I need to bring my Luxembourg organisation into compliance with article 86 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 86 is the friction point between two fundamental rights: public access to official documents and data protection. The trap does not only concern administrations: it also targets any private body performing a task in the public interest (public service delegate, social security body, professional order). Authorities, including the CNPD in Luxembourg and the CNIL in France, sanction mass and undifferentiated disclosures: publishing a full document online without pseudonymising third parties, without checking that a national legal basis actually authorises the disclosure, without minimising. The reconciliation required by Article 86 is not automatic, it must be performed document by document.The reflexes to embed before any disclosureCheck for a precise national legal basis authorising access (the GDPR does not create the right of access, it reconciles it).Distinguish disclosure to the requester (individual access) from online public dissemination (reuse), which requires a reinforced proportionality test.Redact or pseudonymise the data of third parties not concerned by the request (witnesses, minors, staff).Systematically protect special categories (Article 9): health, opinions, convictions, even incidental ones.Document the balancing exercise carried out, to make it enforceable during an audit.Log every disclosure: who, what, on what basis, with which redactions.How Luxgap automates this riskOur Luxgap Disclosure Redactor makes it impossible to leak third-party data when disclosing official documents: an LLM agent reads the requested document, identifies each personal data point and proposes the redacted version before release. The tool connects to your document repositories (SharePoint M365, Alfresco, Odoo DMS, eBRC spaces) and automatically applies the Article 86 reconciliation grid to each incoming request.Automatically detects and classifies the personal data in a document (names, addresses, identifiers, Article 9 data) through semantic analysis, with no manual entry.Distinguishes the legitimate recipient from third parties to protect and proposes a pseudonymised or redacted version ready to send.Verifies that a national access legal basis (freedom of information law) actually covers the request before any disclosure.Alerts in real time whenever a special category or a minor's data appears in the document to be released.Generates a timestamped disclosure register, with the documented balancing exercise, enforceable before the CNPD during an audit.Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real documents, with a free blind audit within 48h to measure your exposure before any commitment.

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 86

Processing and public access to official documents

General Data Protection Regulation · UE 2016/679

Processing and public access to official documents

Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation.

Luxembourg specificity

loi luxembourgeoise du 14 septembre 2018 relative a une administration transparente et ouverte

In Luxembourg, public access to official documents rests on the law of 14 September 2018 on a transparent and open administration, which frames requests to public bodies and sets the grounds for refusal, notably the protection of personal data. The Article 86 GDPR reconciliation is therefore read in light of this law: a body may disclose a document only after verifying that the release does not disproportionately harm the privacy of third parties. The CNPD remains the competent authority, never a non-existent APDL.

Luxgap practice: before any disclosure under the 2018 law, document the balancing between transparency and data protection and keep proof of the redaction performed, the Disclosure Redactor builds this file automatically.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 86 is the friction point between two fundamental rights: public access to official documents and data protection. The trap does not only concern administrations: it also targets any private body performing a task in the public interest (public service delegate, social security body, professional order). Authorities, including the CNPD in Luxembourg and the CNIL in France, sanction mass and undifferentiated disclosures: publishing a full document online without pseudonymising third parties, without checking that a national legal basis actually authorises the disclosure, without minimising. The reconciliation required by Article 86 is not automatic, it must be performed document by document.

The reflexes to embed before any disclosure

Check for a precise national legal basis authorising access (the GDPR does not create the right of access, it reconciles it).
Distinguish disclosure to the requester (individual access) from online public dissemination (reuse), which requires a reinforced proportionality test.
Redact or pseudonymise the data of third parties not concerned by the request (witnesses, minors, staff).
Systematically protect special categories (Article 9): health, opinions, convictions, even incidental ones.
Document the balancing exercise carried out, to make it enforceable during an audit.
Log every disclosure: who, what, on what basis, with which redactions.

How Luxgap automates this risk

Our Luxgap Disclosure Redactor makes it impossible to leak third-party data when disclosing official documents: an LLM agent reads the requested document, identifies each personal data point and proposes the redacted version before release. The tool connects to your document repositories (SharePoint M365, Alfresco, Odoo DMS, eBRC spaces) and automatically applies the Article 86 reconciliation grid to each incoming request.

Automatically detects and classifies the personal data in a document (names, addresses, identifiers, Article 9 data) through semantic analysis, with no manual entry.
Distinguishes the legitimate recipient from third parties to protect and proposes a pseudonymised or redacted version ready to send.
Verifies that a national access legal basis (freedom of information law) actually covers the request before any disclosure.
Alerts in real time whenever a special category or a minor's data appears in the document to be released.
Generates a timestamped disclosure register, with the documented balancing exercise, enforceable before the CNPD during an audit.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real documents, with a free blind audit within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Processing and public access to official documents

They trust us

Before we chat