Data protection & privacy laws in Luxembourg (2026)

Luxembourg's data protection authority published a reflection on a decade of the GDPR, reaffirming its role enforcing the regulation and supporting compliance. It signals continuity of the GDPR-based framework as the country's core privacy regime.

Luxembourg's Administrative Court overturned the record €746 million fine, finding the CNPD had not analysed Amazon's intent/negligence nor whether a fine was proportionate, while upholding that Amazon's 'legitimate interests' basis and information practices breached the GDPR. The case was sent back to the regulator for reassessment.

The CNPD sanctioned a major bank for failing to meet GDPR deadlines for handling access requests; an initial €493,560 penalty was reduced to €175,000. It underscored the authority's focus on enforcing data-subject rights timelines.

The CNPD fined Amazon Europe Core S.à r.l. €746 million for processing personal data for targeted advertising without valid consent — the largest GDPR fine ever at the time, stemming from a 2018 complaint by La Quadrature du Net. It established Luxembourg's regulator as a major enforcer for the EU-headquartered tech sector.

This law reorganised the CNPD and laid down the national rules complementing the GDPR, repealing the 2002 Act. It is the foundation of Luxembourg's current data-protection regime, granting the CNPD investigative and fining powers (up to €20M or 4% of global turnover).

EU Regulation 2016/679 (GDPR) took direct effect across the EU, replacing the 2002 Act as the principal data-protection instrument in Luxembourg. It introduced expanded data-subject rights, accountability obligations, and far higher sanctions.

Transposing the ePrivacy Directive 2002/58/EC, this Act set sector-specific rules on cookies (consent), direct marketing, traffic/location data, and breach notification by communications providers. It remains the basis for cookie and electronic-marketing rules in Luxembourg.

Transposing the EU Data Protection Directive 95/46/EC, this Act (in force 1 December 2002) established the National Commission for Data Protection (CNPD) as an independent authority and set general processing rules. It was the country's first comprehensive privacy law in the modern sense.

Luxembourg's earliest data-protection statute governed the digital identification of natural and legal persons and the use of nominative data in automated processing. It marked the country's first legal recognition of data-protection concerns, later repealed by the 2002 Act.