I need to bring my Luxembourg organisation into compliance with article 23 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 23 is not addressed to companies but to legislators: it allows the Union or a Member State to restrict data subject rights (access, erasure, information) through a legislative measure. The trap for the controller is to believe it can grant itself a restriction. Wrong. The CNPD and the CNIL regularly sanction organisations that refuse a right of access or delay a breach notification (Article 34) by invoking a vague legal obligation, without being able to cite the precise legislative basis restricting the right, nor demonstrate that the restriction respects the necessity and proportionality test. An internal investigation secret, an HR policy or a contractual clause is never a legislative measure within the meaning of Article 23.When can you actually invoke a restrictionBefore refusing or delaying the exercise of a right, check that you tick every box. Otherwise you are in breach, not in restriction.An identifiable legislative rule exists (national or Union law), not merely an internal practice or a circular.The rule pursues one of the limitative objectives of Article 23(1): national security, prevention of criminal offences, secrecy of an investigation, ethics of a regulated profession, enforcement of civil law claims.The restriction respects the essence of fundamental rights and passes the necessity and proportionality test in a democratic society.The rule specifies the purposes, categories of data, exact scope of the restriction and storage periods (Article 23(2)).The person remains informed of the restriction, unless that information would harm the pursued purpose.The restriction is temporary and targeted: lifting the information duty during a money laundering investigation, for example, not a permanent and general refusal.How Luxgap automates this riskOur Luxgap Restriction Gatekeeper makes arbitrary refusal of a right impossible: every incoming request (access, erasure, delayed notification) triggers a legal decision tree that requires an enforceable legislative basis before any block. The AI agent reads your request management inbox (M365, Odoo ticketing, web form) and confronts each invoked restriction ground against the closed list of Article 23(1) and the applicable national laws, without letting a handler improvise a refusal.Detects every incoming rights request in M365, Odoo or your helpdesk and automatically qualifies it (access, erasure, objection, Article 34 notification).Requires the entry of a precise legislative basis before allowing a refusal or deferral, and blocks any ground not traceable to Article 23(1).Applies the necessity and proportionality test through a structured grid aligned with EDPB Guidelines 10/2020 on restrictions.Generates a timestamped refusal justification, citing the invoked national law article, the sector (criminal, tax, ethics) and the duration of the restriction.Calculates the lifting date of the restriction and automatically reopens the file to inform the person when the obstac...

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 23

Restrictions

General Data Protection Regulation · UE 2016/679

Restrictions

1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

(a)	national security;

(b)

defence;

(c)	public security;

(d)	the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(e)	other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;

(f)	the protection of judicial independence and judicial proceedings;

(g)	the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

(h)	a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

(i)	the protection of the data subject or the rights and freedoms of others;

(j)	the enforcement of civil law claims.

2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a)	the purposes of the processing or categories of processing;

(b)	the categories of personal data;

(c)	the scope of the restrictions introduced;

(d)	the safeguards to prevent abuse or unlawful access or transfer;

(e)	the specification of the controller or categories of controllers;

(f)	the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g)	the risks to the rights and freedoms of data subjects; and

(h)	the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees et du regime general sur la protection des donnees

In Luxembourg, the law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection regime specifies the restrictions allowed at national level. Its Articles 63 to 65 notably restrict certain data subject rights where processing is carried out for scientific, historical, statistical or archiving research purposes, and frame the CNPD powers. An organisation invoking a restriction in Luxembourg must therefore tie its refusal to a precise article of this law, not to Article 23 GDPR alone, which is merely an empowerment for the legislator.

Luxgap practice: before any refusal of a right, identify the exact provision of the law of 1 August 2018 invoked and document the duration and scope of the restriction, because the CNPD systematically checks the national basis during an audit.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 23 is not addressed to companies but to legislators: it allows the Union or a Member State to restrict data subject rights (access, erasure, information) through a legislative measure. The trap for the controller is to believe it can grant itself a restriction. Wrong. The CNPD and the CNIL regularly sanction organisations that refuse a right of access or delay a breach notification (Article 34) by invoking a vague legal obligation, without being able to cite the precise legislative basis restricting the right, nor demonstrate that the restriction respects the necessity and proportionality test. An internal investigation secret, an HR policy or a contractual clause is never a legislative measure within the meaning of Article 23.

When can you actually invoke a restriction

Before refusing or delaying the exercise of a right, check that you tick every box. Otherwise you are in breach, not in restriction.

An identifiable legislative rule exists (national or Union law), not merely an internal practice or a circular.
The rule pursues one of the limitative objectives of Article 23(1): national security, prevention of criminal offences, secrecy of an investigation, ethics of a regulated profession, enforcement of civil law claims.
The restriction respects the essence of fundamental rights and passes the necessity and proportionality test in a democratic society.
The rule specifies the purposes, categories of data, exact scope of the restriction and storage periods (Article 23(2)).
The person remains informed of the restriction, unless that information would harm the pursued purpose.
The restriction is temporary and targeted: lifting the information duty during a money laundering investigation, for example, not a permanent and general refusal.

How Luxgap automates this risk

Our Luxgap Restriction Gatekeeper makes arbitrary refusal of a right impossible: every incoming request (access, erasure, delayed notification) triggers a legal decision tree that requires an enforceable legislative basis before any block. The AI agent reads your request management inbox (M365, Odoo ticketing, web form) and confronts each invoked restriction ground against the closed list of Article 23(1) and the applicable national laws, without letting a handler improvise a refusal.

Detects every incoming rights request in M365, Odoo or your helpdesk and automatically qualifies it (access, erasure, objection, Article 34 notification).
Requires the entry of a precise legislative basis before allowing a refusal or deferral, and blocks any ground not traceable to Article 23(1).
Applies the necessity and proportionality test through a structured grid aligned with EDPB Guidelines 10/2020 on restrictions.
Generates a timestamped refusal justification, citing the invoked national law article, the sector (criminal, tax, ethics) and the duration of the restriction.
Calculates the lifting date of the restriction and automatically reopens the file to inform the person when the obstacle disappears.
Produces a timestamped PDF register enforceable before the CNPD, demonstrating that each restriction relied on a legislative measure and not on internal convenience.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real rights requests, with a free blank audit within 48h to measure your exposure before any engagement.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Restrictions

They trust us

Before we chat