I need to bring my Luxembourg organisation into compliance with recital 106 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 106 DORA — Recital 106 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 106

Digital Operational Resilience Act · UE 2022/2554

(106)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (29) and delivered an opinion on 10 May 2021 (30),

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the CSSF and the CNPD have signed an information exchange protocol allowing cross-transmission of incident notifications between the two authorities. Concretely, a major ICT incident notification to the CSSF can be relayed to the CNPD if it reveals a personal data breach, and vice versa. The law of 1 August 2018 organising the National Data Protection Commission and the law of 23 December 2016 on the financial sector frame this inter-authority cooperation.

Luxgap practice: we recommend Luxembourg financial entities prepare a unified notification anticipating questions from both authorities, and designate a single point of contact (often a pooled DPO-CISO) to avoid discourse divergences between CSSF and CNPD.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital recalls that DORA was submitted to prior consultation by the EDPS (European Data Protection Supervisor) under Regulation 2018/1725. In practice, this means that DORA obligations, particularly major ICT incident notification, cyber threat intelligence sharing (Article 45) and TLPT penetration testing, must articulate with GDPR. Luxembourg financial entities supervised by the CSSF that neglect this articulation expose themselves to dual CSSF and CNPD sanctions, because a data leak or sharing during an ICT incident systematically triggers GDPR Articles 33 and 34.

The DORA-GDPR articulation points not to miss

Major ICT incident notification to CSSF (DORA Article 19) versus breach notification to CNPD within 72h (GDPR Article 33): two deadlines, two recipients, two forms.
Cyber threat intelligence sharing between financial entities (DORA Article 45): the GDPR legal basis must be documented, generally legitimate interest Article 6(1)(f) with a formalised balancing test.
TLPT penetration testing (DORA Articles 26-27): red teams often handle real personal data, requiring a prior DPIA and strict GDPR Article 28 contractual framing.
ICT third-party provider register (DORA Article 28): must be consistent with the GDPR Article 30 record of processing activities, without duplication or contradiction.
Retention of ICT incident logs and journals: the DORA duration (often 5 years for CSSF) must be justified against the GDPR minimisation principle.

How Luxgap automates this risk

Our Luxgap DORA-GDPR Bridge eliminates the dual CSSF and CNPD sanction risk by orchestrating in real time the crossed obligations of both regulations. As soon as an ICT incident is detected in your SIEM (Microsoft Sentinel, Splunk, Wazuh, CrowdStrike Falcon), the tool triggers both notification workflows in parallel with the right deadlines, the right recipients and the right forms, without manual intervention from the CISO or DPO.

Automatically detects each qualifying ICT incident via native connectors for Sentinel, Defender XDR, CrowdStrike and Wazuh, and evaluates in under 60 seconds whether it crosses DORA Article 18 thresholds and GDPR Article 33 breach criteria.
Simultaneously generates the CSSF major ICT incident notification form and the CNPD breach notification form, pre-filled with the same factual elements but adapted to each authority's vocabulary.
Synchronises the DORA Article 28 ICT third-party register with the GDPR Article 30 record of processing to avoid inconsistencies detected during cross CSSF-CNPD audits.
Produces for each TLPT test a prior DPIA and a GDPR framing dossier, including the red team legal basis, pseudonymisation measures and artefact retention duration.
Generates a cryptographically sealed timestamped PDF report, admissible during a CSSF or CNPD audit, demonstrating the DORA-GDPR articulation over a rolling 12-month period.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams prepare a demonstration on your real incidents from the last 12 months, with a free white audit within 48h to measure your dual-sanction exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 106

They trust us

Before we chat