I need to bring my Luxembourg organisation into compliance with article 78 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 78 is often read as a right reserved to individuals, when it also protects the company on the receiving end of a CNPD decision: injunction, fine, formal notice, refusal of certification. The classic trap is to be hit by a legally binding decision without building the appeal file in time, because the deadline to seize the Luxembourg administrative court runs fast and the proof of what was actually communicated to the authority (and vice versa) was never preserved. The mirror trap: a data subject who lodged a complaint under Article 77 gains a remedy as soon as the authority fails to handle the file or fails to inform within three months of the progress, turning your procedural silence into avoidable litigation.What authorities and courts check in practiceThe exact nature of the contested decision: only a legally binding decision opens the Article 78(1) remedy, not a mere guidance letter.Compliance with the three-month information deadline (Article 78(2)), the tipping point toward a remedy for inaction.Territorial jurisdiction: proceedings are brought before the courts of the Member State where the authority is established (Article 78(3)), so the administrative court in Luxembourg for the CNPD.The traceability of exchanges: who notified what, when, and with which acknowledgment of receipt, a decisive element to demonstrate compliance with or breach of deadlines.The opinion or decision of the European Board (EDPB) issued under the consistency mechanism, which the authority must forward to the court (Article 78(4)) and which you must anticipate in your argument.In practice, winning or losing an Article 78 appeal is decided first on mastery of the calendar and of the evidence, well before the substantive argument.How Luxgap automates this riskOur Luxgap Remedy Timeline Tracker makes it impossible to silently miss an appeal or response deadline with the authority: it turns every interaction with the CNPD into a time-stamped and enforceable timeline. The tool ingests your exchanges automatically from your M365 mailboxes and document repositories (SharePoint, Odoo Documents), rebuilds the chronology of complaint, acknowledgment, decision, and continuously computes the time left to act.Detects automatically any incoming or outgoing correspondence with the CNPD in M365 and files it by case (Article 77 complaint, binding decision, formal notice).Computes in real time the three-month deadline of Article 78(2) and alerts via Teams as soon as an information failure opens a remedy for or against you.Counts down the applicable judicial appeal deadline before the Luxembourg administrative court and triggers an escalation alert before time bar.Rebuilds the full evidentiary chain of notifications with acknowledgments of receipt, to demonstrate who knew what and when.Matches your file against the EDPB opinion or decision issued under the consistency mechanism and flags the forwarding obligation set out in Article 78(4).Produces a time-stam...

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 78

Right to an effective judicial remedy against a supervisory authority

General Data Protection Regulation · UE 2016/679

Right to an effective judicial remedy against a supervisory authority

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the supervisory authority is the CNPD, established in Belvaux, and Article 78(3) proceedings fall under the administrative tribunal and, on appeal, the administrative court. The law of 1 August 2018 on the organisation of the CNPD frames the binding decisions open to appeal and their notification. The appeal deadline before the administrative tribunal is in principle three months from notification of the decision, distinct from the three-month deadline of Article 78(2) relating to the authority's inaction.

Luxgap practice: as soon as a CNPD decision arrives, date and archive the notification, determine whether it is legally binding, and immediately lock the appeal deadline countdown so you never suffer a time bar.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 78 is often read as a right reserved to individuals, when it also protects the company on the receiving end of a CNPD decision: injunction, fine, formal notice, refusal of certification. The classic trap is to be hit by a legally binding decision without building the appeal file in time, because the deadline to seize the Luxembourg administrative court runs fast and the proof of what was actually communicated to the authority (and vice versa) was never preserved. The mirror trap: a data subject who lodged a complaint under Article 77 gains a remedy as soon as the authority fails to handle the file or fails to inform within three months of the progress, turning your procedural silence into avoidable litigation.

What authorities and courts check in practice

The exact nature of the contested decision: only a legally binding decision opens the Article 78(1) remedy, not a mere guidance letter.
Compliance with the three-month information deadline (Article 78(2)), the tipping point toward a remedy for inaction.
Territorial jurisdiction: proceedings are brought before the courts of the Member State where the authority is established (Article 78(3)), so the administrative court in Luxembourg for the CNPD.
The traceability of exchanges: who notified what, when, and with which acknowledgment of receipt, a decisive element to demonstrate compliance with or breach of deadlines.
The opinion or decision of the European Board (EDPB) issued under the consistency mechanism, which the authority must forward to the court (Article 78(4)) and which you must anticipate in your argument.

In practice, winning or losing an Article 78 appeal is decided first on mastery of the calendar and of the evidence, well before the substantive argument.

How Luxgap automates this risk

Our Luxgap Remedy Timeline Tracker makes it impossible to silently miss an appeal or response deadline with the authority: it turns every interaction with the CNPD into a time-stamped and enforceable timeline. The tool ingests your exchanges automatically from your M365 mailboxes and document repositories (SharePoint, Odoo Documents), rebuilds the chronology of complaint, acknowledgment, decision, and continuously computes the time left to act.

Detects automatically any incoming or outgoing correspondence with the CNPD in M365 and files it by case (Article 77 complaint, binding decision, formal notice).
Computes in real time the three-month deadline of Article 78(2) and alerts via Teams as soon as an information failure opens a remedy for or against you.
Counts down the applicable judicial appeal deadline before the Luxembourg administrative court and triggers an escalation alert before time bar.
Rebuilds the full evidentiary chain of notifications with acknowledgments of receipt, to demonstrate who knew what and when.
Matches your file against the EDPB opinion or decision issued under the consistency mechanism and flags the forwarding obligation set out in Article 78(4).
Produces a time-stamped and cryptographically sealed PDF appeal file, enforceable before the court, gathering chronology, exhibits and deadline calculations.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real exchanges with the authority, with a free blind audit within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Right to an effective judicial remedy against a supervisory authority

They trust us

Before we chat