Luxembourg

Reach comes from Article 3 of the General Data Protection Regulation, not from Luxembourg law. The Law of 1 August 2018 organises the national regulator and adds national choices on top; Article 2 of that law states that the duties in its Title II apply to controllers and processors established on Luxembourg territory. Separately, the new cybersecurity law of 5 May 2026 has its own reach: Article 16 requires certain entities not established in the European Union to designate a representative, and if they do not, the authority can apply to the President of the Luxembourg District Court in summary proceedings for an order appointing one. Financial and insurance secrecy duties attach to persons established in Luxembourg and supervised here, and, for insurance, also to business carried on from Luxembourg under the freedom to provide services.

Sector by sector, checked 18 August 2026. BANKING AND INVESTMENT FIRMS - conditional, with one hard location rule. Article 41 of the Law of 5 April 1993 on the financial sector makes client secrecy a criminal matter. Since a 2018 amendment, paragraph 2a lets you outsource without breaching secrecy in two situations: the supplier is itself supervised in Luxembourg and criminally bound by secrecy, or, in every other case, the client has accepted the outsourcing, the type of information transmitted and the country where the supplier is established. Country of establishment is therefore a term the client signs up to, not a free engineering choice. Separately, point 28 of Circular CSSF 22/806 requires that where the accounting system is hosted outside Luxembourg the firm must hold, at the end of each day, a secure backup of all end-of-day accounting positions including client positions, at its own premises in the European Economic Area, or those of a group entity or a different service provider in the European Economic Area. INSURANCE - the same shape. Article 300 of the Law of 7 December 2015 mirrors banking secrecy, again criminally sanctioned, again with a country-of-establishment acceptance test for outsourcing. INVESTMENT FUNDS AND SUPPORT SERVICES - Articles 29-3, 29-5 and 29-6 of the 1993 law create licensed Luxembourg statuses for firms that operate the IT systems of financial entities, or that digitise or preserve their documents. That is a licensing wall, not a storage wall. TELECOMS - no localisation found, but a 6-month duty to keep traffic and location records under the Law of 30 May 2005. HEALTH - no hosting-in-Luxembourg rule found as at 18 August 2026, unlike France. Patient files must be kept for at least 10 years. GOVERNMENT CLOUD, EDUCATION, GAMING, MAPPING AND DEFENCE - no localisation rule found in a government source on 18 August 2026. Treat that as 'not found', not as 'does not exist'; see the unconfirmed list.

The mechanisms are the European ones: an adequacy decision, the 2021 standard contractual clauses, binding corporate rules, an approved certification or code of conduct, or one of the narrow Article 49 exceptions. A transfer impact assessment is still expected after the Schrems II judgment. The approved list on 18 August 2026 includes Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, the European Patent Organisation, and the United States for organisations self-certified under the EU-US Data Privacy Framework. That last one is the fragile one: it is legally valid today, but on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether it still stands. Do not build a single-mechanism architecture on it. On top of all of this, a Luxembourg bank or insurer needs the client-acceptance step described in question 2 before client information leaves for a named country.

Regulators and their reach. CNPD - privacy. Published anonymised decisions run from 2021 to 2025, most recently a December 2025 decision on incomplete processing registers. Volume is modest, roughly 3 to 12 published decisions a year after a burst of 48 in 2021, so the honest rating is active rather than aggressive. Appeals go to the Administrative Tribunal, which rehears the case on the merits rather than only reviewing the process. One genuine gap: under Article 48 of the Law of 1 August 2018 the CNPD cannot impose administrative fines on the State or on the communes. It can still order them to stop, and it can impose a daily penalty on private bodies of up to 5 per cent of average daily turnover, but a Luxembourg public body faces no fine. CSSF - banks, investment firms, payment institutions and funds. Requires prior notification at least three months before a critical or important outsourcing starts. Commissariat aux Assurances - insurers and reinsurers. Institut Luxembourgeois de Regulation - telecoms, and since the Law of 5 May 2026 the competent authority for the cybersecurity regime, taking incident notifications through its SERIMA platform. Commissariat du Gouvernement a la protection des donnees aupres de l'Etat - a separate body created by the 2018 law that acts as data protection officer for state administrations. It advises; it does not fine.

Floors verified today. Anti-money-laundering: 5 years from the end of the business relationship or the date of an occasional transaction, under Article 3(6) of the Law of 12 November 2004. A supervisor may require a further period of up to 5 more years in a specific case, and firms keep data a further 5 years where needed to make internal prevention or detection measures work. Patient records: at least 10 years from the end of care, under the Law of 24 July 2014 on patients' rights; neither the provider nor the patient may strip anything out of the file before that period ends. Telecoms: 6 months for traffic data and for location data other than traffic data, under Articles 5 and 9 of the Law of 30 May 2005. Ceilings: the anti-money-laundering law says plainly that, without prejudice to longer periods laid down by other laws, professionals must erase personal data once the retention periods end. General accounting and commercial books are widely stated to run 10 years, but we could not open a government source for that today; see the unconfirmed list.

Clock 1 - privacy. Article 33 of the General Data Protection Regulation: notify the CNPD within 72 hours of becoming aware, where there is a risk to people, and tell affected people without undue delay where the risk is high. Clock 2 - electronic communications. Providers must notify a personal data breach within 24 hours of detection, under Commission Regulation (EU) 611/2013 as applied by the CNPD. Clock 3 - cybersecurity. Under the Law of 5 May 2026, essential and important entities must send the competent authority a preliminary notification without undue delay and in any event within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the incident notification. They must also warn the users of their service without undue delay where the incident may harm the service. Notifications go through the ILR's SERIMA platform. Clock 4 - finance. Financial entities also report major information and communication technology incidents under the European Digital Operational Resilience Act, which has applied since 17 January 2025.

1. Criminal secrecy. Article 41 of the Law of 5 April 1993 and Article 300 of the Law of 7 December 2015 both say disclosure is punished under Article 458 of the Penal Code. This reaches directors, employees and anyone working for the firm, and the insurance law states expressly that the duty survives after the job, mandate or practice ends. A standard European supplier contract is not enough on its own; the person with access must be under a legal secrecy duty or a confidentiality agreement, and the client must have accepted the outsourcing, the information type and the supplier's country. 2. Monitoring staff. Article L.261-1 of the Labour Code, as rewritten in 2018, requires the employer to inform the joint works committee or the staff delegation in advance, with a detailed description of the purpose, how the monitoring will work, how long data is kept, and a formal undertaking not to reuse the data for anything else. The delegation or the affected employees then have 15 days to ask the CNPD for a prior opinion, which the CNPD must give within a month, and the request suspends the project meanwhile. A complaint to the CNPD is expressly not a valid or serious reason to dismiss someone. 3. Research. Article 65 of the Law of 1 August 2018 lists 12 measures for scientific, historical or statistical research, including a data protection officer, an impact assessment, an independent trusted third party to pseudonymise, encryption in transit and at rest with state-of-the-art key management, access logs, an independent audit and a data management plan. You may leave one out, but you must document and justify it project by project. 4. Genetic data. Article 66 bans processing genetic data for the controller's own employment-law or insurance purposes. Full stop. 5. Public bodies. Article 48 of the same law bars administrative fines against the State and the communes. 6. Bonus, for insurers: Article 181-3 of the insurance law lists safeguards for health data, and four of them - encryption, access restrictions, log files and staff awareness, plus an internal policy - cannot be derogated from at all. 7. Bonus, on age: Luxembourg did not lower the age of digital consent, so it stays at 16, higher than France at 15 or the United Kingdom at 13.

Dated. 12 January 2027 - the European Data Act makes all charges for switching cloud provider, including data egress fees, zero. This is a contract and architecture change, not a paperwork one. 10 May 2026 - the Law of 5 May 2026 on cybersecurity entered into force. Registration deadlines in the law are written to 17 January 2025 for cloud providers, data-centre providers, managed service providers, content delivery networks, online marketplaces, search engines and social platforms. Because that date is already past, an entity in scope is late from day one. The ILR is still running consultations and publishing templates for the security measures. Dormant switches. 1. The EU-US Data Privacy Framework. Valid on 18 August 2026, but the Latombe appeal is pending before the Court of Justice and on 31 July 2026 the European Data Protection Board asked the Commission to examine whether the decision still stands. If it falls, every transfer relying on it needs a new mechanism overnight. 2. Telecom retention. Articles 5 and 9 of the Law of 30 May 2005 impose a general 6-month duty to keep traffic and location data on every provider. Blanket, untargeted retention of this kind has repeatedly been held contrary to European law. We found no Luxembourg judgment disapplying it and no repeal, so it is treated here as in force, but it is the most likely provision in this record to change without warning. 3. Circular scope. Circular CSSF 25/883, effective immediately from 9 April 2025, switched off Part II of Circular CSSF 22/806 for firms covered by the European Digital Operational Resilience Act. Firms outside that Act still follow the old text. Reading the circular without the amendment gives the wrong answer. Proposed only, no legal effect: the European Digital Omnibus of 19 November 2025 and the Cloud and AI Development Act proposed on 3 June 2026.