Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Luxembourg enforces GDPR through the CNPD and only recently completed its delayed NIS2 transposition, the Law of 5 May 2026, entering into force 10 May 2026 and supervised by the Institut Luxembourgeois de Régulation (ILR).
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Directly applicable EU regulation; sets the 72-hour breach notification standard and the €20m/4% fine cap uniformly across the EEA.
SourceLuxembourg's supplementary GDPR legislation, repealing the amended Act of 2 August 2002 and establishing the CNPD's organization and Article 58 investigative powers.
SourceLuxembourg's NIS2 transposition, in force since 10 May 2026, roughly 19 months after the EU's 17 October 2024 deadline, making it one of the last member states to complete transposition. Applies to entities with 50+ employees or over €10m annual turnover across the 18 NIS2 sectors.
Source72 hours
Controllers must notify the CNPD without undue delay and, where feasible, within 72 hours of becoming aware of a breach, per GDPR Article 33.
Notify: CNPD (Commission Nationale pour la Protection des Données)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Only recently transposed: the Law of 5 May 2026 entered into force on 10 May 2026, roughly 19 months late against the EU's 17 October 2024 deadline, making Luxembourg one of the last member states to complete transposition. The Institut Luxembourgeois de Régulation (ILR) is the designated competent authority; in-scope entities had to register by 10 July 2026.
SourceCommission Nationale pour la Protection des Données(CNPD)
Visit authority siteThe CNPD (Commission Nationale pour la Protection des Données), within 72 hours of becoming aware of the breach where feasible, per GDPR Article 33.
Yes, but late, the Law of 5 May 2026 entered into force on 10 May 2026, about 19 months after the EU's original 17 October 2024 deadline, making Luxembourg one of the last EU member states to complete transposition.
The Institut Luxembourgeois de Régulation (ILR), which operates the online registration portal. This is separate from the CNPD, which remains the GDPR/data-protection authority.
Talk to us about scoping an engagement around your specific regulatory context.
