Law: Act of 1 August 2018 on the Organisation of the National Commission for Data Protection and Implementing the GDPR ('the Act') and the General Data Protection Regulation (Regulation (EU) 2016/679)

Regulator: National Commission for Data Protection ('CNPD')

Summary: The Act is the main piece of privacy legislation in Luxembourg and implements the GDPR into national law. The GDPR is therefore directly applicable with regards to data subject rights and data controller and data processor obligations as well as data transfers. The Act establishes the CNPD and details its investigatory and enforcement powers. Moreover, the Act contains several express permissions to derogate from the GDPR where personal data is processed for scientific or historical research purposes or for statistical purposes, and prohibits the processing of genetic data for the purposes of the exercise of rights of the data controller in the insurance sector and in relation to employment. The CNPD frequently advises the legislator on privacy aspects and has issued opinions on legal reforms regarding anti-money laundering, insurance, and financial trusts.