberattack crippled the cloud infrastructure of BMS Engineering in Luxembourg. The company confirmed 40 practices affected, no confirmed leak, while one practice reported patient data loss.
CNIL fines a hospital: €500,000 and security requirements
The CNIL fines the Hôpital privé de la Loire €500,000 after a large-scale EHR breach. A reminder of security (MFA, access rights, detection) and data subject notification requirements, with direct implications in Luxembourg.
MAG: 8.7M customers exposed — third‑party risk hits airports
Manchester Airports Group confirms unauthorized access to parking, lounge, Fast Track and Wi‑Fi data, affecting around 8.7M customers. The case highlights third‑party risk and GDPR/NIS 2 notification duties.
MyDr: 19M health records exposed — third‑party risk hits Europe
Polish health software vendor MyDr suffered a breach disclosed August 12–13, 2026: nearly 19M people and over 12,000 facilities may be affected. Poland’s PM suggested extortion as the motive.
WEBA (BE) hit by Qilin: ransomware, customer data accessed, 48 h recovery
On August 10, 2026, Belgian retailer WEBA was hit by a ransomware attack. Customer data was accessed; operations resumed on August 12. Qilin claimed responsibility on August 16; WEBA says no ransom was paid.
French Education Ministry: data breach targeting millions of students
On 18 August 2026, France’s Education Ministry confirmed an intrusion and investigation into a breach claimed to target several million students and tens of thousands of teachers. Highly detailed databases are reportedly involved.
August 11, 2026: cold calling banned without consent
Since August 11, 2026, B2C cold calling in France is banned without prior explicit consent. Fines can reach €375,000 per breach for legal entities.
DGFiP: 600,000 tax records for sale — warning on stealth exfiltration
On 14 August 2026, France’s Finance Ministry confirmed a DGFiP breach with over 600,000 tax records exported. A stealth exfiltration via a spoofed VPN, fueling targeted fraud risks.
CEVA Logistics: data leak at supplier — Bol and De Bijenkorf customers warned
On August 6, 2026, Bol and De Bijenkorf warned customers that a possible data leak at CEVA Logistics may have exposed names, addresses and phone numbers. The Dutch DPA was notified on August 3; no payments or passwords are implicated so far.
AI Act: mandatory transparency from August 2 — act now
The AI Act’s transparency rules (Art. 50) have applied since August 2, 2026. Chatbots, deepfakes and AI-generated content must now be disclosed — including by deployers in Luxembourg.