The glossary to understand and take action

GDPR — protection of personal data

The General Data Protection Regulation governs the processing of personal data within its scope of application.

Notion comptable, fiscale ou juridique · Luxembourg Fiduciaries Editorial Team · Reviewed on

Understand the scope

Definition and points to distinguish

It requires an examination of purposes, legal bases, information, rights and security. Having a written policy is not enough: the organisation and tools must correspond to the described practices.

In your file

What this changes in practice

The GDPR governs the processing of personal data: customers, employees or business contacts may be concerned. Compliance starts with identifying the purposes, necessary data and appropriate legal bases. Consent is not the only possible basis and does not resolve all obligations. Information for individuals, retention periods, rights and security must be organised in day-to-day practices.

A scenario to help you understand

Educational example

A company creates a prospect database. It defines its use, checks the applicable rules and provides for clear information as well as the handling of individuals’ requests.

Fictitious situation, presented to illustrate the concept.

Prepare for what comes next

Points to check

  • Recenser les traitements
  • Justifier les données et durées
  • Organiser les droits et la sécurité

The practical question

Find out more

Faut-il demander le consentement pour tout traitement de données ?

Le RGPD prévoit plusieurs bases juridiques. Le choix dépend de la finalité et du contexte, et doit être fait avant le traitement. Un consentement inutile ou mal recueilli ne corrige pas une collecte excessive ou une conservation indéfinie. L’entreprise doit pouvoir expliquer sa base, informer les personnes et respecter les autres obligations qui restent applicables.

Connecting concepts

Terms to know as well

Continue with the concepts, contacts and procedures related to this topic.

Data minimisationA principle consisting of limiting the personal data used to what is necessary for the intended purpose.Processor within the meaning of the GDPRThe processor processes personal data on behalf of a controller, within the framework of the applicable instructions and conditions.National Commission for Data Protection (CNPD)The CNPD is Luxembourg's data protection supervisory authority. It provides information, carries out supervision and, in particular, handles complaints within its area of competence.LuxTrust — authentication and signatureLuxTrust provides means of identification, authentication and electronic signature in accordance with its products and services.Luxembourg Institute of Regulation (ILR)The ILR carries out regulatory tasks in several sectors, including electronic communications, energy, postal services and certain transport services, as well as cybersecurity responsibilities.Reporting OfficeThe Reporting Office provides information and guidance in connection with the protection of persons reporting breaches of law. Its role forms part of Luxembourg's whistleblower protection framework.

Put it into practice

Explore further with our guides

Practical guideDigitising accounting: documents, automation and human oversightPractical guideGDPR-CARPA: understanding the scope of GDPR certificationPractical guidePersonal data and fiduciary services: governing document exchanges

Sources and verification

References consulted on 20 September 2026. Official procedures specify the applicable conditions and exceptions.

This guide explains a general process. The applicable rules depend on your situation; it does not constitute personalised advice. Report a correction.

A definition gives you a reference point. To examine your situation, clarify your question with a professional.