Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
98 articles found · #reglementaire
DPIA: EDPB template (Apr 2026) and CNPD/CNIL divergences
The EDPB issued an EU DPIA template for consultation (April 2026). Yet CNPD and CNIL still diverge on triggers, with France publishing a “not required” whitelist that Luxembourg does not.
Belgian DPA fines SWDE €86,000 and rebukes missing Article 28 contract
Belgium’s DPA fines SWDE over call recording and monitoring: transparency, retention and a missing processor contract. A clear signal for Luxembourg: an incomplete Article 28 DPA is costly.
GDPR Article 22 after SCHUFA vs ICO guidance: where is the red line?
CJEU SCHUFA: a decisive credit score can be an automated decision (Art. 22). The UK ICO is more flexible if there’s meaningful human involvement. Concrete implications for LU‑UK data chains.
France Travail fined: key lessons from GDPR Article 32
On 22 January 2026, the CNIL fined France Travail €5M for weaknesses in authentication, logging and access rights. In Luxembourg, GDPR Article 32 requires appropriate, demonstrably effective security measures.
CNPD 16/12/2025: insufficient GDPR Article 30 record sanctioned
On 16/12/2025, the CNPD imposed a €7,000 fine for an incomplete Article 30 record. The decision clarifies required fields (recipients, transfers, categories, retention, security) and the EDPB fine calculation method.
CNPD — Vehicle geolocation: what the 2023–2025 guidance requires
The CNPD updated its vehicle geolocation guidance. Key points: structured legitimate interest, purpose limitation, off-duty deactivation, dual transparency and DPIA.
Analytics cookies: CNIL/CNPD exemptions, ICO still requires consent
On 29 April 2026, the ICO confirmed that non-essential analytics cookies require PECR consent. In France and Luxembourg, CNIL and CNPD allow narrow exemptions for certain audience measurement cookies.
Criteo: France’s Conseil d’État upholds €40M — consent prevails in AdTech
On 4 March 2026, France’s Conseil d’État upheld the €40M fine against Criteo for personalized advertising without valid consent. Key takeaway in AdTech: for targeting trackers, the lawful basis is (almost always) consent.
CSSF: DORA takes precedence and clarifies ICT outsourcing (Apr 2025)
CSSF confirmed DORA’s primacy from 17 January 2025 and issued Circular 25/882 to govern third‑party ICT use, the Article 28 register of information, and incident notifications via eDesk.
DORA — TLPT framed by Delegated Regulation (EU) 2025/1190
The Commission clarified TLPT under DORA via Delegated Regulation (EU) 2025/1190. In Luxembourg, the CSSF is the TLPT authority: timeline, scope, and method are now clear.
CJEU 19 March 2026 (Brillen Rottler): first access request may be refused for abuse
The CJEU allows a first access request (Art. 15 GDPR) to be refused as “excessive” if an abusive intent is proven (Art. 12(5)). Any refusal must remain exceptional, justified, and within deadlines.
Amazon vs CNPD (12 March 2026): Legitimate interest is not enough
Luxembourg’s Administrative Court annulled the €746M fine but confirmed that behavioral advertising cannot rely on legitimate interest. 2026 takeaways for legal bases and the requirement to prove fault.