I need to bring my Luxembourg organisation into compliance with recital 19 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 19 draws a subtle line that many bodies miss: the GDPR does not apply to police and judicial processing (covered by the Law Enforcement Directive 2016/680), BUT it does apply as soon as a competent authority processes data for other purposes (HR, public procurement, building management of a police station). The CNPD and CNIL regularly sanction administrations that applied the wrong regime, or that mixed data falling under both regimes in a single database without proper segregation. A mirror trap hits the private sector: banks under AML/CFT obligations, requisitioned forensic labs, video surveillance providers wrongly invoking the public security exception to restrict data subject rights without a specific national legal basis.Mapping the two regimes: GDPR or Directive 2016/680GDPR applies: HR of a municipal police force, public procurement of a prosecutor's office, access-control video of a police station (building), anonymised crime statistics published for information.Directive 2016/680 (LU law of 1 August 2018): investigation files, criminal records, wiretaps, Schengen transmissions, criminal intelligence files.Grey zone to document: AML/CFT alerts in banks, suspicious transaction reports to the FIU, judicial requisitions received by a private operator , processing remains under GDPR but with rights restrictions (article 23 GDPR + national law).Technically segregate databases: a single IS cannot serve both purposes without logical separation of roles, logs and retention periods.Any restriction of rights (access, information, erasure) invoked on public security grounds must rest on an explicit national legal provision, proportionate and necessary, not just an internal policy.How Luxgap automates this riskOur Luxgap Dual-Regime Classifier eliminates the grey zone between GDPR and Directive 2016/680 by automatically classifying each of your processing activities under the correct legal regime, with reasoning enforceable before the CNPD. A specialised LLM agent analyses the declared purpose, legal basis, recipient and data categories, then cross-references the EDPB grid and the Luxembourg law of 1 August 2018 to deliver a reasoned verdict in less than 60 seconds per processing activity.Classifies each processing activity in the article 30 register under the applicable regime (GDPR, Law Enforcement Directive, outside Union scope) with confidence score and justification citing relevant recitals.Detects hybrid high-risk processing (AML/CFT banks, video providers serving a municipality, requisitioned labs) and proposes a technical and organisational segregation plan.Audits the rights restrictions invoked by your organisation and verifies they rest on an identified national legal basis compliant with article 23 GDPR.Generates differentiated information notices to be delivered to data subjects according to the applicable regime, with correct remedies (CNPD GDPR vs CNPD Law Enforcement).Produces a timestamped PDF report, enfor...

Recital 19 GDPR — Recital 19 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 19

General Data Protection Regulation · UE 2016/679

(19)

The protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and the free movement of such data, is the subject of a specific Union legal act. This Regulation should not, therefore, apply to processing activities for those purposes. However, personal data processed by public authorities under this Regulation should, when used for those purposes, be governed by a more specific Union legal act, namely Directive (EU) 2016/680 of the European Parliament and of the Council (7). Member States may entrust competent authorities within the meaning of Directive (EU) 2016/680 with tasks which are not necessarily carried out for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and prevention of threats to public security, so that the processing of personal data for those other purposes, in so far as it is within the scope of Union law, falls within the scope of this Regulation.

With regard to the processing of personal data by those competent authorities for purposes falling within scope of this Regulation, Member States should be able to maintain or introduce more specific provisions to adapt the application of the rules of this Regulation. Such provisions may determine more precisely specific requirements for the processing of personal data by those competent authorities for those other purposes, taking into account the constitutional, organisational and administrative structure of the respective Member State. When the processing of personal data by private bodies falls within the scope of this Regulation, this Regulation should provide for the possibility for Member States under specific conditions to restrict by law certain obligations and rights when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard specific important interests including public security and the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. This is relevant for instance in the framework of anti-money laundering or the activities of forensic laboratories.

Luxembourg specificity

loi du 1er aout 2018 relative a la protection des personnes physiques a l'egard du traitement des donnees a caractere personnel en matiere penale ainsi qu'en matiere de securite nationale

In Luxembourg, Directive 2016/680 was transposed by the law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data in criminal matters and in matters of national security. The CNPD remains the single supervisory authority for both regimes (GDPR and Law Enforcement Directive), which simplifies the contact point but requires particular rigour in qualifying the applicable regime: a CNPD inspection will first verify under which regime you operate before auditing compliance.

Luxgap practice: for any hybrid entity (AML/CFT bank, municipality with municipal police, video provider on public buildings), we document from the article 30 register the regime applicable to each processing activity and the Luxembourg legal basis relied upon for any rights restriction.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 19 draws a subtle line that many bodies miss: the GDPR does not apply to police and judicial processing (covered by the Law Enforcement Directive 2016/680), BUT it does apply as soon as a competent authority processes data for other purposes (HR, public procurement, building management of a police station). The CNPD and CNIL regularly sanction administrations that applied the wrong regime, or that mixed data falling under both regimes in a single database without proper segregation. A mirror trap hits the private sector: banks under AML/CFT obligations, requisitioned forensic labs, video surveillance providers wrongly invoking the public security exception to restrict data subject rights without a specific national legal basis.

Mapping the two regimes: GDPR or Directive 2016/680

GDPR applies: HR of a municipal police force, public procurement of a prosecutor's office, access-control video of a police station (building), anonymised crime statistics published for information.
Directive 2016/680 (LU law of 1 August 2018): investigation files, criminal records, wiretaps, Schengen transmissions, criminal intelligence files.
Grey zone to document: AML/CFT alerts in banks, suspicious transaction reports to the FIU, judicial requisitions received by a private operator , processing remains under GDPR but with rights restrictions (article 23 GDPR + national law).
Technically segregate databases: a single IS cannot serve both purposes without logical separation of roles, logs and retention periods.
Any restriction of rights (access, information, erasure) invoked on public security grounds must rest on an explicit national legal provision, proportionate and necessary, not just an internal policy.

How Luxgap automates this risk

Our Luxgap Dual-Regime Classifier eliminates the grey zone between GDPR and Directive 2016/680 by automatically classifying each of your processing activities under the correct legal regime, with reasoning enforceable before the CNPD. A specialised LLM agent analyses the declared purpose, legal basis, recipient and data categories, then cross-references the EDPB grid and the Luxembourg law of 1 August 2018 to deliver a reasoned verdict in less than 60 seconds per processing activity.

Classifies each processing activity in the article 30 register under the applicable regime (GDPR, Law Enforcement Directive, outside Union scope) with confidence score and justification citing relevant recitals.
Detects hybrid high-risk processing (AML/CFT banks, video providers serving a municipality, requisitioned labs) and proposes a technical and organisational segregation plan.
Audits the rights restrictions invoked by your organisation and verifies they rest on an identified national legal basis compliant with article 23 GDPR.
Generates differentiated information notices to be delivered to data subjects according to the applicable regime, with correct remedies (CNPD GDPR vs CNPD Law Enforcement).
Produces a timestamped PDF report, enforceable during a CNPD inspection, demonstrating the consistency of your dual-regime mapping.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a demonstration and our teams will perform a free 48h white audit on your sensitive processing activities to materialise your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 19

They trust us

Before we chat