I need to bring my Luxembourg organisation into compliance with recital 73 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 73 opens the door to national restrictions provided for by article 23 GDPR: public security, criminal investigations, economic interests of the State, public registers, public health. The trap is that many organisations think they can rely on it directly (banks invoking banking secrecy, HR invoking an internal investigation, hospitals invoking general interest). The CNPD and CNIL regularly sanction refusals of access requests justified by a restriction that exists in no precise legislative text: a restriction must rest on a clear legal basis, necessary and proportionate, not on an internal assessment.The legality test of an invoked restrictionIdentified legal basis: the restriction must appear in a text of Union or Member State law (statute, regulation), not in an internal policy or terms of service.Limitative purpose: the restriction must serve one of the purposes of recital 73 (public security, crime prevention, major economic interest, public register, public health, protection of others).Necessity and proportionality: demonstrable through a written analysis. A systematic blocking of all rights without case-by-case examination is almost always disproportionate.Charter and ECHR compliance: the essence of the fundamental right must be preserved.Information of the data subject: unless this information would compromise the very purpose of the restriction, article 23(2) requires notification.Traceability: each refusal or limitation must be documented with the legal basis invoked and the proportionality reasoning.In Luxembourg, the most frequently invoked restrictions concern the law of 12 November 2004 (AML/CFT, prudential banking secrecy), the law of 25 March 2020 on the criminal record, and certain tax provisions. Each must be precisely mapped.How Luxgap automates this riskOur Luxgap Restriction Justifier turns the vague invocation of a legal restriction into an opposable, signed and timestamped argument, ready to be produced before the CNPD in case of complaint. The tool embeds a specialised AI agent that reads the data subject request received (access, erasure, objection), queries your processing mapping and proposes within 60 seconds the precise legal basis applicable to a partial or total refusal, with a documented proportionality test.Automatically classifies each incoming rights request received via web form, DPO mail or helpdesk ticket, and links it to the relevant processing activity in your article 30 register.Detects invocable restriction grounds by cross-referencing the processing with a knowledge base of Luxembourg, French and Belgian laws transposing article 23 GDPR.Generates a pre-formatted proportionality argument that demonstrates necessity, the absence of a less intrusive alternative and respect for the essence of the right, in line with EDPB guidelines 10/2020.Produces the reasoned response to send to the data subject, in the language of the request, with the mandatory remedies (CNPD complaint, judicia...

Recital 73 GDPR — Recital 73 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 73

General Data Protection Regulation · UE 2016/679

(73)

Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.

Luxembourg specificity

loi luxembourgeoise du 1er août 2018 relative a la protection des personnes physiques a l'egard du traitement des donnees a caractere personnel

In Luxembourg, the law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data sets out the restrictions applicable to articles 12 to 22 GDPR, in particular for scientific, statistical and archival processing (articles 63 to 65). The law of 12 November 2004 on anti-money laundering adds a non-disclosure (tipping-off) obligation that restricts the right of information and access when a suspicious transaction report is filed with the CRF.

Luxgap practice: before invoking a restriction in response to a rights request, systematically verify the precise Luxembourg legal basis (article and law) and document the proportionality test in a memo signed by the DPO, opposable in case of complaint before the CNPD.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 73 opens the door to national restrictions provided for by article 23 GDPR: public security, criminal investigations, economic interests of the State, public registers, public health. The trap is that many organisations think they can rely on it directly (banks invoking banking secrecy, HR invoking an internal investigation, hospitals invoking general interest). The CNPD and CNIL regularly sanction refusals of access requests justified by a restriction that exists in no precise legislative text: a restriction must rest on a clear legal basis, necessary and proportionate, not on an internal assessment.

The legality test of an invoked restriction

Identified legal basis: the restriction must appear in a text of Union or Member State law (statute, regulation), not in an internal policy or terms of service.
Limitative purpose: the restriction must serve one of the purposes of recital 73 (public security, crime prevention, major economic interest, public register, public health, protection of others).
Necessity and proportionality: demonstrable through a written analysis. A systematic blocking of all rights without case-by-case examination is almost always disproportionate.
Charter and ECHR compliance: the essence of the fundamental right must be preserved.
Information of the data subject: unless this information would compromise the very purpose of the restriction, article 23(2) requires notification.
Traceability: each refusal or limitation must be documented with the legal basis invoked and the proportionality reasoning.

In Luxembourg, the most frequently invoked restrictions concern the law of 12 November 2004 (AML/CFT, prudential banking secrecy), the law of 25 March 2020 on the criminal record, and certain tax provisions. Each must be precisely mapped.

How Luxgap automates this risk

Our Luxgap Restriction Justifier turns the vague invocation of a legal restriction into an opposable, signed and timestamped argument, ready to be produced before the CNPD in case of complaint. The tool embeds a specialised AI agent that reads the data subject request received (access, erasure, objection), queries your processing mapping and proposes within 60 seconds the precise legal basis applicable to a partial or total refusal, with a documented proportionality test.

Automatically classifies each incoming rights request received via web form, DPO mail or helpdesk ticket, and links it to the relevant processing activity in your article 30 register.
Detects invocable restriction grounds by cross-referencing the processing with a knowledge base of Luxembourg, French and Belgian laws transposing article 23 GDPR.
Generates a pre-formatted proportionality argument that demonstrates necessity, the absence of a less intrusive alternative and respect for the essence of the right, in line with EDPB guidelines 10/2020.
Produces the reasoned response to send to the data subject, in the language of the request, with the mandatory remedies (CNPD complaint, judicial review).
Archives each decision in a cryptographically sealed log, opposable during an inspection or CNPD mediation.
Alerts the DPO when a restriction is invoked at an abnormal rate on the same processing, a signal of possible systemic abuse to correct.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real rights requests, with a free 48h blind audit to identify restrictions currently invoked without a solid legal basis.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 73

They trust us

Before we chat