Recital 126
General Data Protection Regulation · UE 2016/679
| (126) | The decision should be agreed jointly by the lead supervisory authority and the supervisory authorities concerned and should be directed towards the main or single establishment of the controller or processor and be binding on the controller and processor. The controller or processor should take the necessary measures to ensure compliance with this Regulation and the implementation of the decision notified by the lead supervisory authority to the main establishment of the controller or processor as regards the processing activities in the Union. |
In Luxembourg, the CNPD acts as lead supervisory authority for many international groups headquartered there, particularly in e-commerce, fintech and platform sectors (historically Amazon, PayPal, Rakuten). The law of 1 August 2018 organising the CNPD details the authority's procedural role in the article 60 cooperation mechanism and the article 63 consistency mechanism, without altering the substance of recital 126.
Luxgap practice: if your group is based in Luxembourg, secure your main establishment qualification today through an enforceable factual file (decision-making org chart, board minutes, signatures of processing contracts). Without it, a foreign authority can challenge the one-stop-shop benefit and open a parallel procedure.
