Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
Ahold Delhaize cyber incident — NIS 2 wake-up call in LU
A cyber incident forced Ahold Delhaize to take systems offline (Oct 12–21, 2026). In Luxembourg, it underscores the urgency of NIS 2 reporting readiness and business continuity.
PHP2Shell: our sites patched in under 3 hours
The PHP2Shell flaw (CVE-2026-109618 and CVE-2026-109619) can let a single web request take over a PHP server. What the authorities advised, and how we closed, patched and reopened our sites in under 3 hours of hands-on work.
CJEU 21/04/2026: criminal records and GDPR Article 10
The CJEU strikes down a Hungarian law on criminal-record access: without “appropriate safeguards”, GDPR Article 10 is breached. Key takeaway for Luxembourg: third‑party access is tightly constrained and under public control.
Phishing campaigns: what NIS 2 and DORA require
No law requires phishing simulations, but in Luxembourg NIS 2 and DORA require staff training, and proof of it. What the texts say, the 2026 threat landscape and how to run a phishing campaign lawfully.
Fridge cyberattack: huge losses, NIS 2 impact in LU
Attackers hijacked supermarket refrigeration (Oct 11–12, 2026), causing “tens of millions of euros” in losses and IT shutdowns. The case highlights NIS 2 requirements for the cold chain in Luxembourg.
DORA: TLPT RTS now in force — what the CSSF expects
Delegated Regulation (EU) 2025/1190 sets TLPT under DORA. In Luxembourg, the CSSF is the TLPT authority and aligns TIBER‑LU. Who gets designated, how testing works, and cadence: a practical brief.
AI Act: labelling of AI content, 50 days to comply
The Commission confirms the Code of Practice on AI content labelling. Systems placed on the market before 2 Aug 2026 must comply by 2 Dec 2026.
NIS 2: ILR frames directors’ accountability
ILR issues NIS 2 Guidelines for governing bodies: approval, oversight and training become verifiable and sanctionable.
DORA: CSSF tightens major ICT incident reporting
CSSF releases additional operational instructions for DORA major ICT incident reporting. Deadlines, content and data quality are tightened, aligning with the EU framework.
Mandatory DPIA: CNPD vs CNIL on HR (GDPR Art. 35)
The CNPD and CNIL apply the same GDPR yet diverge on HR surveillance and analytics: a narrower scope in Luxembourg, broader in France. Result: a DPIA may be mandatory in FR and conditional in LU.
NIS 2 Luxembourg: ILR releases incident guide via SERIMA
The ILR, with HCPN/ANSSI-GOVCERT.LU, CIRCL and CSSF, releases rulebooks to handle NIS 2 incidents and meet the 24h/72h/1-month milestones via SERIMA.
GDPR: CNIL fines EXTIA €300k for erasure failures
CNIL fines EXTIA €300,000 for breaches of GDPR Articles 12 and 17 on the right to erasure and one‑month response obligations.