Luxembourg

Commission nationale pour la protection des données (CNPD) is an independent public body that supervises and ensures that the processing of personal data in Luxembourg is legal and respects people’s privacy rights. It was created in 2002, but the authority of the CNPD has become much stronger since the introduction of the General Data Protection Regulation (GDPR) of the European Union. CNPD protects the rights of people by investigating possible data breaches, advising the government on legislation related to the internet, and auditing companies and organizations for compliance.

Protection of personal data is carried out by the CNPD through enforcement of data protection laws, checking compliance, and investigating any data breach cases within public and private sector institutions. As the lead data regulator in Luxembourg, it conducts on-site audits, manages citizen complaints, and has legal authority to impose hefty penalties on any institution violating the GDPR. In addition, the regulator educates the public and businesses on their privacy responsibilities and rights and acts as the government's advisor for all legislative proposals concerning personal data.