--- title: "Luxembourg Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/luxembourg/ source_html: /jurisdictions/luxembourg/index.html description: "Luxembourg data protection and privacy regulation: 10 categories, 42 claims, updated 2026-10-25." generated_at: 2026-11-07T14:58:19Z content_sha256: 1cb6507b4772556af990c47dab6b10454086a40b5038ac4ce7c6c131ff30e25f generator: "fe-fleet/md-twin@1.0" --- # Luxembourg Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/luxembourg/), [World Payments](https://payments.gi/jurisdictions/luxembourg/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 42 claims · 29 sources in the cumulative register Download report (PDF) Expand all Luxembourg's Administrative Appeal Court overturned the CNPD's EUR 746 million fine against Amazon Europe Core on 13 March 2026, annulling the decision on procedural grounds: the court found the CNPD had failed to properly analyse intentionality or negligence in line with the Court of Justice of the European Union's Deutsche Wohnen line of authority. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Lawful Processing & Special Data, Sectoral Watch, Algorithmic, Biometric & Surveillance Governance (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=LUXEMBOURG)[Build Report](/reports/?j=LUXEMBOURG)[Compare](/compare/?j=LUXEMBOURG) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Commission Nationale pour la Protection des Données (CNPD) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 8 Probable · 2 Uncertain 10 Categories 0 Red categories 57 Sub-modules 42 Claims 6 Tier-1 sources Traffic-light mix 3 green 7 amber (sums to 10 rendered categories; click to filter) No red categories; 30 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Luxembourg is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Luxembourg’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,297 Full executive summary 464 ###### Latest update · 25 October 2026 #### Lead Signal Luxembourg's data-protection enforcement landscape remains anchored by the Administrative Court's judgment of 12 March 2026 (No. 52757C) in the Amazon case, the jurisdiction's largest and most consequential enforcement matter. The Court upheld the CNPD's underlying finding that Amazon could not rely on legitimate interest as a lawful basis for its behavioural-advertising processing, affirming the substantive privacy violation at the heart of the case. At the same time, the Court annulled the EUR746m fine itself, finding that the CNPD had failed to properly assess fault as required under Article 83 of the General Data Protection Regulation, applying the standard set out by the Court of Justice of the European Union in its C-807/21 and C-683/21 judgments. The matter has been remanded to the CNPD for a fault-compliant re-assessment of the penalty. The practical effect is that Luxembourg's single largest data-protection case remains open on the question that matters most to the company and to the market: what fine, if any, will ultimately be upheld once the CNPD re-examines fault under the corrected legal standard. This split outcome, substantive finding upheld, penalty annulled and remanded, illustrates a distinction that likely has implications well beyond this one case for how the CNPD approaches large-scale fines going forward. It confirms a legal duty on which it is understood to have been found wanting is one the CNPD will need to apply more rigorously before any future fine of comparable scale is imposed. #### Other Developments EU Data Act duties are now live or imminent in Luxembourg. The EU Data Act has applied directly in Luxembourg since 12 September 2025, and its access-by-design duty for connected products placed on the market has applied from 12 September 2026. A further duty, the abolition of cloud-switching charges, is due to take effect from 12 January 2027. Luxembourg filed implementing Bill No. 8809 on 28 July 2026, though whether this Bill designates a national competent authority or data coordinator for the Act has not been confirmed. CNPD's 2025 enforcement record shows sustained, if modest, activity. In 2025 the CNPD issued eight decisions following investigation, seven of which carried fines, together totalling EUR216,061, with individual penalties ranging from EUR1,277 to EUR175,000. The focus of this enforcement activity was principally transparency, data-minimisation and retention-limit failures, a different register of concern from the large-scale legitimate-interest question at issue in the Amazon matter. Separately, since the Law of 20 November 2025, Luxembourg has had a specific framework permitting class actions, including in the data-protection context, giving affected individuals a collective-redress route that did not previously exist in this form, although the precise statutory article establishing this framework has not been located. #### Cross-Monitor Connections Luxembourg's Draft Bill No. 8476 proposes assigning the CNPD responsibility as the national competent authority under the EU Artificial Intelligence Act, a designation whose adoption status remains unconfirmed; this question is more properly the subject of dedicated artificial-intelligence-focused tracking than of privacy-specific analysis, but it bears directly on how CNPD institutional capacity and mandate may evolve. The EU Data Act's phased duties, including the cloud-switching-charge abolition due in January 2027, likewise connect to broader commercial and competition-focused monitoring of cloud-services markets, an area more fully addressed outside this monitor's core remit. #### Outlook The central open question for Luxembourg's data-protection regime remains the CNPD's re-assessment of the Amazon fine under a fault-compliant standard; the eventual re-determined penalty, whatever figure it reaches, is likely to be closely watched as an indicator of how the CNPD applies the Article 83 fault standard clarified by the Court of Justice. Separately, Luxembourg's implementing Bill No. 8809 for the Data Act and Draft Bill No. 8476 on AI Act competent-authority designation both remain legislative questions whose resolution will materially shape the CNPD's institutional remit going into 2027, when the Data Act's cloud-switching-charge abolition and the broader AMLR-adjacent regulatory calendar converge. 2 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Luxembourg's Administrative Appeal Court overturned the CNPD's EUR 746 million fine against Amazon Europe Core on 13 March 2026, annulling the decision on procedural grounds: the court found the CNPD had failed to properly analyse intentionality or negligence in line with the Court of Justice of the European Union's Deutsche Wohnen line of authority. The case is remitted to the CNPD for reconsideration. Significantly, the CNPD has stated that the ruling's procedural annulment leaves intact its main substantive findings on unlawful behavioural-advertising practices; what is now unresolved is the fine's quantum, not the underlying finding of unlawful processing. This is Luxembourg's flagship GDPR enforcement outcome, and its remittal establishes a live procedural-rigour standard -- an explicit intentionality/negligence analysis -- that the CNPD must now satisfy before any reconsidered penalty can stand. The annulment does not resolve the underlying legal question of Luxembourg's compliance posture toward Amazon's advertising practices; it resolves a narrower procedural question about how the CNPD reached its penalty decision. For any controller relying on Luxembourg's one-stop-shop status under GDPR, the ruling is a reminder that even a substantively well-founded finding can be procedurally vulnerable if the regulator's decision-making record does not visibly address the intentionality-or-negligence question EU case law now requires. #### Other Developments CNPD concentrates 2025 enforcement attention on ROPA and video surveillance. The CNPD's enforcement focus in 2025 centred on the obligation to maintain records of processing activities and on GDPR compliance of video-surveillance systems, issuing seven corrective measures in total, including six fines ranging from EUR 1,277 to EUR 175,000. The concentration of enforcement attention on these two areas, rather than a broader sweep across all controller obligations, reflects a thematic-priority enforcement model. A new collective-redress framework enters force. The Law of 20 November 2025 introduced a specific framework allowing class actions in Luxembourg, a new procedural avenue relevant to any future collective claims against controllers or processors operating in the jurisdiction. CNPD joins EU-wide erasure-rights enforcement sweep. The CNPD joined the European Data Protection Board's 2025 Coordinated Enforcement Framework action on the right to erasure, following up with several organisations, aligning Luxembourg's data-subject-rights enforcement priorities with the wider EU coordinated approach. CNPD launches children's data-literacy toolkit. On 5 June 2026, the CNPD launched the "Leonora" toolkit at a Geesseknäppchen Forum event attended by two government ministers, targeting children's data-protection awareness. The initiative is non-binding but signals an active CNPD priority on data-protection literacy for a vulnerable population. #### Cross-Monitor Connections The Amazon fine annulment and its behavioural-advertising substance connect to the crypto and world-payments monitors only insofar as adtech-driven commercial data practices increasingly intersect with digital-payments and crypto-platform user-tracking architectures; no LU-specific finding this cycle ties the Amazon matter to either monitor directly, and no such cross-domain analysis is asserted here. The new collective-redress framework under the Law of 20 November 2025 is a procedural development relevant to how future claims might be aggregated against any controller or processor operating in Luxembourg, including financial or payments entities tracked by the financial-integrity and world-payments monitors, though no specific collective action has been identified this cycle. #### Outlook The central marker to watch is the CNPD's reconsideration of the Amazon matter: whether it can satisfy the Administrative Appeal Court's intentionality/negligence-analysis standard and re-impose a fine, and at what quantum, will determine whether Luxembourg's flagship enforcement outcome is ultimately vindicated or further reduced. The CNPD's continued ROPA and video-surveillance enforcement focus suggests these will remain live inspection priorities into the next cycle, and the new collective-redress framework's first practical use in a data-protection context would be a significant development to track. A second-source, tier-1 corroboration of the CNPD's exact enforcement-tracker figures would strengthen confidence in the precise 2025 enforcement tally, which currently rests on a tier-3 secondary summary of the CNPD's own report. Read full brief · 1297 words ###### Latest update · 25 October 2026 #### Regulatory Status Luxembourg's data-protection landscape is currently defined by the unresolved fine quantum in its largest enforcement case, the Amazon matter, in which the Administrative Court's 12 March 2026 judgment (No. 52757C) upheld the CNPD's finding that legitimate interest could not justify Amazon's behavioural-advertising processing, while annulling the EUR746m fine for failure to apply the Article 83 fault-assessment standard set out by the Court of Justice of the European Union, and remanding the matter to the CNPD. Alongside this, Luxembourg's broader enforcement activity in 2025 comprised eight decisions, seven with fines totalling EUR216,061, concentrated on transparency, minimisation and retention issues, a markedly different scale from the Amazon case. A new collective-redress mechanism, introduced by the Law of 20 November 2025, now permits class actions in the data-protection context, though its precise statutory basis and procedural scope were not confirmed. Two further legislative threads remain open. The EU Data Act has applied directly in Luxembourg since 12 September 2025, with its access-by-design duty now live and its cloud-switching-charge abolition due from 12 January 2027; Luxembourg's implementing Bill No. 8809, filed 28 July 2026, has not been confirmed to designate a national competent authority or data coordinator. Separately, Draft Bill No. 8476 would assign the CNPD responsibility as Luxembourg's competent authority under the EU Artificial Intelligence Act, but its adoption status remains unconfirmed. #### Outlook The CNPD's re-assessment of fault in the Amazon case is the most consequential pending determination in Luxembourg's data-protection regime, and its outcome will likely be read as an indicator of how rigorously the authority now applies the Article 83 fault standard. The resolution of the Data Act competent-authority question and the AI Act designation under Draft Bill No. 8476 will together shape the CNPD's institutional remit going into 2027, a period that also brings the Data Act's cloud-switching-charge abolition into effect. 1 earlier update not shown here. ###### Standing brief · as of 23 August 2026 #### Regulatory Status Luxembourg's data-protection enforcement environment intensified this cycle. The CNPD's flagship EUR 746 million fine against Amazon Europe Core was overturned on procedural grounds, with the matter remitted for reconsideration and its substantive behavioural-advertising findings confirmed. The CNPD's 2025 enforcement priorities concentrated on records-of-processing and video-surveillance compliance, yielding seven corrective measures including six fines, while the CNPD also joined an EU-wide coordinated enforcement action on the right to erasure and launched a children's data-literacy toolkit. A new collective-redress framework entered force via the Law of 20 November 2025. #### Outlook The CNPD's reconsideration of the Amazon matter is the central marker to watch, alongside whether the new collective-redress framework sees its first data-protection use and whether the CNPD's ROPA and video-surveillance enforcement focus continues into 2026. Read full brief · 464 words Key regulatory facts for Luxembourg Regulatory Dimension Luxembourg Standing Position Jurisdiction Luxembourg (LU) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 42 sourced findings) Regulator & Framework Core regulator, founding statute and territorial scope are well-evidenced from primary EDPB/EUR-Lex sources; registration/filing sub-module lacks a distinct LU-specific finding. Lawful Processing & Special Data Lawful bases, consent and special categories are solidly evidenced from EDPB primary guidance; pseudonymisation/anonymisation sub-module has no LU-specific finding. Data Subject Rights Strong enforcement-based evidence for access/rectification/erasure/objection; portability and deadlines sub-modules unevidenced. Controller/Processor Duties DPO and accountability sub-modules well evidenced; ROPA, joint-controller, GDPR-breach-notification and retention sub-modules unevidenced in this pass. Primary Instruments Cited EDPB, EUR-Lex (National Implementing Measure record), EDPB, CNPD, Luxembourg Official Instrument (cnpd.public.lu en-html) Last Confirmed / Updated 2026-10-25 (29 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Luxembourg: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Core regulator, founding statute and territorial scope are well-evidenced from primary EDPB/EUR-Lex sources; registration/filing sub-module lacks a distinct LU-specific finding. Primary framework Regulation (EU) 2016/679 (GDPR), as given domestic institutional effect by the Loi du 1er août 2018 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Green Core regulator, founding statute and territorial scope are well-evidenced from primary EDPB/EUR-Lex sources; registration/filing sub-module lacks a distinct LU-specific finding. #### Sub-modules (5) #### Regulator And AuthorityGreen CNPD, 15 Boulevard du Jazz, 4370 Belvaux, is Luxembourg's independent GDPR supervisory authority. Claims (3): - The Commission Nationale pour la Protection des Données (CNPD), based at 15 Boulevard du Jazz, 4370 Belvaux, Luxembourg, is the country's independent GDPR supervisory authority. - The CNPD is Luxembourg's single national data-protection supervisory authority, established and organised under the Law of 1 August 2018, entirely distinct from the CSSF. - CNPD — Luxembourg's independent supervisory authority, established under the Law of 1 August 2018 implementing the GDPR. #### Act And InstrumentsGreen The Loi du 1er août 2018 is the national instrument organising the CNPD and the general data-protection regime. Claims (1): - Luxembourg's GDPR-implementing act is the Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données, published in Mémorial A No. 686 of 16 August 2018. #### Material ScopeAmber Material scope tracks GDPR's definition of personal-data processing, with the national act supplying institutional/procedural detail. Claims (1): - The general data-protection regime organised by the Loi du 1er août 2018 applies alongside the directly-applicable GDPR to processing falling within GDPR's material scope, with the national act supplying Luxembourg's institutional and procedural framework (CNPD organisation, sanctions, cooperation). #### Territorial ScopeGreen Territorial scope follows GDPR Art 3 establishment and targeting criteria per EDPB Guidelines 3/2018. Claims (1): - GDPR Article 3 extends Luxembourg's data-protection regime extraterritorially via the establishment criterion (Art 3(1)) and the targeting criterion (Art 3(2)). #### Regulator Registration And FilingRed No LU-specific general registration/filing obligation beyond GDPR accountability documentation (ROPA, DPIA) was located in this pass. Searched: 'CNPD registration filing requirements Luxembourg', 'Luxembourg data controller notification obligation'. Luxembourg is an EU Member State subject to the directly-applicable GDPR, given national institutional effect via the Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données. The CNPD (Commission Nationale pour la Protection des Données), headquartered in Belvaux, is the sole national supervisory authority. Territorial scope follows GDPR Art 3's establishment/targeting test. Registration/filing: GDPR abolished general prior-notification regimes; no LU-specific residual filing obligation was identified in this research pass beyond DPIA/DPO record-keeping duties captured under controller_processor_duties (searched: 'CNPD registration filing requirements Luxembourg'). Periodic update · new data 2026-10-11 #### Regulator & Framework The CNPD is Luxembourg's independent supervisory authority, established under the Law of 1 August 2018 implementing the GDPR. This standing position is unchanged and continues to anchor Luxembourg's data-protection regulatory architecture. What has moved, and remains unresolved, is Luxembourg's national designation of a competent authority under the EU AI Act. Bill of Law No. 8476 proposes to designate the CNPD as Luxembourg's single point of contact and default market-surveillance authority under the AI Act, with the CSSF and CAA retaining sectoral oversight for the entities each already regulates. As of the most recent secondary-source check this cycle, this Bill remained pending; its status has not been independently re-verified against the Chamber of Deputies' own legislative tracking this cycle, so this should be read as the most recent confirmed position rather than a current-as-of-today statement. This pending status carries practical consequence because the AI Act's Article 50 transparency obligations took effect 2 August 2026, with enforcement sitting with national market-surveillance authorities from that date. Where a Member State has not yet completed its own competent-authority designation, the practical enforcement route for those obligations within that Member State carries a degree of uncertainty. For Luxembourg, this means the obligations themselves are in force, but the question of which domestic authority formally exercises market-surveillance power is not yet settled in enacted law. Separately, Luxembourg's DPO-notification practice continues to exceed the GDPR baseline: controllers and processors must communicate their DPO's contact details to the CNPD when the DPO takes office, and must notify the CNPD immediately of any change of DPO. This is a standing requirement distinct from the baseline notification obligations under GDPR Article 37, and it remains an active compliance touchpoint for any entity operating in Luxembourg. #### Outlook The central open question for Luxembourg's regulator-and-framework position is whether Bill of Law No. 8476 advances to adoption, formally resolving the AI Act competent-authority question and CSSF/CAA sectoral carve-outs. Until that Bill is enacted, the practical enforcement route for AI Act Article 50 obligations in Luxembourg carries an element of institutional uncertainty that sits alongside the otherwise settled GDPR/CNPD core framework. Sources and claims (6) - [EDPB](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) — The Commission Nationale pour la Protection des Données (CNPD), based at 15 Boulevard du Jazz, 4370 Belvaux, Luxembourg, is the country's independent GDPR supervisory authority. - [EUR-Lex (National Implementing Measure record)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=NIM:262136) — Luxembourg's GDPR-implementing act is the Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données, published in Mémorial A No. 686 of 16 August 2018. - [EDPB](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf) — GDPR Article 3 extends Luxembourg's data-protection regime extraterritorially via the establishment criterion (Art 3(1)) and the targeting criterion (Art 3(2)). - [EUR-Lex (National Implementing Measure record)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=NIM:262136) — The general data-protection regime organised by the Loi du 1er août 2018 applies alongside the directly-applicable GDPR to processing falling within GDPR's material scope, with the national act supplying Luxembourg's institutional and procedural framework (CNPD organisation, sanctions, cooperation). - [CNPD](https://cnpd.public.lu/en/actualites/national/2026/03/arret-ca-amazon-cnpd.html) — The CNPD is Luxembourg's single national data-protection supervisory authority, established and organised under the Law of 1 August 2018, entirely distinct from the CSSF. - [https://cnpd.public.lu/en.html](https://cnpd.public.lu/en.html) — CNPD — Luxembourg's independent supervisory authority, established under the Law of 1 August 2018 implementing the GDPR. ### Luxembourg: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Lawful bases, consent and special categories are solidly evidenced from EDPB primary guidance; pseudonymisation/anonymisation sub-module has no LU-specific finding. Primary framework GDPR (EU) 2016/679, Articles 6-9 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Green Lawful bases, consent and special categories are solidly evidenced from EDPB primary guidance; pseudonymisation/anonymisation sub-module has no LU-specific finding. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data The dominant development in this module is the Administrative Court's judgment of 12 March 2026, numbered 52757C, resolving the appeal in Luxembourg's largest data-protection enforcement case. The Court upheld the CNPD's substantive finding that Amazon could not rely on legitimate interest as the lawful basis for its behavioural-advertising processing of customer data, confirming that the underlying privacy violation the CNPD identified was correctly found. This part of the judgment leaves intact the core legal conclusion that the processing in question required a different lawful basis, most likely explicit consent, than the one the company had relied upon. At the same time, the Court annulled the EUR746m fine that the CNPD had imposed, finding that the CNPD had not properly assessed fault as required under Article 83 of the General Data Protection Regulation. The Court applied the fault-assessment standard articulated by the Court of Justice of the European Union in its C-807/21 and C-683/21 judgments, which require a supervisory authority to establish that an infringement was committed intentionally or negligently before a fine of this kind can stand. Because the CNPD's original decision did not include this fault assessment, the fine itself could not survive the appeal even though the underlying legal violation it was based on did. The case has been remanded to the CNPD, meaning the authority must now revisit the matter and produce a fault-compliant assessment before any fine, whether the original EUR746m sum, a revised figure, or potentially no fine at all, can be finally confirmed. The practical significance of this split outcome is considerable. A company facing a comparable legitimate-interest finding in Luxembourg can expect the substantive legal standard, that legitimate interest does not justify behavioural-advertising processing of this kind, to be applied consistently; but the case also demonstrates that the CNPD's procedural rigour in assessing fault under Article 83 has been found wanting at least once, at the scale of its largest enforcement matter to date. The procedural status of the CNPD's remand re-examination, including any timeline for the fault re-assessment, has not been confirmed on the evidence retrieved. #### Outlook The CNPD's forthcoming re-assessment of fault in the Amazon matter is the single most consequential open question for Luxembourg's lawful-processing enforcement landscape, and the fine that ultimately results, once re-determined, will likely be treated as a benchmark for how the CNPD applies the Article 83 fault standard in future large-scale cases. Companies relying on legitimate interest for behavioural-advertising or similarly data-intensive processing in Luxembourg should expect the substantive legal conclusion reached by the Administrative Court, that legitimate interest does not support processing of this character, to remain the governing standard regardless of how the fine question is ultimately resolved. D2 · Lawful Processing — Full Module Record 4 sub-modules · 54 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Strong enforcement-based evidence for access/rectification/erasure/objection; portability and deadlines sub-modules unevidenced. Primary framework GDPR Articles 12-22, given institutional effect via the Loi du 1er août 2018 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Amber Strong enforcement-based evidence for access/rectification/erasure/objection; portability and deadlines sub-modules unevidenced. #### Sub-modules (5) #### Access RightAmber CNPD found an Art 15 violation in the Amazon Europe Core case. Claims (1): - In its 16 July 2021 decision, the CNPD found Amazon Europe Core in violation of, among other provisions, GDPR Article 15 (right of access), as part of a €746 million fine. #### Rectification And ErasureAmber CNPD found Art 16/17 violations in the same case. Claims (1): - The same CNPD decision against Amazon Europe Core also found violations of GDPR Articles 16 (rectification) and 17 (erasure). #### Restriction And ObjectionAmber CNPD found an Art 21 violation tied to profiling-based advertising objection rights. Claims (1): - The CNPD's Amazon decision further found a violation of GDPR Article 21 (right to object), the provision underpinning objections to profiling-based targeted advertising. #### Data PortabilityRed No LU-specific portability finding located this pass. #### Deadlines And Response WindowsRed No LU-specific deadline/response-window guidance located this pass; GDPR's default one-month window is assumed absent evidence of derogation. CNPD's own enforcement record evidences the operative rights framework: the Amazon Europe Core decision (16 July 2021) expressly found violations of Articles 15 (access), 16 (rectification), 17 (erasure) and 21 (objection). Portability (Art 20) and the statutory response-deadline mechanics (Art 12(3)) were not independently evidenced with LU-specific material in this pass (searched: 'CNPD subject access request deadline', 'CNPD data portability guidance'). No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (3) - [OneTrust DataGuidance](https://www.dataguidance.com/news/luxembourg-president-administrative-tribunal-suspends) — In its 16 July 2021 decision, the CNPD found Amazon Europe Core in violation of, among other provisions, GDPR Article 15 (right of access), as part of a €746 million fine. - [OneTrust DataGuidance](https://www.dataguidance.com/news/luxembourg-president-administrative-tribunal-suspends) — The same CNPD decision against Amazon Europe Core also found violations of GDPR Articles 16 (rectification) and 17 (erasure). - [OneTrust DataGuidance](https://www.dataguidance.com/news/luxembourg-president-administrative-tribunal-suspends) — The CNPD's Amazon decision further found a violation of GDPR Article 21 (right to object), the provision underpinning objections to profiling-based targeted advertising. ### Luxembourg: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ DPO and accountability sub-modules well evidenced; ROPA, joint-controller, GDPR-breach-notification and retention sub-modules unevidenced in this pass. Primary framework GDPR Articles 5, 24-39, given institutional effect via the Loi du 1er août 2018 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Amber DPO and accountability sub-modules well evidenced; ROPA, joint-controller, GDPR-breach-notification and retention sub-modules unevidenced in this pass. D4 · Controller & Processor — Full Module Record 7 sub-modules · 73 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ General Chapter V applicability evidenced generically; LU-specific transfer-mechanism detail (SCC uptake, TIA practice, localisation) unevidenced. Primary framework GDPR Chapter V (Articles 44-49), directly applicable EU law Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Amber General Chapter V applicability evidenced generically; LU-specific transfer-mechanism detail (SCC uptake, TIA practice, localisation) unevidenced. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 69 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and telecoms overlays well evidenced; health, employment, credit-scoring, education and (binding) insurance overlays unevidenced. Primary framework GDPR plus sector overlays: Law of 5 April 1993 on the financial sector (CSSF); ePrivacy Directive 2002/58/EC (as amended) Supervisory authority Commission de Surveillance du Secteur Financier (CSSF) Traffic-light rationale — Amber Financial and telecoms overlays well evidenced; health, employment, credit-scoring, education and (binding) insurance overlays unevidenced. Periodic update · new data 2026-10-25 #### Sectoral Watch The EU Data Act's obligations are now substantially live in Luxembourg, having applied directly since 12 September 2025 without need for national transposition of its core provisions. Two further phased duties under the Act mark this period: the access-by-design duty, requiring that connected products placed on the market after 12 September 2026 be designed to allow data access by the user or a party the user designates, has now taken effect; and the abolition of charges for switching between data-processing and cloud services, required under the Act, is due to take effect from 12 January 2027. Luxembourg filed an implementing Bill, numbered 8809, on 28 July 2026, addressing aspects of the Act's application domestically, though whether this Bill designates Luxembourg's national competent authority or data coordinator under the Act, a status that remains unconfirmed on the evidence retrieved, is a material open question for any entity needing to know which Luxembourg authority to approach with Data Act compliance or enforcement matters. The timing of these phased duties matters for any entity placing connected products on the Luxembourg market or operating cloud-switching arrangements with Luxembourg-based customers. The access-by-design duty, now in effect, applies prospectively to products placed on the market after the September 2026 date, meaning products already in the market before that date are not automatically brought into scope retroactively by the duty itself. The cloud-switching-charge abolition, by contrast, remains a forthcoming duty rather than a live one, with just under three months remaining before its January 2027 effective date at the time of this assessment. No information was retrieved regarding enforcement activity specifically under the Data Act in Luxembourg, which is unsurprising given how recently its core provisions and phased duties have taken effect; the sectoral-watch signal here is accordingly about the regulatory calendar and its uncertain institutional landing point, the data-coordinator designation, rather than about observed compliance or enforcement outcomes. #### Outlook The confirmation of Luxembourg's data-coordinator or competent-authority designation under the Data Act, whether through Bill No. 8809 or a separate instrument, is the most immediate open institutional question in this module, and entities with Data Act compliance obligations in Luxembourg should expect clarity on this point to emerge as the Bill progresses. The approach of the January 2027 cloud-switching-charge abolition deadline means that cloud-service providers operating in or into Luxembourg have a defined and relatively near-term date by which their switching-charge practices must be brought into compliance, a duty that sits alongside the already-live access-by-design requirement for connected products. Periodic update · new data 2026-10-11 #### Sectoral Watch Two sectoral overlays carry open structural questions for Luxembourg this cycle. The first concerns the EU Data Act, Regulation (EU) 2023/2854, which has applied generally since 12 September 2025. Luxembourg has not yet introduced a national implementing or enforcement law under the Data Act, nor has it designated a national competent authority or data coordinator for the Regulation's purposes. The CNPD has indicated an expectation of future involvement in this area, but no formal designation has been located as of this cycle. This leaves data-holders and data-recipients operating in Luxembourg without clarity on which domestic authority would field a Data Act complaint or enforcement matter, even though the substantive obligations under the Regulation have applied for over a year. The second overlay concerns the NIS2 transposition. The Law of 5 May 2026 designates the ILR as the default NIS2 competent authority for Luxembourg, while carving out the CSSF as the competent authority for banking and financial-market-infrastructure entities, and for CSSF-supervised digital-infrastructure and ICT-service-management activities, under Article 3 of that law. Where DORA applies to a given entity, DORA operates as lex specialis, meaning its sector-specific operational-resilience requirements take precedence over the general NIS2 framework for that entity. This sectoral carve-out is now a settled feature of Luxembourg's cybersecurity-regulation architecture, confirmed by the Law of 5 May 2026's own allocation of competence. Taken together, these two overlays show an uneven pattern: the NIS2/financial-sector allocation has reached a settled, enacted position, while the Data Act's national-authority question remains an open gap more than a year after the Regulation began applying. #### Outlook Whether Luxembourg moves to designate a national Data Act competent authority or data coordinator, and whether the CNPD's anticipated future involvement in that space materialises into a formal designation, are the clearest items to track going forward. The NIS2/DORA sectoral allocation under the Law of 5 May 2026 is comparatively settled and is unlikely to see further near-term structural change absent a new EU-level instrument. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 99 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookies/dark-patterns/cross-context advertising well evidenced; opt-out signals, clean rooms and direct marketing unevidenced. Primary framework ePrivacy Directive (as amended) + GDPR, CNPD cookie guidance Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Amber Cookies/dark-patterns/cross-context advertising well evidenced; opt-out signals, clean rooms and direct marketing unevidenced. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy The Luxembourg Administrative Appeal Court's 12 March 2026 ruling is this cycle's central adtech development. The court upheld the CNPD's substantive finding that Amazon's use of legitimate interests to justify behavioural advertising was not a legally valid basis for that processing, a finding that stands as a confirmed precedent for how Luxembourg's courts read the legitimate-interests basis against behavioural-advertising practices generally, not solely against Amazon. At the same time, the court annulled the associated EUR 746 million fine, so the practical commercial consequence of the ruling is currently split: the legal-basis question is settled against the adtech practice at issue, while the financial sanction attached to it has been set aside pending fresh analysis. For any commercial actor relying on legitimate interests to support cross-context behavioural advertising involving Luxembourg data subjects, the upheld substantive finding is the more durable and more directly relevant signal than the annulled fine, since it speaks to the validity of the underlying legal basis rather than to sanction quantum. The annulment does not amount to a finding that the underlying practice was compliant; it reflects a procedural shortfall in how the CNPD reasoned its way to the fine amount, not a substantive vindication of the processing basis used. #### Outlook Whether the CNPD's forthcoming reconsideration produces a renewed fine, and at what level, is the open question carried into the next cycle. The substantive finding against legitimate interests as a basis for behavioural advertising is not itself under appeal or in doubt following this ruling, so commercial actors relying on that basis in Luxembourg should treat the underlying legal exposure as unresolved in the CNPD's favour even while the sanction quantum remains pending. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 59 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI Act competent-authority designation and Art 22 baseline evidenced but the designation is still at bill stage; biometric/genetic/profiling/surveillance carve-out sub-modules unevidenced. Primary framework GDPR Article 22; EU AI Act (Regulation (EU) 2024/1689); draft Luxembourg AI Act implementing Bill No. 8476 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Amber AI Act competent-authority designation and Art 22 baseline evidenced but the designation is still at bill stage; biometric/genetic/profiling/surveillance carve-out sub-modules unevidenced. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The EU AI Act's Article 50 transparency obligations took effect 2 August 2026, with enforcement sitting with national market-surveillance authorities from that date. For Luxembourg, this creates a practical gap: the obligations themselves are now in force, but Luxembourg's own Bill of Law No. 8476, which would designate the CNPD as the single point of contact and default market-surveillance authority for the AI Act, with the CSSF, CAA and ILNAS carrying sectoral and notifying-authority roles respectively, remained unvoted as of the most recent check this cycle. This is best understood as an active, named gap in Luxembourg's AI-governance architecture rather than an unexamined one: the substantive EU-level obligation under Article 50 is clear and already binding, but the domestic institutional machinery for enforcing it within Luxembourg has not yet been completed through enacted national legislation. This creates practical uncertainty over which Luxembourg authority currently exercises market-surveillance power over AI Act Article 50 compliance, pending Bill 8476's adoption. The practical consequence of this gap is most acute for entities subject to AI Act transparency obligations that engage with Luxembourg specifically, where the question of which domestic body would receive a complaint, conduct an investigation, or exercise market-surveillance powers under Article 50 cannot currently be answered definitively by reference to enacted Luxembourg law alone. #### Outlook The clearest marker for this module going forward is the adoption status of Bill of Law No. 8476. Until the Bill is enacted, Luxembourg's AI Act enforcement architecture for Article 50 and related provisions remains in a state of institutional uncertainty, even as the underlying EU-level transparency obligations continue to apply and bind entities operating in or into Luxembourg. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 88 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-of-consent/parental-consent baseline evidenced via GDPR Art 8 generic guidance; no confirmed LU-specific derogation and other sub-modules unevidenced. Primary framework GDPR Article 8 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Amber Age-of-consent/parental-consent baseline evidenced via GDPR Art 8 generic guidance; no confirmed LU-specific derogation and other sub-modules unevidenced. D9 · Children's Privacy — Full Module Record 5 sub-modules · 76 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Luxembourg: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Landmark enforcement action, its collective-complaint origin, and a within-180-day legislative development are all well evidenced; funding/capacity and private-right-of-action detail are gaps. Primary framework GDPR Chapter VI-VIII (Articles 77-84), given institutional effect via the Loi du 1er août 2018 Supervisory authority [Commission Nationale pour la Protection des Données (CNPD)](http://www.cnpd.lu/) Traffic-light rationale — Green Landmark enforcement action, its collective-complaint origin, and a within-180-day legislative development are all well evidenced; funding/capacity and private-right-of-action detail are gaps. Periodic update · new data 2026-10-25 #### Enforcement & Redress Luxembourg's enforcement and redress landscape this period is defined by a contrast in scale between its single largest case and its broader annual enforcement activity. In 2025, the CNPD issued eight decisions following investigation, of which seven carried fines, with an aggregate fine total of EUR216,061 and individual penalties ranging from EUR1,277 to EUR175,000. The stated focus of this enforcement activity was principally transparency failures, data-minimisation shortfalls and retention-limit breaches, a set of concerns considerably more modest in scale, and markedly different in character, from the legitimate-interest question central to the Amazon matter addressed elsewhere in this assessment. This contrast illustrates that the bulk of the CNPD's day-to-day enforcement activity operates at a very different order of magnitude than its headline case, and that most Luxembourg controllers and processors are more likely to encounter the CNPD through this smaller-scale, more routine enforcement activity than through anything resembling the Amazon-scale proceeding. A structurally significant redress development this period is the introduction, via the Law of 20 November 2025, of a specific framework permitting class actions in Luxembourg, including in the data-protection context. This is a material addition to the redress landscape because it creates a collective mechanism through which affected individuals can pursue claims together, rather than relying solely on individual complaints to the CNPD or individual civil claims, a route that did not previously exist in Luxembourg in this specific form. The precise statutory article within the Law of 20 November 2025 establishing this framework, and the procedural detail of how it operates in a data-protection context specifically, were not located, leaving some open questions about its practical scope and the conditions under which a data-protection class action could proceed. The Amazon remand, discussed in the lawful-processing module of this assessment, remains the dominant unresolved matter in Luxembourg's enforcement record, since it is the jurisdiction's largest case by a wide margin and its ultimate fine figure remains to be determined by the CNPD following the Administrative Court's remand. #### Outlook The newly available class-action framework for data-protection matters is likely to be tested for the first time in the coming period, and the manner in which it is first invoked, including what kind of underlying violation triggers its use, will likely shape expectations about its practical reach going forward. Meanwhile, the CNPD's ordinary enforcement activity, running at a modest aggregate scale focused on transparency, minimisation and retention issues, is likely to continue at a broadly similar tempo and focus unless a new sectoral priority, such as the EU Data Act's phased duties or AI Act-related obligations, begins to generate its own distinct enforcement activity. Periodic update · new data 2026-10-11 #### Enforcement & Redress The CNPD may impose administrative fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, together with temporary or definitive processing bans, under GDPR Article 83. This standing enforcement power remains the backdrop against which Luxembourg's single largest enforcement matter has now taken a significant turn. The Cour administrative annulled the CNPD's EUR 746 million fine against Amazon Europe Core, originally decided 15 July 2021, in a judgment dated 12 March 2026. The appellate court's reasoning confirmed the CNPD's underlying finding that Amazon's prior processing lacked a valid legitimate-interest basis, but faulted the CNPD on two specific grounds: first, for not assessing intent or negligence in setting the quantum of the fine, and second, for not accounting for the fact that Amazon has since changed its legal basis for the relevant processing activity to consent. As a result of the annulment, the CNPD is now required to issue a fresh, unscheduled decision determining a proportionate fine for Amazon's past conduct, taking the appellate court's guidance into account. This remains the single largest live enforcement item on Luxembourg's data-protection record by a wide margin, and no newer enforcement development has emerged to supersede it this cycle. The annulment does not overturn the substantive finding against Amazon's legal-basis practice; rather, it sends the matter back to the CNPD specifically on the question of appropriate fine quantum, informed by considerations the original decision did not address. #### Outlook The clearest item to watch is the CNPD's forthcoming fresh decision on the Amazon fine. The timing of that decision has not been scheduled publicly, and the appellate court's guidance, requiring an assessment of intent and negligence and an accounting for Amazon's subsequent change of legal basis, will shape both the scale and the reasoning of whatever fine the CNPD ultimately imposes. Given the scale of the original fine, EUR 746 million, the reassessed figure will be closely watched as a marker of how Luxembourg's enforcement practice treats large-scale legitimate-interest violations going forward. Periodic update · new data 2026-09-28 #### Enforcement & Redress Two developments define this cycle for Luxembourg's enforcement and redress landscape. First, the Administrative Appeal Court's 12 March 2026 ruling annulled the CNPD's EUR 746 million Amazon fine, holding that the CNPD had not established the fault or negligence that Article 83 requires, an evidentiary standard clarified by the CJEU's Deutsche Wohnen ruling, and remanding the case for fresh sanction analysis. This is a confirmed, in-force development with high materiality: it signals that Luxembourg courts will now demand explicit fault-based reasoning before upholding large administrative fines, raising the evidentiary bar the CNPD must clear in future high-value sanctions, even as it leaves the underlying substantive finding against Amazon's processing basis intact. Second, and separately, the Law of 20 November 2025, in force from 25 November 2025, transposes Directive (EU) 2020/1828 and grants the CNPD standing as a qualified entity able to bring collective consumer actions for GDPR-based harms. This is a new redress mechanism layered on top of the CNPD's existing enforcement powers, giving the regulator a route to pursue collective, rather than only individual or CNPD-initiated administrative, remedies for GDPR-based harms affecting Luxembourg consumers. Against this backdrop, the CNPD's ordinary 2025 enforcement activity, seven corrective measures including six fines from EUR 1,277 to EUR 175,000, concentrated on records-of-processing-activities compliance and video-surveillance proportionality, describes a steady enforcement cadence well below the scale of the Amazon matter, and should be read as the regulator's baseline activity level rather than as evidence of a shift in enforcement priorities. #### Outlook The Amazon remand leaves open both the timing and quantum of any renewed fine; the CNPD's need to produce fault-based reasoning under the post-Deutsche Wohnen standard is likely to slow, without necessarily preventing, a fresh sanction. Separately, the practical significance of the CNPD's new collective-redress standing will depend on whether and how it is used in a first case; no such case had been identified as brought this cycle. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 117 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties