Recital 98
Directive on the security of network and information systems · UE 2022/2555
| (98) | In order to safeguard the security of public electronic communications networks and publicly available electronic communications services, the use of encryption technologies, in particular end-to-end encryption as well as data-centric security concepts, such as cartography, segmentation, tagging, access policy and access management, and automated access decisions, should be promoted. Where necessary, the use of encryption, in particular end-to-end encryption should be mandatory for providers of public electronic communications networks or of publicly available electronic communications services in accordance with the principles of security and privacy by default and by design for the purposes of this Directive. The use of end-to-end encryption should be reconciled with the Member States’ powers to ensure the protection of their essential security interests and public security, and to allow for the prevention, investigation, detection and prosecution of criminal offences in accordance with Union law. However, this should not weaken end-to-end encryption, which is a critical technology for the effective protection of data and privacy and the security of communications. |
In Luxembourg, the law of 28 July 2023 on cybersecurity (as amended by the law of 28 July 2025) entrusts the ILR with the supervision of technical measures applied by essential and important entities, including cryptographic robustness. The ILR relies on ENISA and ANSSI frameworks to assess the relevance of encryption choices, and may require during an inspection concrete proof that keys are not exclusively controlled by a foreign hyperscaler when data is sensitive.
Luxgap practice: for entities processing highly sensitive data (health, finance, public administration), we recommend HSMs hosted on LuxConnect or eBRC with strict key separation via BYOK or HYOK, and full documentation of this choice in your ILR file.
