The classic trap
Recital 96 targets a frequently overlooked audience: ministries, municipalities, public bodies and regulators that draft a bill, a grand-ducal regulation, a ministerial order or even a sector convention imposing data processing. The CNPD must be consulted upstream, during the drafting phase, not after the text has been voted. In practice, many projects reach the CNPD 15 days before ministerial signature, which makes the opinion purely cosmetic and exposes the text to later challenges for lack of a valid legal basis under Article 6(1)(c) or (e) GDPR.
When to trigger CNPD consultation under recital 96
- Any bill or grand-ducal regulation that imposes, authorises or organises personal data processing (registries, sectoral files, interadministrative exchanges).
- Any data-sharing convention between public authorities (Ministry of Interior, social security, employment agency, municipalities, tax administration).
- Any ministerial order creating a public service portal, citizen platform or state-issued mobile application.
- Any emergency measure (health, security) involving exceptional data collection, even temporary.
- Any amendment to an existing text that broadens the purpose, adds a recipient or extends the retention period.
This consultation works in tandem with Article 36(4) GDPR, which makes the referral mandatory for public authorities. The CNPD opinion must be attached to the legislative file submitted to the Conseil d'Etat, otherwise the legal basis of the processing is weakened.
How Luxgap automates this risk
Our Luxgap Legislative Impact Scanner turns recital-96 consultation into an automatic reflex for administrations and regulated bodies that co-draft sectoral texts. The tool ingests your draft (PDF, Word, OpenDocument), uses a specialised LLM agent to detect provisions that imply personal data processing, qualifies the envisaged legal basis and generates the CNPD referral package ready to send, with a preliminary impact analysis.
- Automatically analyses each article of the draft text and identifies passages that create, extend or modify a personal data processing operation.
- Qualifies the relevant legal basis (Article 6(1)(c), 6(1)(e), 9(2)) and flags inconsistencies between the stated purpose and the data categories collected.
- Generates the CNPD prior consultation form pre-filled, with a proportionality analysis and a table of planned mitigation measures.
- Compares your draft against historical public CNPD opinions on similar texts and flags points that have triggered observations in the past.
- Tracks the legislative calendar and alerts the legal team if the CNPD referral has not been initiated 90 days before submission to the Conseil d'Etat.
- Produces a timestamped, opposable PDF report demonstrating that recital 96 and Article 36(4) have been respected in the process.
Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on one of your ongoing draft texts, with a free 48h white audit to measure your exposure before any commitment.
