The glossary to understand and take action

Reporting Office

The Reporting Office provides information and guidance in connection with the protection of persons reporting breaches of law. Its role forms part of Luxembourg's whistleblower protection framework.

Administration ou organisme professionnel · Luxembourg Fiduciaries Editorial Team · Reviewed on

Understand the scope

Its role for your business

A distinction must be made between guidance provided by the Office, an internal company channel and the external authority competent for the breach concerned. Not every commercial complaint automatically falls within this framework.

In your file

When to contact them and what to prepare

The company must verify its own obligations regarding reporting channels and organise confidentiality. Persons responsible for receiving alerts must know the processing workflow and applicable rules. Indiscriminate collection or broad disclosure of identities compromises the expected protection.

A scenario to help you understand

Educational example

A company prepares its internal procedure and identifies the authorised recipients, follow-up arrangements and information to be provided to employees.

Fictitious situation, presented to illustrate the concept.

Prepare for what comes next

Points to check

  • Vérifier le champ du dispositif
  • Organiser la confidentialité
  • Identifier les autorités compétentes

Connecting concepts

Terms to know as well

Continue with the concepts, contacts and procedures related to this topic.

GDPR — protection of personal dataThe General Data Protection Regulation governs the processing of personal data within its scope of application.Data minimisationA principle consisting of limiting the personal data used to what is necessary for the intended purpose.Corporate secretarial servicesCorporate secretarial services organise the documents and formalities linked to the life of a company: decisions, registers and filings according to its regime.Processor within the meaning of the GDPRThe processor processes personal data on behalf of a controller, within the framework of the applicable instructions and conditions.National Commission for Data Protection (CNPD)The CNPD is Luxembourg's data protection supervisory authority. It provides information, carries out supervision and, in particular, handles complaints within its area of competence.Notification of a personal data breachA data breach may affect the confidentiality, integrity or availability of data. The controller must assess the incident and the notification obligations provided for by the GDPR.

Put it into practice

Explore further with our guides

Practical guidePersonal data and fiduciary services: governing document exchanges

Sources and verification

References consulted on 20 September 2026. Official procedures specify the applicable conditions and exceptions.

This guide explains a general process. The applicable rules depend on your situation; it does not constitute personalised advice. Report a correction.

A definition gives you a reference point. To examine your situation, clarify your question with a professional.