🇱🇺Law of 1 August 2018 Organising the CNPD and Implementing the GDPR

← Back to laws in Luxembourg

Law of 1 August 2018 Organising the CNPD and Implementing the GDPR

Luxembourg applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Law organises the CNPD, extends selected GDPR rules outside the Regulation and adds Luxembourg rules for expression, research, special-category data, professional secrecy and workplace surveillance.

National additions and variations

• Article 62 creates targeted journalism and expression derogations but confines special and criminal-data relief to data made manifestly public or directly connected with public life or voluntary public involvement.
• Articles 63-65 condition research and statistics rights derogations on serious impairment and a documented safeguards programme including a DPO, DPIA, separation, encryption, logging, access limits, training and independent audit.
• Article 66 prohibits genetic-data processing to exercise controller rights in employment and insurance.
• Article 67 preserves professional-secrecy procedures when the CNPD exercises access powers against lawyers, notaries and statutory auditors.
• Article 71 amends Labour Code Article L.261-1 to require a GDPR basis, advance worker-representation information, purpose and retention details, and a process for prior CNPD review of workplace surveillance.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.