I need to bring my Luxembourg organisation into compliance with recital 55 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 55 grounds the legitimacy of personal data processing by public authorities for the benefit of officially recognised religious associations on public interest. The classic trap sanctioned by the CNPD and CNIL is extending this legal basis beyond its strict scope: transmitting parish files for non-religious purposes, cross-matching with administrative databases without explicit legal framework, or failing to qualify the religious versus civil purpose precisely. The EDPB reminds in its guidelines on Article 6(1)(e) that public interest must be anchored in an identifiable national or international norm, not in implicit administrative practice.How to correctly qualify a religious processing of public interestIdentify the precise normative basis: concordat, convention, official recognition law of the religious denomination, international treaty.Define the scope of the data concerned: baptism registers, electoral lists of a church council, religious contributions versus private pastoral data.Document the purpose: achievement of a constitutional or international public law objective, not mere administrative convenience.Verify the public authority status of the sender: municipality, ministry of religious affairs, registration administration.Frame any outgoing transmission by a separate Article 9 analysis (data revealing religious beliefs) in addition to Article 6.Trace the complete sender-recipient-purpose chain in the Article 30 record of processing activities.In Luxembourg, six religions are conventioned (Catholic, Reformed Protestant, Protestant, Anglican, Jewish, Orthodox) and receive data via specific administrative channels. Any transmission outside this conventional framework must be justified article by article.How Luxgap automates this riskOur Luxgap Public Interest Mapper automatically maps each processing based on public interest and links it to its precise normative basis, eliminating vague justifications such as unsourced 'public service mission'. The tool scans your Article 30 record, your conventions with recognised religions and the constitutional and international texts applicable in Luxembourg to materialise the legitimacy chain of each data flow to or from an officially recognised religious association.Automatically detects each processing in your record invoking public interest without a precise normative reference and triggers a compliance alert.Classifies each flow between public authority and religious association according to the actual legal basis: convention, concordat, recognition law, international treaty.Generates a qualification rationale enforceable before the CNPD, demonstrating the articulation between Article 6(1)(e), Article 9(2)(d) and the Luxembourg constitutional framework.Alerts in real time if a new data flow to a religious entity appears in your connected systems (business IS, administrative exchange platforms).Produces a timestamped PDF report, enforceable during a CNPD audit, demonstra...

Recital 55 GDPR — Recital 55 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 55

General Data Protection Regulation · UE 2016/679

(55)	Moreover, the processing of personal data by official authorities for the purpose of achieving the aims, laid down by constitutional law or by international public law, of officially recognised religious associations, is carried out on grounds of public interest.

Luxembourg specificity

loi luxembourgeoise du 13 février 2018 portant organisation des cultes conventionnés

In Luxembourg, six religious denominations are officially recognised by convention with the State (Catholic, Reformed Protestant, Protestant, Anglican, Jewish, Orthodox) under the Law of 13 February 2018 on the organisation of conventioned religions, which replaced the historical concordat regime. The CNPD has exclusive jurisdiction to supervise processing carried out by public authorities for the benefit of these religions, and requires strict traceability of the legal basis invoked for each flow.

Luxgap practice: we recommend that municipalities, church councils and central administrations explicitly map each religious data flow against the 2018 law and the applicable convention, and document the dual basis Article 6(1)(e) plus Article 9(2)(d) in the record.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 55 grounds the legitimacy of personal data processing by public authorities for the benefit of officially recognised religious associations on public interest. The classic trap sanctioned by the CNPD and CNIL is extending this legal basis beyond its strict scope: transmitting parish files for non-religious purposes, cross-matching with administrative databases without explicit legal framework, or failing to qualify the religious versus civil purpose precisely. The EDPB reminds in its guidelines on Article 6(1)(e) that public interest must be anchored in an identifiable national or international norm, not in implicit administrative practice.

How to correctly qualify a religious processing of public interest

Identify the precise normative basis: concordat, convention, official recognition law of the religious denomination, international treaty.
Define the scope of the data concerned: baptism registers, electoral lists of a church council, religious contributions versus private pastoral data.
Document the purpose: achievement of a constitutional or international public law objective, not mere administrative convenience.
Verify the public authority status of the sender: municipality, ministry of religious affairs, registration administration.
Frame any outgoing transmission by a separate Article 9 analysis (data revealing religious beliefs) in addition to Article 6.
Trace the complete sender-recipient-purpose chain in the Article 30 record of processing activities.

In Luxembourg, six religions are conventioned (Catholic, Reformed Protestant, Protestant, Anglican, Jewish, Orthodox) and receive data via specific administrative channels. Any transmission outside this conventional framework must be justified article by article.

How Luxgap automates this risk

Our Luxgap Public Interest Mapper automatically maps each processing based on public interest and links it to its precise normative basis, eliminating vague justifications such as unsourced 'public service mission'. The tool scans your Article 30 record, your conventions with recognised religions and the constitutional and international texts applicable in Luxembourg to materialise the legitimacy chain of each data flow to or from an officially recognised religious association.

Automatically detects each processing in your record invoking public interest without a precise normative reference and triggers a compliance alert.
Classifies each flow between public authority and religious association according to the actual legal basis: convention, concordat, recognition law, international treaty.
Generates a qualification rationale enforceable before the CNPD, demonstrating the articulation between Article 6(1)(e), Article 9(2)(d) and the Luxembourg constitutional framework.
Alerts in real time if a new data flow to a religious entity appears in your connected systems (business IS, administrative exchange platforms).
Produces a timestamped PDF report, enforceable during a CNPD audit, demonstrating control of your Article 6(1)(e) scope applied to religious associations.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual record, with a free 48h white audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 55

They trust us

Before we chat