How to comply with recital 30 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 30 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThis recital states a truth many financial entities overlook: a TLPT is never neutral from a personal data standpoint. A red team that exfiltrates production data, captures credentials or reaches HR systems mechanically processes personal data. The consultation of the European Data Protection Supervisor (EDPS) on 20 August 2024 confirms that the legislator built the DORA / GDPR duality into the very design of the test. In practice, the CSSF (TLPT authority under Article 46 of DORA) and the BCL, within the TIBER-LU framework, expect the scope document to account for this exposure. The classic mistake: launching a TLPT against critical functions in live production without a documented legal basis or impact assessment, exposing the entity to both a GDPR risk and an incomplete remediation.What this recital concretely imposes on your TLPTA recital is not binding, but it guides the interpretation of the RTS operational articles. Here is how to turn the legislator's intent into concrete safeguards:Document the legal basis for processing personal data during the test (legitimate interest under DORA Art. 26, or legal obligation) in the TIBER-LU scoping document.Run a data protection impact assessment (DPIA) when the red team reaches critical functions processing sensitive or large-scale data.Frame red team and threat intelligence providers contractually through Article 28 GDPR agreements, consistent with outsourcing RTS 2025/532 and CSSF circulars 22/806 and 25/882 (ICT providers included in the test scope).Minimise and pseudonymise data captured during the exercise, and set a short retention period for test artefacts.Feed findings into ICT risk management (CSSF circular 20/750), ensuring remediation does not recreate a GDPR risk.How Luxgap automates this riskOur Luxgap TLPT Privacy Guardrail makes it impossible to launch a threat-led test without the GDPR layer being traced and enforceable. The tool connects to your TIBER-LU scoping document, your records of processing and your asset inventories (Azure Sentinel, Microsoft Defender, CrowdStrike, Active Directory) to automatically map the personal data exposed by each critical function included in the test scope.Detects, for each critical function in scope, the systems processing personal data and raises an alert when a DPIA is required under GDPR.Generates a documented legal basis and a TLPT-specific record of processing, aligned with DORA Art. 26-27 and the TIBER-LU methodology revised on 20 June 2025.Produces Article 28 agreement templates for the red team, threat intelligence and white team, consistent with RTS 2025/532 and CSSF circulars 22/806 and 25/882.Tracks retention and pseudonymisation of captured artefacts, and alerts on any breach in real time.Verifies that each remediation action (CSSF circular 20/750) does not recreate GDPR exposure, and cross-checks the follow-up with your ICT risk management.Produces a time-stamped PDF report, enforceable before the CSSF and BCL, demons...

Recital 30

They trust us

Before we chat