I need to bring my Luxembourg organisation into compliance with article 39 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 39

Tasks of the data protection officer

General Data Protection Regulation · UE 2016/679

Tasks of the data protection officer

1. The data protection officer shall have at least the following tasks:

(a)	to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;

(b)

to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

(c)	to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;

(d)	to cooperate with the supervisory authority;

(e)	to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.

2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the designation and oversight of the DPO fall under the control of the CNPD, which in practice checks the real effectiveness of Article 39 tasks rather than their mere formal existence. The law of 1 August 2018 organising the CNPD confirms the CNPD as the single supervisory authority and interlocutor of the DPO, making the Article 39(1)(e) contact point particularly scrutinised during Luxembourg inspections.

Luxgap practice: keep the timestamped history of every exchange with the CNPD and every DPIA opinion, because during an inspection this traceability is what distinguishes an effective DPO from a paper one.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 39 turns the DPO into the pivot of accountability, but the CNPD and CNIL rarely sanction the DPO personally: they sanction the controller who appointed a paper DPO. The classic trap is to designate a DPO on paper, without a monitoring plan, without a training budget, without any trace of advice given on DPIAs. During an inspection, the authority asks for the DPO's activity log: without documented proof of the monitoring required under Article 39(1)(b) and of cooperation with the authority (39(1)(d)), the DPO is deemed fictitious and the organisation loses its main line of defence.

What authorities expect you to prove

A documented annual monitoring plan (audits, compliance points checked, dates), not just a job title.
The written record of advice given on data protection impact assessments (Article 35), with timestamp and recipient.
Proof that the DPO was consulted upstream of new processing, not informed afterwards.
A register of awareness and training actions for staff, with participation rates.
Exchanges with the CNPD as the single contact point, archived and retrievable.
The risk-based prioritisation required by Article 39(2): the DPO must show that controls focus on the most sensitive processing.

How Luxgap automates this risk

Our Luxgap DPO Activity Ledger makes the paper DPO accusation impossible by automatically building the opposable log of every Article 39 task. The tool aggregates your advice, your controls and your exchanges from M365, Outlook, Teams, your processing register and your ticketing system, then timestamps each action without asking the DPO to keep a manual spreadsheet.

Automatically captures each piece of advice given on a DPIA from Outlook and Teams, and links it to the relevant processing in the register.
Generates a risk-prioritised annual monitoring plan per Article 39(2), ranking your processing by sensitivity and volume.
Detects new processing created in Odoo, Salesforce or SharePoint and alerts the DPO if they were not consulted upstream.
Tracks awareness and training actions via M365 enrolments and calculates staff coverage rates.
Archives and indexes every exchange with the CNPD to materialise the contact point role of Article 39(1)(e).
Produces a timestamped PDF report, opposable to the CNPD during an inspection, demonstrating the real effectiveness of the DPO function.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Tasks of the data protection officer

They trust us

Before we chat