The glossary to understand and take action

National Commission for Data Protection (CNPD)

The CNPD is Luxembourg's data protection supervisory authority. It provides information, carries out supervision and, in particular, handles complaints within its area of competence.

Administration ou organisme professionnel · Luxembourg Fiduciaries Editorial Team · Reviewed on

Understand the scope

Its role for your business

Consulting its recommendations does not constitute individual validation of all of the company's processing activities. The controller retains its obligations and must be able to explain its choices.

In your file

When to contact them and what to prepare

Use the CNPD's resources to structure information for individuals, the management of rights and the analysis of processing activities. Certain situations, such as a data breach, require a prompt assessment of notification obligations. Prepare the facts and the processing documentation before seeking an opinion or responding to an inspection.

A scenario to help you understand

Educational example

An SME reviews its customer file and IT contracts based on the data protection principles published by the CNPD.

Fictitious situation, presented to illustrate the concept.

Prepare for what comes next

Points to check

  • Recenser les traitements concernés
  • Documenter les mesures prises
  • Identifier les procédures de droits et d’incident

Connecting concepts

Terms to know as well

Continue with the concepts, contacts and procedures related to this topic.

GDPR — protection of personal dataThe General Data Protection Regulation governs the processing of personal data within its scope of application.Processor within the meaning of the GDPRThe processor processes personal data on behalf of a controller, within the framework of the applicable instructions and conditions.Notification of a personal data breachA data breach may affect the confidentiality, integrity or availability of data. The controller must assess the incident and the notification obligations provided for by the GDPR.Data minimisationA principle consisting of limiting the personal data used to what is necessary for the intended purpose.Reporting OfficeThe Reporting Office provides information and guidance in connection with the protection of persons reporting breaches of law. Its role forms part of Luxembourg's whistleblower protection framework.

Put it into practice

Explore further with our guides

Practical guidePersonal data and fiduciary services: governing document exchanges

Sources and verification

References consulted on 20 September 2026. Official procedures specify the applicable conditions and exceptions.

This guide explains a general process. The applicable rules depend on your situation; it does not constitute personalised advice. Report a correction.

A definition gives you a reference point. To examine your situation, clarify your question with a professional.