I need to bring my Luxembourg organisation into compliance with recital 144 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 144 NIS 2 — Recital 144 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 144

Directive on the security of network and information systems · UE 2022/2555

(144)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (25) and delivered an opinion on 11 March 2021 (26),

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite (modifiee le 28 juillet 2025)

In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) designates the ILR as the NIS 2 competent authority and the national CSIRT (GOVCERT.LU / CIRCL) as the technical recipient. Essential and important entities in the financial sector also have the CSSF as a sectoral authority, which can create a triple notification (ILR + CNPD + CSSF) for a single incident.

Luxgap practice: for CSSF-regulated entities, the orchestrator integrates CSSF circular 24/847 on ICT incident notification from the outset, preventing the CSSF notification from drifting out of sync with ILR and CNPD.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 144 confirms that NIS 2 was validated by the European Data Protection Supervisor (EDPS) before adoption. The practical trap: essential and important entities forget that NIS 2 does not replace the GDPR, and that a cybersecurity incident is very often also a personal data breach. Result: dual notification to ILR (NIS 2 incident within 24h then 72h) and CNPD (GDPR breach within 72h), with different deadlines and recipients, on the same facts. ILR and CNPD do exchange information in practice, and inconsistent notifications between the two are a direct red flag.

The NIS 2 / GDPR interplay this recital makes explicit

The EDPS opinion of 11 March 2021 specifically insisted on the coexistence of both regimes. Concretely, for an entity covered by NIS 2:

Any significant incident (Article 23 NIS 2) must be assessed under GDPR Article 33: are personal data affected?
Deadlines are not aligned: early warning to ILR within 24h, incident notification within 72h, final report within 1 month under NIS 2; CNPD notification within 72h under GDPR.
Recipients diverge: ILR for cybersecurity, CNPD for data protection, data subjects if high risk (Article 34 GDPR).
The legal bases for information sharing between authorities (ILR, CNPD, CSSF, ENISA, CSIRT) must be documented, otherwise you lose control of the narrative.
Internal documentation must prove that both qualifications were examined, even if only one ultimately applies.

How Luxgap automates this risk

Our Luxgap Dual-Notification Orchestrator eliminates the risk of inconsistent notifications between ILR and CNPD by running both regulatory clocks in parallel as soon as an incident is declared. The tool ingests alerts from your SIEM (Microsoft Sentinel, Wazuh, CrowdStrike Falcon, Defender XDR) and EDR, then an AI agent automatically qualifies the incident under the dual prism of NIS 2 Article 23 and GDPR Article 33 in under 5 minutes.

Triggers two synchronised countdowns (24h ILR, 72h ILR, 72h CNPD, 1-month final report) with automatic escalations on Teams and SMS to designated responders.
Pre-fills the official ILR and CNPD forms from the same facts, ensuring consistency of qualification, scope and number of data subjects affected.
Automatically detects, via LLM log classification, whether personal data are present in the compromised scope and switches to dual notification mode.
Generates a cryptographically sealed timeline (timestamped SHA-256 hash) admissible during an ILR or CNPD inspection, demonstrating qualification due diligence.
Alerts in real time if communication to data subjects (Article 34 GDPR) becomes mandatory after a risk re-assessment.
Archives exchanges with the national CSIRT and ENISA in a single, traceable, exportable register.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request your demonstration and our teams will prepare an incident simulation on your real stack, with a free 48h white audit to measure your current capacity to meet both clocks.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 144

They trust us

Before we chat