Luxembourg

Tier 2 Comprehensive law Europe

Principal framework: GDPR + Law of 1 August 2018 (2018). Regulator: CNPD. CNPD given strong investigative powers; research-friendly derogations.

At a glance

Criminal offences: Yes — a dedicated offence carrying custody exists
Public-sector fines: Effectively no — not the State or municipalities
Principal law: Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en œuvre du règlement (UE) 2016/679 [Act of 1 August 2018 organising the CNPD and implementing the GDPR]
Regulator: Commission Nationale pour la Protection des Données (CNPD)
Breach notification: 72 hours to the supervisory authority (Art 33); undue-delay notice to individuals at high risk
Maximum penalty: Up to €20m or 4% of global annual turnover
DPO required: Public authorities; large-scale regular monitoring or special-category processing (Art 37)
Digital consent age: 16
Extraterritorial reach: Yes — targeting or monitoring people in the EU (Art 3(2))
National implementing act: Law of 1 August 2018

Structure

Structural pattern: Not assessed
Sub-jurisdictions: None — no sub-national axis
ISO code: LU

A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.

Transfers and adequacy

EU member: Yes
EEA member: Yes
Holds EU adequacy: Yes

EU/EEA member — intra-EEA transfers need no adequacy decision.

Instruments

No instrument profiled yet.

Also applies here

Directly applicable as EU law, without national transposition. The national act supplements it rather than replacing it.

GDPR

Tier 1 · directly applicable

Regulation (EU) 2016/679 (General Data Protection Regulation)

Sources

Never independently verified — seeded from the prototype.