Luxembourg

The reach comes from Article 3 of the General Data Protection Regulation, not from Luxembourg law. The Law of 1 August 2018 sets up the national regulator and adds national choices on top. Its Article 2 says the duties in Title II apply to companies set up on Luxembourg territory. That covers both the companies that decide how data is used and the ones that handle it for someone else. The cybersecurity law of 5 May 2026 has its own reach. Article 16 makes certain companies based outside the European Union appoint a representative. If they do not, the authority can ask the President of the Luxembourg District Court for a fast order appointing one. Financial and insurance secrecy duties attach to people set up in Luxembourg and supervised here. For insurance, they also cover business run from Luxembourg into other countries.

Industry by industry, checked 18 August 2026. BANKING AND INVESTMENT FIRMS. Paperwork works, with one hard location rule. Article 41 of the Law of 5 April 1993 on the financial sector makes breaking client secrecy a crime. Since a 2018 change, paragraph 2a lets you outsource without breaking secrecy in two cases. Either the supplier is itself supervised in Luxembourg and bound by secrecy under criminal law. Or, in every other case, the client has agreed to three things. Those are the outsourcing, the type of information sent, and the country where the supplier is set up. So the supplier's country is something the client signs up to. It is not a free engineering choice. Separately, point 28 of Circular CSSF 22/806 applies where the accounting system is hosted outside Luxembourg. The firm must then hold, at the end of each day, a secure backup of all end-of-day accounting positions, including client positions. That backup must sit on premises in the European Economic Area. The premises can be its own, a group company's, or a different service provider's. INSURANCE. The same shape. Article 300 of the Law of 7 December 2015 copies banking secrecy. It is also a crime, and it also uses the client-agrees-to-the-country test for outsourcing. INVESTMENT FUNDS AND SUPPORT SERVICES. Articles 29-3, 29-5 and 29-6 of the 1993 law create Luxembourg licences. They cover firms that run the computer systems of financial companies, or that scan or store their documents. That is a licence wall, not a storage wall. TELECOMS. We found no rule that data must stay in the country. There is a 6-month duty to keep traffic and location records under the Law of 30 May 2005. HEALTH. We found no rule that health data must be hosted in Luxembourg, as at 18 August 2026. France is different. Patient files must be kept for at least 10 years. GOVERNMENT CLOUD, EDUCATION, GAMING, MAPPING AND DEFENCE. We found no storage-location rule in a government source on 18 August 2026. That means we did not find one, not that none exists. See the list of things we could not confirm.

The routes are the European ones. An official decision that a country is safe enough. The 2021 standard contract clauses. Company-wide rules approved by a regulator. An approved certificate or code of conduct. Or one of the narrow Article 49 exceptions. You are still expected to write down why the destination country is safe, after the Schrems II court ruling. On 18 August 2026 the approved list held Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, the European Patent Organisation, and United States organisations signed up to the European Union-United States Data Privacy Framework. That last one is the fragile one. It is legally valid today. But on 31 July 2026 the European Data Protection Board formally asked the Commission to check whether it still stands. Do not make it your only route. On top of all this, a Luxembourg bank or insurer needs the client's agreement from question 2. That must come before client information leaves for a named country.

Regulators and what they cover. CNPD - privacy. Its published anonymised decisions run from 2021 to 2025. The most recent, from December 2025, dealt with incomplete records of how data is used. Volume is modest: roughly 3 to 12 published decisions a year, after a burst of 48 in 2021. So it is active rather than aggressive. Appeals go to the Administrative Tribunal, which rehears the case in full rather than only checking the process. One real gap: under Article 48 of the Law of 1 August 2018, the CNPD cannot fine the State or the communes. It can still order them to stop. It can impose a daily penalty on private bodies of up to 5 per cent of average daily turnover. But a Luxembourg public body faces no fine. CSSF - banks, investment firms, payment institutions and funds. You must notify it at least three months before a critical or important outsourcing starts. Commissariat aux Assurances - insurers and reinsurers. Institut Luxembourgeois de Regulation - telecoms. Since the Law of 5 May 2026 it is also the authority in charge of cybersecurity. It takes incident reports through its SERIMA platform. Commissariat du Gouvernement a la protection des donnees aupres de l'Etat - a separate body created by the 2018 law. It acts as data protection officer for state departments. It advises. It does not fine.

Minimums we confirmed today. Anti-money-laundering: 5 years from the end of the business relationship, or from the date of a one-off transaction, under Article 3(6) of the Law of 12 November 2004. A supervisor may require up to 5 more years in a specific case. Firms keep data a further 5 years where they need it to make their own prevention or detection checks work. Patient records: at least 10 years from the end of care, under the Law of 24 July 2014 on patients' rights. Neither the provider nor the patient may take anything out of the file before that period ends. Telecoms: 6 months for traffic data, and for location data that is not traffic data, under Articles 5 and 9 of the Law of 30 May 2005. Maximums. The anti-money-laundering law says plainly that firms must erase personal data once the keep-it periods end. Longer periods set by other laws still apply. General accounting and business books are widely said to run 10 years. We could not open a government source for that today. See the list of things we could not confirm.

DEADLINE 1 - privacy. Article 33 of the General Data Protection Regulation. Tell the CNPD within 72 hours of finding out, where there is a risk to people. Tell the people affected without undue delay where the risk is high. DEADLINE 2 - electronic communications. Providers must report a personal data breach within 24 hours of spotting it. This comes from Commission Regulation (EU) 611/2013, as applied by the CNPD. DEADLINE 3 - cybersecurity. Under the Law of 5 May 2026, essential and important companies must send an early notice to the authority. It is due without undue delay, and in any case within 24 hours of finding out about a significant incident. A fuller notice follows within 72 hours. A final report is due within one month of that notice. They must also warn the users of their service without undue delay where the incident may harm the service. Notices go through the ILR's SERIMA platform. DEADLINE 4 - finance. Financial companies also report major technology incidents under the European Digital Operational Resilience Act, which has applied since 17 January 2025.

1. Secrecy is criminal. Article 41 of the Law of 5 April 1993 and Article 300 of the Law of 7 December 2015 both cover disclosure. Both say it is punished under Article 458 of the Penal Code. This reaches directors, employees and anyone working for the firm. The insurance law says expressly that the duty lasts after the job, mandate or practice ends. A standard European supplier contract is not enough on its own. The person with access must be under a legal secrecy duty or a confidentiality agreement. The client must also have agreed to the outsourcing, the type of information and the supplier's country. 2. Monitoring staff. Article L.261-1 of the Labour Code, rewritten in 2018, makes the employer tell the joint works committee or the staff delegation in advance. You must give a detailed description of the purpose, how the monitoring will work, and how long data is kept. You must also promise formally not to reuse the data for anything else. The delegation or the affected staff then have 15 days to ask the CNPD for an opinion. The CNPD must answer within a month, and the request pauses the project in the meantime. Complaining to the CNPD is expressly not a valid or serious reason to dismiss someone. 3. Research. Article 65 of the Law of 1 August 2018 lists 12 measures for scientific, historical or statistical research. They include a data protection officer, an impact assessment, an independent trusted third party to strip out names, encryption in transit and at rest with up-to-date key management, access logs, an independent audit and a data management plan. You may leave one out. You must write down why, project by project. 4. Genetic data. Article 66 bans using genetic data for your own employment-law or insurance purposes. Full stop. 5. Public bodies. Article 48 of the same law bars fines against the State and the communes. 6. Bonus, for insurers. Article 181-3 of the insurance law lists safeguards for health data. Four of them can never be dropped: encryption, access limits, log files and staff awareness, plus an internal policy. 7. Bonus, on age. Luxembourg did not lower the age at which children can agree for themselves. It stays at 16. France is 15 and the United Kingdom is 13.

Dated. 12 January 2027 - the European Data Act makes all charges for switching cloud provider zero, including data export fees. This is a contract and architecture change, not a paperwork one. 10 May 2026 - the Law of 5 May 2026 on cybersecurity came into force. The registration deadline written into the law is 17 January 2025. It applies to cloud providers, data-centre providers, managed service providers, content delivery networks, online marketplaces, search engines and social platforms. That date had already passed, so a company covered by the law is late from day one. The ILR is still running consultations and publishing templates for the security measures. Powers already in someone's hand. 1. The European Union-United States Data Privacy Framework. It is valid on 18 August 2026. The Latombe appeal is waiting at the Court of Justice. On 31 July 2026 the European Data Protection Board asked the Commission to check whether the decision still stands. If it falls, every transfer relying on it needs a new route overnight. 2. Telecoms record-keeping. Articles 5 and 9 of the Law of 30 May 2005 make every provider keep traffic and location data for 6 months. Keeping everyone's records like this has repeatedly been held to break European law. We found no Luxembourg judgment setting it aside and no repeal, so we treat it as in force. It is the rule in this record most likely to change without warning. 3. Which circular applies. Circular CSSF 25/883 took effect on 9 April 2025. It switched off Part II of Circular CSSF 22/806 for firms covered by the European Digital Operational Resilience Act. Firms outside that Act still follow the old text. Reading the circular without the change gives the wrong answer. Proposed only, with no legal effect: the European Digital Omnibus of 19 November 2025 and the Cloud and AI Development Act proposed on 3 June 2026.