I need to bring my Luxembourg organisation into compliance with recital 31 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 31 GDPR — Recital 31 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 31

General Data Protection Regulation · UE 2016/679

(31)

Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation units, independent administrative authorities, or financial market authorities responsible for the regulation and supervision of securities markets should not be regarded as recipients if they receive personal data which are necessary to carry out a particular inquiry in the general interest, in accordance with Union or Member State law. The requests for disclosure sent by the public authorities should always be in writing, reasoned and occasional and should not concern the entirety of a filing system or lead to the interconnection of filing systems. The processing of personal data by those public authorities should comply with the applicable data-protection rules according to the purposes of the processing.

Luxembourg specificity

loi modifiee du 12 novembre 2004 relative a la lutte contre le blanchiment et loi du 5 avril 1993 relative au secteur financier

In Luxembourg, requisitions from tax authorities (ACD, AED) and the FIU (Cellule de Renseignement Financier) are framed by the law of 25 March 2020 on automatic exchange of information and the amended law of 12 November 2004 on anti-money laundering. The CSSF also has extensive requisition powers under the law of 5 April 1993 on the financial sector. Local specificity: FIU requests benefit from a presumption of lawfulness but must imperatively be written and reasoned, otherwise the reporting professional's liability is engaged.

Luxgap practice: configure the Gatekeeper with official CSSF, ACD and FIU requisition templates in library, to distinguish in 10 seconds a compliant request from an out-of-scope one, and systematically retain proof of the occasional nature to avoid requalification as an undeclared structural flow to the CNPD.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 31 creates a subtle but dangerous nuance: a public authority (tax administration, financial intelligence unit, CSSF, customs) requesting data for a specific inquiry is not a recipient within the GDPR meaning. But this does NOT exempt the controller from verifying the lawfulness of the request. The CNPD and CNIL regularly sanction companies that disclosed entire files to an authority without a written reasoned request, or that accepted verbal requisitions over the phone, thereby turning a theoretically legitimate request into an unlawful transfer engaging their own liability.

The 4 cumulative conditions of a valid public authority request

Written: an official email, a signed paper requisition, a bailiff act. Never a phone call, never an SMS, never a verbal request in a meeting.
Reasoned: the request must cite the precise legal basis (article of the tax code, criminal procedure code, CSSF law) and the purpose of the inquiry.
Occasional: an automated monthly flow to an authority is NOT occasional, it falls under another legal basis (recurring legal obligation such as DAC, FATCA, CRS).
Targeted: never the entirety of a client file, never a full HR database extraction. Always on an identified scope (one person, one account, one period).

If any of these conditions is missing, you must refuse or request a written regularisation before transmission. Such refusal is not only lawful but protects your liability under article 5(1)(a) (lawfulness).

How Luxgap automates this risk

Our Luxgap Authority Request Gatekeeper turns every public authority requisition into an opposable, timestamped and traced file, and automatically blocks transmissions that do not meet the 4 cumulative conditions of recital 31. The tool sits between your dpo@ or legal@ inbox and your operational team: a legal AI agent analyses each incoming request (email, scanned letter, PDF requisition) and qualifies in 60 seconds the legal basis, the scope, the occasional nature and the cited motivation.

Detects incoming requisitions automatically via Microsoft 365, Gmail, Outlook and DMS connectors (M-Files, SharePoint, Alfresco), without altering your existing workflows.
Classifies each request by its presumed legal basis (LU tax code, CSSF law, criminal procedure code, GDPR article 6(1)(c)) and flags off-scope demands.
Blocks transmission until the 4 conditions of recital 31 are validated and automatically generates the regularisation request letter to send back to the authority.
Produces a cryptographically sealed register of every requisition received, refused or honoured, opposable to the CNPD during an accountability audit under article 5(2).
Alerts the DPO in real time via Teams or Slack whenever a request targets an entire filing system or leads to a prohibited interconnection.
Pre-drafts the response to the authority with the minimal scope automatically extracted from your databases, respecting the minimisation principle of article 5(1)(c).

Available as a complement to a Luxgap DPO mandate or as a standalone SaaS module depending on your requisition volume. Request a tailored quote and our teams will prepare a demonstration on your actual requisitions from the past 12 months, with a free blind audit within 48h to identify past transmissions that should have been refused.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 31

They trust us

Before we chat