The Luxembourg data protection regulatory framework is currently being amended by Draft Bill n°7184. This draft bill forms the basis for the creation of the Commission nationale pour la protection des données (the Luxembourg data protection supervisory authority, CNPD), for the implementation of the GDPR, and for the abolishment of the Law of 2 August 2002 on the protection of persons with regard to the processing of personal data. The draft bill was lodged on 12 September 2017 and a final text is expected to be published by the end of 2017 or by the beginning of 2018.

The CNPD has published several guidelines throughout 2017 to inform companies, public authorities and associations about their data protection obligations and to guide them in their efforts to be compliant with the GDPR. These include:

  • animated videos on the GDPR (January 2017);
  • information sessions (18th-19th October 2017); and
  • new Brochure data protection obligations (published in November 2017).