I need to bring my Luxembourg organisation into compliance with recital 108 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 108 NIS 2 — Recital 108 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 108

Directive on the security of network and information systems · UE 2022/2555

(108)

Personal data are in many cases compromised as a result of incidents. In that context, the competent authorities should cooperate and exchange information about all relevant matters with the authorities referred to in Regulation (EU) 2016/679 and Directive 2002/58/EC.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) entrusts the ILR with NIS 2 incident notifications, while the CNPD remains competent for article 33 GDPR data breaches. Both authorities have formalised information exchange channels, making any narrative divergence immediately detectable during an audit.

Luxgap practice: prepare a single notification playbook that triggers both ILR and CNPD forms in parallel with a shared factual narrative, and trace everything in a timestamped incident register admissible before both authorities.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

A NIS 2 incident is almost always also a personal data breach under GDPR. The classic mistake is notifying the ILR within 24h while forgetting the CNPD, or vice versa, with diverging narratives between the two files. The authorities talk to each other, and any factual inconsistency between the ILR notification and the GDPR article 33 notification becomes an aggravating factor when sanctions are assessed.

Dual qualification: what this recital requires in practice

Every significant NIS 2 incident must be assessed simultaneously against article 4(12) GDPR: is there a breach of confidentiality, integrity or availability of personal data?
Deadlines are not aligned: ILR requires an early warning within 24h and a report within 72h, the CNPD requires notification within 72h, the NRA within 24h for electronic communications (Directive 2002/58/EC).
The factual narrative (timeline, scope, IOCs, measures) must be strictly identical across both files, since authorities exchange this information.
Communication to data subjects (article 34 GDPR) follows its own logic and is not the same as NIS 2 public information.
Document the dual qualification in the incident register: even an incident dismissed on GDPR grounds must show the qualification reasoning.

How Luxgap automates this risk

Our Luxgap Incident Dual-Track Orchestrator eliminates the risk of diverging notifications between the ILR and the CNPD by orchestrating a single narrative, automatically qualified under both regimes, and dispatched to both authorities with the right deadlines and formats. As soon as an incident is declared in Microsoft Sentinel, Defender XDR, CrowdStrike Falcon or Wazuh, the AI agent analyses the artefacts (logs, technical scope, data types touched) and produces a cross-qualification NIS 2 / GDPR / ePrivacy in under 5 minutes.

Automatically detects compromise of personal data by cross-referencing impacted systems with your article 30 records of processing.
Calculates in parallel the ILR obligations (early warning 24h, intermediate report 72h, final report 1 month) and CNPD obligations (72h notification, communication to data subjects).
Generates both notification files with a strictly consistent factual narrative, timestamped and traced to demonstrate the information exchange between authorities.
Alerts the DPO, CISO and management via Teams or Slack with a real-time legal deadline counter.
Produces a cryptographically sealed PDF report, admissible during a joint ILR-CNPD audit, demonstrating the consistency of declarations.
Archives everything in a timestamped vault (90 days minimum) to handle follow-up requests from the authorities.

Available as part of a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request your demonstration and our team will prepare an incident simulation on your real scope, with a free 48h white audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 108

They trust us

Before we chat