I need to bring my Luxembourg organisation into compliance with recital 14 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 14 NIS 2 — Recital 14 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 14

Directive on the security of network and information systems · UE 2022/2555

(14)

Union data protection law and Union privacy law applies to any processing of personal data under this Directive. In particular, this Directive is without prejudice to Regulation (EU) 2016/679 of the European Parliament and of the Council (8) and Directive 2002/58/EC of the European Parliament and of the Council (9). This Directive should therefore not affect, inter alia, the tasks and powers of the authorities competent to monitor compliance with the applicable Union data protection law and Union privacy law.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the coexistence of the ILR (NIS 2 competent authority designated by the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025) and the CNPD (GDPR authority) requires an effective dual notification for any security incident involving personal data. The Luxembourg transposition law applies the NIS 2 deadlines (early warning 24h, notification 72h, final report 1 month) without derogating from the GDPR 72h deadline applied in parallel.

Luxgap practice: build a single incident procedure that triggers both ILR and CNPD notifications from the same event, with a shared field mapping to avoid contradictions between both files (which are cross-checked during inspections).

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 14 reminds organisations of an often forgotten point: NIS 2 does not suspend the GDPR. In practice, the ILR sanctions the absence of technical measures under NIS 2 while the CNPD sanctions the same incident in parallel under the GDPR angle (article 32 and article 33). Organisations that handle their ILR incident notification without coordinating with their DPO end up facing two distinct procedures, two deadlines (24h ILR vs 72h CNPD), and two investigation logics that contradict each other.

Concrete friction zones between NIS 2 and GDPR

A security incident affecting personal data triggers both regimes simultaneously: ILR notification (early warning 24h, notification 72h, final report 1 month) AND CNPD notification (72h article 33 GDPR).
Logs and detection data collected for NIS 2 compliance are themselves personal data processing subject to GDPR: legal basis, retention duration, information of monitored employees.
Sharing IOCs with the national CSIRT may include personal data (IP addresses, compromised identifiers) and requires a compatible GDPR basis.
NIS 2 article 21 measures (encryption, MFA, segmentation) are also GDPR article 32 measures: documentation must serve both audits.
Post-incident forensic analysis handles personal data of staff and third parties: the ILR does not exempt you from the rights of data subjects.

How Luxgap automates this risk

Our Luxgap Dual-Notify Orchestrator eliminates the risk of desynchronised notifications between the ILR and the CNPD by driving a single incident timeline that automatically feeds both authorities with the right elements, in the right deadlines, without double entry. An AI agent classifies the incident as soon as it is detected in Microsoft Sentinel, Defender XDR, CrowdStrike or Wazuh, determines whether the dual NIS 2 + GDPR qualification applies, and triggers the appropriate notification workflows in less than 5 minutes.

Automatically classifies each SIEM alert against a dual NIS 2 / GDPR matrix and qualifies the incident as significant under NIS 2 article 23, as a breach under GDPR article 33, or both.
Pre-fills the ILR form (early warning 24h, intermediate notification 72h, final report 1 month) AND the CNPD notification (72h) from the same technical elements pulled from Sentinel or Defender, avoiding any contradiction between the two files.
Generates GDPR article 34 information letters to data subjects when the risk is high, with a template adapted to the typology of compromised data.
Traces every action in a cryptographically timestamped register, enforceable before the ILR and the CNPD in case of a cross audit, proving the coherent articulation of both regimes.
Alerts the DPO and the CISO simultaneously via Teams or Slack as soon as an incident shifts into dual qualification, preventing one authority from being notified while the other is left out.

Available as part of a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a demonstration on your real stack, with a free blind audit within 48h to measure the gap between your NIS 2 and GDPR procedures before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 14

They trust us

Before we chat