The classic trap
Recital 20 creates a dangerous grey zone for any law firm, bailiff, notary or IT provider serving a Luxembourg court. The CNPD is NOT competent when a court acts in its judicial capacity, but it regains full jurisdiction over everything administrative (registry HR, public procurement, access badges, intranet). In practice, organisations confuse the two perimeters and apply a single regime, exposing themselves either to a compliance gap or to an infringement of judicial independence.
How to draw the judicial / administrative line
- Judicial capacity (outside CNPD scope): drafting judgments, case investigation, deliberations, judicial file management, hearings.
- Administrative capacity (full CNPD scope): HR of magistrates and clerks, IT vendors, badges, premises CCTV, institutional website, public procurement.
- Sensitive hybrid cases: civil status registers, criminal record, online hearing roll, archives after final judgment.
- For Luxembourg lawyers, notaries and bailiffs: you are NOT covered by this exception. The CNPD has full jurisdiction over your client files, even those linked to ongoing court proceedings.
- The internal supervisory body specific to the Luxembourg judiciary handles complaints relating to the judicial capacity, but does not exempt you from maintaining an Article 30 record.
The practical qualification test
Ask: could this processing operation have been carried out by a non-judicial administration? If yes, you are in the administrative perimeter and the CNPD is competent. If the operation is inseparable from the act of judging, you are in the judicial perimeter.
How Luxgap automates this risk
Our Luxgap Judicial Scope Mapper automatically draws, processing by processing, the boundary between your judicial activities (outside CNPD) and administrative activities (under CNPD), to eliminate the grey zone that exposes courts, prosecutors offices and legal auxiliaries to a dual compliance risk. The tool relies on a legal AI agent trained on CJEU case law and EDPB guidelines that classifies each processing operation in your IS by cross-referencing connected sources (Active Directory, M365, judicial business applications, notary and law firm management software such as Kleos, Secib, eJustice).
- Classifies each processing operation in your Article 30 record against a judicial / administrative / hybrid grid, with reasoned justification citing Recital 20 and CJEU case law.
- Automatically detects misqualified operations by cross-referencing declared purpose, data categories, recipients and retention periods.
- Generates a dual register: one part submitted to the CNPD, one part falling under the internal judicial oversight body, with documented bridges for hybrid cases.
- Issues real-time alerts as soon as a new processing operation appears (newly deployed software, new data flow) and suggests the proper qualification before go-live.
- Produces a timestamped, cryptographically sealed PDF report, enforceable during a CNPD inspection or a complaint before the competent judicial body.
- For lawyers and notaries: makes clear that YOUR client processing operations do NOT benefit from the exception, and structures your full CNPD compliance (register, DPAs with software publishers, retention policy by file type).
Available alongside a Luxgap DPO mandate or as a standalone SaaS brick depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual processing map, with a free 48h white audit to measure your exposure before any engagement.
