Recital 123
General Data Protection Regulation · UE 2016/679
| (123) | The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application throughout the Union, in order to protect natural persons in relation to the processing of their personal data and to facilitate the free flow of personal data within the internal market. For that purpose, the supervisory authorities should cooperate with each other and with the Commission, without the need for any agreement between Member States on the provision of mutual assistance or on such cooperation. |
In Luxembourg, the CNPD (never APDL) is the competent authority, established by the law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection regime. It actively cooperates through the EDPB and systematically applies European guidelines during audits, even when those are not transposed into Luxembourg law.
Luxgap practice: for groups with a main establishment in Luxembourg, formally identify the CNPD as the lead authority under article 56 and document this designation in your register, otherwise each local authority may claim jurisdiction over its own data subjects.
