Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
137 articles found · #luxembourg
DORA: TLPT RTS now in force — what the CSSF expects
Delegated Regulation (EU) 2025/1190 sets TLPT under DORA. In Luxembourg, the CSSF is the TLPT authority and aligns TIBER‑LU. Who gets designated, how testing works, and cadence: a practical brief.
AI Act: labelling of AI content, 50 days to comply
The Commission confirms the Code of Practice on AI content labelling. Systems placed on the market before 2 Aug 2026 must comply by 2 Dec 2026.
NIS 2: ILR frames directors’ accountability
ILR issues NIS 2 Guidelines for governing bodies: approval, oversight and training become verifiable and sanctionable.
DORA: CSSF tightens major ICT incident reporting
CSSF releases additional operational instructions for DORA major ICT incident reporting. Deadlines, content and data quality are tightened, aligning with the EU framework.
NIS 2 Luxembourg: ILR releases incident guide via SERIMA
The ILR, with HCPN/ANSSI-GOVCERT.LU, CIRCL and CSSF, releases rulebooks to handle NIS 2 incidents and meet the 24h/72h/1-month milestones via SERIMA.
EDPB harmonizes GDPR fines: a unified EU methodology
On 21 September 2026, the EDPB adopted guidelines aligning how GDPR fines are decided and calculated. Luxembourg companies gain predictability—alongside stricter enforcement.
CJEU 10/02/2026 — GDPR: EDPB binding decisions are challengeable
The CJEU held that an EDPB binding decision (Art. 65 GDPR) is a challengeable act directly concerning the company. The EDPB’s fine methodology can now be contested before EU courts.
40 medical practices hit: cyberattack at an IT provider
On 22 August 2026, a cyberattack crippled the cloud infrastructure of BMS Engineering in Luxembourg. The company confirmed 40 practices affected, no confirmed leak, while one practice reported patient data loss.
CNIL fines a hospital: €500,000 and security requirements
The CNIL fines the Hôpital privé de la Loire €500,000 after a large-scale EHR breach. A reminder of security (MFA, access rights, detection) and data subject notification requirements, with direct implications in Luxembourg.
MAG: 8.7M customers exposed — third‑party risk hits airports
Manchester Airports Group confirms unauthorized access to parking, lounge, Fast Track and Wi‑Fi data, affecting around 8.7M customers. The case highlights third‑party risk and GDPR/NIS 2 notification duties.
Legitimate interest vs consent: French Supreme Court, 17 June 2026
On 17 June 2026, the French Supreme Court (commercial chamber) required strict Article 14 GDPR information when relying on legitimate interest for data collected indirectly, including in litigation contexts.
MyDr: 19M health records exposed — third‑party risk hits Europe
Polish health software vendor MyDr suffered a breach disclosed August 12–13, 2026: nearly 19M people and over 12,000 facilities may be affected. Poland’s PM suggested extortion as the motive.