Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
69 articles found · #cnpd
GDPR Article 32: a small Italian fine, big obligations
On 29/04/2026, the Italian Garante imposed an €8,600 fine for security failures (Arts. 5 and 32 GDPR), including non‑compliant password storage. In Luxembourg, proving proportionality and state of the art remains decisive.
Workplace video surveillance: Garante fine and lessons for Luxembourg
Italy’s Garante fined a shop €2,000 for video surveillance without notice or labor authorization. In Luxembourg, L.261‑1, two‑layer notice and short retention are mandatory.
Amazon vs CNPD (12/03/2026): fine annulled, fine methodology reset
On 12 March 2026, Luxembourg’s Administrative Court annulled Amazon’s €746m fine while upholding core findings. Key takeaway: apply CJEU (Deutsche Wohnen/Nacionalinis) and robustly justify the GDPR fine methodology.
Art. 28 GDPR: Garante fines Velletri over sub-processing chain
On 12 Feb 2026, the Italian Garante fined Velletri Servizi for non‑compliant sub‑processing contracts under Art. 28(4) GDPR and insufficient oversight. Key takeaway: document and audit the entire sub‑processing chain.
Data transfers outside the EU: EDPB vs ICO — essential equivalence or risk test?
On 15 Jan 2026, the ICO introduced a simplified three‑step test and TRA, diverging from the EDPB/CNPD’s ‘essential equivalence’ plus supplementary measures approach. Bottom line: distinct compliance tracks for EU vs UK transfers.
GDPR Record: CNPD fines for insufficient ROPA, ICO promotes flexibility
On 16 December 2025, the CNPD fined an organisation for an “insufficient” record of processing (Art. 30 GDPR). By contrast, the ICO updated a more flexible approach in June 2026. This gap affects EU–UK groups.
Vehicle geolocation in Luxembourg: CNPD requirements 2024
On 10 April 2024, the CNPD updated its guidelines: no continuous tracking or outside working hours, DPIA often required, retention generally 2 months, and obligations under Labour Code L. 261‑1.
CNPD: recording private meetings — legitimate interest only under conditions
CNPD finds consent rarely valid in meetings and allows legitimate interest only after a strict necessity and balancing test. Recordings must be deleted as soon as minutes are approved.
UL: €98,000 for late notification — what Article 33 really requires
Ireland’s DPC fined the University of Limerick for three late GDPR notifications. Here is how to meet Article 33 and notify the CNPD within 72 hours, with documented timing and solid content.
Right of access to call recordings: the Vodafone (GR) case, 2026
On 11 February 2026, the Hellenic DPA fined Vodafone-Panafon for obstructing access rights and breaching GDPR Articles 12, 15 and 18. Key takeaway: deliver a usable copy of recordings within one month.
Cookies: EDPB orders Belgian DPA to decide the merits in the VRT case
On 14 July 2026, the EDPB ordered the Belgian DPA to rule on the merits of NOYB’s complaint against VRT’s cookie banner, rejecting the abuse-of-rights argument. A signal for CNPD oversight and consent practices in Luxembourg.
CNPD 2025 report: 846 complaints (+40%), key takeaways for Luxembourg
CNPD 2025 annual report: 846 complaints (+40% in one year), 425 breach notifications (49% human error), 59 investigations, 16 opinions. The shift to risk-based regulation, AI as a priority, and 5 concrete actions for DPOs and CISOs in Luxembourg.