Recital 111
Directive on the security of network and information systems · UE 2022/2555
| (111) | In order to ensure the availability of accurate and complete domain name registration data, TLD name registries and entities providing domain name registration services should collect and guarantee the integrity and availability of domain name registration data. In particular, TLD name registries and entities providing domain name registration services should establish policies and procedures to collect and maintain accurate and complete domain name registration data, as well as to prevent and correct inaccurate registration data, in accordance with Union data protection law. Those policies and procedures should take into account, to the extent possible, the standards developed by the multi-stakeholder governance structures at international level. The TLD name registries and the entities providing domain name registration services should adopt and implement proportionate procedures to verify domain name registration data. Those procedures should reflect the best practices used within the industry and, to the extent possible, the progress made in the field of electronic identification. Examples of verification procedures may include ex ante controls carried out at the time of the registration and ex post controls carried out after the registration. The TLD name registries and the entities providing domain name registration services should, in particular, verify at least one means of contact of the registrant. |
In Luxembourg, the national .lu TLD registry is operated by RESTENA-DNS-LU under the supervision of the ILR. The law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) transposes NIS 2 article 28 and requires registries and registrars established in Luxembourg to provide registration data without delay to legitimate access requesters (authorities, rights holders). The ILR may conduct on-site inspections and require evidence of ex ante and ex post verification procedures.
Luxgap practice: connect the verification engine to the DNS.lu EPP flow and to LuxTrust for natural-person registrants residing in Luxembourg, to produce an eIDAS-grade trace directly opposable to ILR auditors.