Recital 95
General Data Protection Regulation · UE 2016/679
| (95) | The processor should assist the controller, where necessary and upon request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and from prior consultation of the supervisory authority. |
In Luxembourg, the Article 36 prior consultation is filed with the CNPD (not APDL), which has issued guidance on DPIA thresholds for regulated sectors (health, finance, HR). The law of 1 August 2018 organising the CNPD specifies the authority's investigative powers, which can directly require technical evidence from a Luxembourg-based processor.
Luxgap practice: for CSSF-regulated entities, anticipate that the CNPD coordinates its requests with CSSF Circular 22/806 on outsourcing arrangements, multiplying the documentation required during a prior consultation.
