Recital 85
General Data Protection Regulation · UE 2016/679
| (85) | A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay. |
In Luxembourg, the competent authority for notification is the CNPD (not APDL), via its dedicated data breach electronic portal. The law of 1 August 2018 organising the CNPD confirms the 72h delay and the option of phased notification. For CSSF-regulated financial actors, dual notification applies: CNPD under the GDPR and CSSF under circular 24/847 on ICT incidents (DORA), with distinct deadlines and forms that must not be confused.
Luxgap practice: our Breach Clock automatically routes each incident to the CNPD, the CSSF or both depending on the entity qualification (PSF, credit institution, insurance, NIS 2 essential entity), and stores timestamped acknowledgements from both authorities in an opposable vault.
