I need to bring my Luxembourg organisation into compliance with recital 24 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 24 GDPR — Recital 24 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 24

General Data Protection Regulation · UE 2016/679

(24)

The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees et du regime general sur la protection des donnees

In Luxembourg, the CNPD (not APDL, which does not exist) is the competent supervisory authority for non-EU controllers and processors targeting individuals located in Luxembourg, save for the one-stop-shop mechanism. The law of 1 August 2018 organising the CNPD and implementing the GDPR confirms CNPD competence for complaints filed by Luxembourg residents against foreign actors, and Luxembourg's position as a fintech and e-commerce hub significantly increases extraterritorial exposure.

Luxgap practice: we recommend that Luxembourg fintechs and e-commerce platforms hosting third-party SDKs or pixels formally document, in their Article 30 record, the GDPR status of every detected non-EU actor, with proof of Article 27 representative designation on the vendor side.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 24 extends the GDPR to any non-EU actor monitoring the behaviour of people located in the Union. The CNIL and CNPD regularly sanction US or Asian publishers who thought they escaped the regulation because they had neither subsidiary nor servers in Europe. The trap: a simple advertising pixel, a mobile tracking SDK, a behavioural analytics script, a retargeting cookie is enough to trigger territorial applicability under Article 3(2)(b). And applicability means the obligation to appoint an EU representative (Article 27), maintain a record, respond to data subject rights, notify breaches to the CNPD.

What 'monitoring of behaviour' actually covers

EDPB Guidelines 03/2018 on territorial scope clarify that monitoring is not limited to classic advertising tracking. Are concerned:

Non-strictly-necessary audience measurement cookies and browser fingerprinting.
Geolocation SDKs embedded in mobile applications distributed in the EU.
Behavioural profiling for credit scoring, insurance scoring or product recommendation.
Social media monitoring for sentiment analysis or targeted reputation watch.
Smart cameras with facial analysis, connected CCTV, IoT presence sensors.
A/B testing tools and session-recording heatmaps (Hotjar, FullStory and similar).

The criterion is not the intention to target the EU, but the objective fact that persons located in the Union are being profiled. A Singapore-based publisher who leaves its website accessible from Luxembourg and drops a retargeting cookie falls within scope.

How Luxgap automates this risk

Our Luxgap Extraterritorial Radar reverses the usual logic: instead of asking your DPO to list your non-EU vendors, it continuously scans your public websites, mobile apps and outbound flows to detect which foreign actors profile your European visitors, and which foreign actors you are profiling without knowing it through your own marketing tools. The radar combines a lightweight JS snippet on your domains, analysis of your Android/iOS app manifests, and correlation with ENISA, EDPB and IAB Europe databases to qualify each detected tracker.

Scans your sites and applications every 24h and detects every new third-party pixel, SDK or tracker established outside the EU that triggers Article 3(2)(b).
Qualifies each detected actor: country of establishment, presence of an Article 27 EU representative, claimed legal basis, transfer mechanism (SCC, DPF, BCR).
Detects outbound flows from your internal systems (CRM, marketing automation, analytics) to non-EU recipients and reconstructs the transfer cartography.
Produces a cryptographically sealed timestamped PDF report that demonstrates your vigilance under recital 24, defensible during a CNPD audit.
Sends instant Teams or Slack alerts when your marketing team adds a new tracking script without prior DPO validation.
Pre-fills the Article 27 EU representative mandate for non-EU sub-processors required to appoint one.

Available as a complement to a Luxgap DPO mandate or as a standalone SaaS module depending on your scope. Request your demonstration and our teams perform a free 48h scan of your sites and applications to concretely materialise the non-EU actors already profiling your European visitors.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 24

They trust us

Before we chat