I need to bring my Luxembourg organisation into compliance with recital 90 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 90 GDPR — Recital 90 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 90

General Data Protection Regulation · UE 2016/679

(90)

In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.

Luxembourg specificity

loi luxembourgeoise du 1er août 2018 portant organisation de la CNPD et décision CNPD du 16 octobre 2018 sur la liste des traitements soumis à AIPD

In Luxembourg, the CNPD has issued its own list of processings requiring a mandatory DPIA (decision of 16 October 2018), which complements the EDPB criteria with cases specific to the Luxembourg economic fabric (cross-border processings, financial big data, systematic HR profiling). The law of 1 August 2018 organising the CNPD further confirms the authority's injunction power, allowing it to require the production of a DPIA during an inspection, even after the fact.

Luxgap practice: for any high-risk processing operated by a Luxembourg entity (private bank, CSSF fintech, CAA insurer, investment fund), we systematically align the DPIA template with the CNPD list of 16 October 2018, and not solely with the EDPB criteria, to ensure direct enforceability during inspections.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

A botched DPIA is one of the findings most frequently raised by the CNPD and CNIL during inspections. Recital 90 makes clear the assessment must be carried out prior to processing, ruling out DPIAs drafted after the fact to fill a file. Another recurring trap: a DPIA that describes the processing but assesses neither the likelihood nor the severity of the risk, or that lists generic measures without demonstrating their actual mitigation effect. The EDPB (WP248 rev.01 guidelines) insists on a demonstrable and defensible reasoning chain.

What recital 90 concretely requires of your DPIA

Anteriority: the DPIA must be dated before the processing goes live, ideally before architecture choices (privacy by design, article 25).
Two-axis evaluation: likelihood AND severity for data subjects, not only for the company.
Identified risk sources: internal (malicious insider, error), external (attacker, failing processor), accidental (loss, misconfiguration).
Quantified mitigation measures: each measure must lower likelihood or severity by a measurable degree, with justification.
Safeguards for data subjects: enhanced information, objection mechanisms, pseudonymisation, effective minimisation.
Compliance demonstration: the DPIA is itself an accountability artefact under article 5(2), it must be presentable as-is to the CNPD.
Iteration: review on every significant change (new processor, new purpose, new hosting country).

How Luxgap automates this risk

Our Luxgap DPIA Reasoner turns the DPIA from a 40-page Word document written once a year into a living, defensible and reproducible reasoning chain. The tool embeds a specialised LLM agent that queries your records of processing, your Microsoft Purview maps, your Azure flows and your processor contracts in Odoo to automatically build the risk scenario, following the CNIL PIA methodology and EDPB WP248 guidelines.

Automatically detects processings that cross the EDPB criteria thresholds (systematic evaluation, large-scale sensitive data, surveillance, matching) and triggers a mandatory DPIA before go-live.
Computes the likelihood x severity matrix for each threat scenario by cross-referencing your actual security posture (Defender vulnerabilities, Azure configurations, processor certifications) with ENISA and MITRE ATT&CK threat bases.
Generates the full timestamped and cryptographically sealed DPIA report, structured along the template expected by the CNPD, with full traceability of assumptions and sources.
Proposes for each high residual risk the quantified mitigation measures and their expected effect, citing applicable standards (ISO 27001, ANSSI, NIST).
Alerts in real time via Teams or Slack as soon as a material change occurs (new processor, new purpose, transfer outside the EU) and triggers the update of the relevant DPIA.
Produces the article 36 prior consultation file ready to submit to the CNPD when residual risk remains high.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on one of your actual high-risk processings, with a free white audit within 48h to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 90

They trust us

Before we chat