I need to bring my Luxembourg organisation into compliance with article 48 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 48 is the blind spot of organisations relying on US providers or exposed to extraterritorial foreign law. The trap: receiving a judicial or administrative request from a third country (subpoena, court order, FBI/SEC demand, CLOUD Act) and complying directly, without checking whether an international agreement (mutual legal assistance treaty, MLAT) exists. The EDPB, in its guidelines 02/2024 on Article 48, recalls that a foreign authority decision is never in itself a transfer ground: transferring without a Chapter V legal basis exposes you to the maximum GDPR fine (EUR 20 million or 4% of worldwide turnover). The CNPD and the CNIL treat this as a sovereignty issue, not a mere formality.The reflexes to have when facing an extraterritorial requestNever transfer based solely on a foreign decision: first verify the existence of an international agreement in force (MLAT, mutual assistance convention).Document every request received, its origin, the legal basis invoked and the response given.Articulate Article 48 with any Chapter V ground (Article 49 derogation, adequacy decision, standard contractual clauses) without confusing the two logics.Identify providers subject to the CLOUD Act or foreign disclosure laws (US hyperscalers, subsidiaries of US groups, Chinese providers).Set up an internal escalation procedure to the DPO and legal team upon receipt of a foreign demand.Assess the potential conflict of laws and notify the competent supervisory authority where needed.The practical difficulty: these requests often arrive by email to a salesperson or a technical support agent, who replies without grasping the stakes. The risk is organisational as much as legal.How Luxgap automates this riskOur Luxgap Foreign Request Shield makes reflexive disclosure to a foreign authority impossible by inserting a control gateway between your teams and any extraterritorial request. The tool continuously maps your providers exposed to the CLOUD Act and foreign disclosure laws by cross-referencing your Odoo contracts, your Microsoft 365 directory, your AWS Cost Explorer subscriptions and the nationality of parent companies, then triggers an enforceable workflow as soon as a request comes in.Automatically detects providers subject to extraterritorial law (US hyperscalers, subsidiaries of foreign groups) and computes an exposure score per processing activity.Intercepts foreign requests through a dedicated inbox and a Microsoft 365 / Outlook integration, and blocks any reply before legal validation.Verifies in real time whether an applicable international agreement (MLAT, mutual assistance conventions) exists between the requesting country and the Union or Luxembourg.Generates a decision tree aligned with EDPB guidelines 02/2024 indicating whether the request can be recognised or must be refused.Produces a timestamped register of every request received, its basis and the action taken, enforceable before the CNPD during an audit.Instantly alerts the...

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 48

Transfers or disclosures not authorised by Union law

General Data Protection Regulation · UE 2016/679

Transfers or disclosures not authorised by Union law

Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the CNPD (never the APDL) is the authority competent to sanction an unauthorised transfer under Article 48. The law of 1 August 2018 organising the CNPD grants it the power to impose GDPR administrative fines on private entities. Financial sector players must additionally articulate Article 48 with their professional secrecy obligations (Article 41 of the law of 5 April 1993 on the financial sector), which already prohibits disclosing client data without a Luxembourg legal basis or international agreement.

Luxgap practice: for a CSSF-regulated fintech or private bank, the dual lock of banking secrecy plus Article 48 must be mapped together. Our Foreign Request Shield embeds the LSF professional secrecy grid into its decision tree.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 48 is the blind spot of organisations relying on US providers or exposed to extraterritorial foreign law. The trap: receiving a judicial or administrative request from a third country (subpoena, court order, FBI/SEC demand, CLOUD Act) and complying directly, without checking whether an international agreement (mutual legal assistance treaty, MLAT) exists. The EDPB, in its guidelines 02/2024 on Article 48, recalls that a foreign authority decision is never in itself a transfer ground: transferring without a Chapter V legal basis exposes you to the maximum GDPR fine (EUR 20 million or 4% of worldwide turnover). The CNPD and the CNIL treat this as a sovereignty issue, not a mere formality.

The reflexes to have when facing an extraterritorial request

Never transfer based solely on a foreign decision: first verify the existence of an international agreement in force (MLAT, mutual assistance convention).
Document every request received, its origin, the legal basis invoked and the response given.
Articulate Article 48 with any Chapter V ground (Article 49 derogation, adequacy decision, standard contractual clauses) without confusing the two logics.
Identify providers subject to the CLOUD Act or foreign disclosure laws (US hyperscalers, subsidiaries of US groups, Chinese providers).
Set up an internal escalation procedure to the DPO and legal team upon receipt of a foreign demand.
Assess the potential conflict of laws and notify the competent supervisory authority where needed.

The practical difficulty: these requests often arrive by email to a salesperson or a technical support agent, who replies without grasping the stakes. The risk is organisational as much as legal.

How Luxgap automates this risk

Our Luxgap Foreign Request Shield makes reflexive disclosure to a foreign authority impossible by inserting a control gateway between your teams and any extraterritorial request. The tool continuously maps your providers exposed to the CLOUD Act and foreign disclosure laws by cross-referencing your Odoo contracts, your Microsoft 365 directory, your AWS Cost Explorer subscriptions and the nationality of parent companies, then triggers an enforceable workflow as soon as a request comes in.

Automatically detects providers subject to extraterritorial law (US hyperscalers, subsidiaries of foreign groups) and computes an exposure score per processing activity.
Intercepts foreign requests through a dedicated inbox and a Microsoft 365 / Outlook integration, and blocks any reply before legal validation.
Verifies in real time whether an applicable international agreement (MLAT, mutual assistance conventions) exists between the requesting country and the Union or Luxembourg.
Generates a decision tree aligned with EDPB guidelines 02/2024 indicating whether the request can be recognised or must be refused.
Produces a timestamped register of every request received, its basis and the action taken, enforceable before the CNPD during an audit.
Instantly alerts the DPO and legal team via Teams or email upon receipt of a foreign disclosure demand.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real providers, with a free blind audit within 48h to measure your extraterritorial exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Transfers or disclosures not authorised by Union law

They trust us

Before we chat