I need to bring my Luxembourg organisation into compliance with recital 118 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 118 GDPR — Recital 118 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 118

General Data Protection Regulation · UE 2016/679

(118)

The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, appeals against CNPD decisions fall under the Administrative Tribunal (first instance) then the Administrative Court (appeal), with a 3-month appeal deadline from notification. The law of 1 August 2018 organising the CNPD specifies that the Commission is subject to Court of Auditors oversight for its financial management, while guaranteeing its functional independence.

Luxgap practice: never let the 3-month deadline pass without consulting a specialised lawyer. We systematically coordinate with your counsel to structure the introductory memorandum within 30 days of notification.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital reminds us that the independence of the CNPD, CNIL or APD/GBA does not place them outside any oversight: they remain subject to budgetary control (Court of Auditors, Parliament) and judicial review of their decisions. In practice, this means that adverse decisions against you are appealable before administrative courts (Tribunal administratif in Luxembourg, Conseil d'Etat in France), and that the authority itself must motivate and document its acts. The trap is either to suffer a CNPD decision without exercising this right of appeal within the deadlines, or conversely to believe the authority operates without a framework.

Why this recital reshapes your defensive strategy

Any CNPD decision (fine, injunction, formal notice) is appealable before the Luxembourg Administrative Tribunal within 3 months.
The authority must respect adversarial proceedings: you have the right to access the file, submit written and oral observations before any sanction.
EDPB guidelines are not legally binding: a judge can set them aside if they exceed the GDPR text.
Proportionality of the sanction (article 83) is a major contestation ground: turnover retained, gravity, corrective measures taken.
Preserving the full exchange history with the authority (letters, emails, hearing minutes) is the foundation of any useful appeal.

How Luxgap automates this risk

Our Luxgap Regulatory Defense Vault turns every interaction with the CNPD or a foreign authority into a litigation-ready defense file, from the very first letter received. The tool captures, timestamps and cryptographically seals each exchange (scanned postal letter via OCR, incoming email, hearing minutes, information request), automatically reconstructs the procedural timeline and flags critical appeal deadlines before they expire.

Automatically detects incoming CNPD letters via a dedicated mailbox and scanner connector, and triggers a Teams or Slack alert within 5 minutes.
Calculates applicable appeal deadlines in real time (3 months before LU Administrative Tribunal, 2 months before FR Conseil d'Etat) and sends D-30, D-15, D-7 reminders.
Builds a structured defense file matching Administrative Tribunal requirements, with a response memorandum pre-drafted by an LLM agent specialised in GDPR litigation.
Archives all exchanges in a probative-value digital vault (eIDAS qualified timestamping, SHA-256 sealing), enforceable before the administrative judge.
Cross-references your arguments with published case law of the LU Administrative Tribunal and FR Conseil d'Etat to identify the strongest contestation angles.
Generates a PDF synthesis report ready to hand over to your lawyer, who saves 80% of file review time.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a custom quote and our teams prepare a demonstration on your actual CNPD exchanges, with a free 48-hour white audit to assess the strength of your position before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 118

They trust us

Before we chat