Law: Act of 1 August 2018 on the Organisation of the National Commission for Data Protection and Implementing the GDPR (the Act) and the General Data Protection Regulation (Regulation (EU) 2016/679)

Regulator: National Commission for Data Protection (CNPD)

Summary: Luxembourg implemented the GDPR in 2018 through the Act of 1 August 2018 on the Organization of the National Commission for Data Protection and Implementing the GDPR (the Act). The GDPR is therefore directly applicable with regards to data subject rights and data controller and data processor obligations as well as data transfers. The Act establishes the National Commission for Data Protection (CNPD) and details its investigatory and enforcement powers. Moreover, the Act contains several express permissions to derogate from the GDPR where personal data is processed for scientific or historical research purposes or for statistical purposes, and prohibits the processing of genetic data for the purposes of the exercise of rights of the data controller in the insurance sector and in relation to employment. The CNPD frequently advises the legislator on privacy aspects and has issued opinions on legal reforms regarding data transparency, anti-money laundering, insurance, and financial trusts.