Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation)
Luxembourg's Act of 1 August 2018, the national law that organises the CNPD and sets Luxembourg's own GDPR measures: accreditation of certification bodies by the CNPD, a criminal offence for obstructing it, periodic penalties up to 5 percent of daily turnover, derogations for journalism and expression, research derogations tied to twelve mandatory safeguards, a ban on genetic data in employment and insurance, and the Labour Code's procedure for monitoring employees (lawful basis, prior information with a non-use commitment, co-decision, the CNPD prior opinion and protection for complaints). As consolidated to 26 December 2025, with two amending bills pending. Built from the Act's own articles.
Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) is a compliance framework from Luxembourg with 3 domains and 13 controls. The largest domains are Title II: specific provisions under the GDPR (Articles 62 to 67) – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) (6 controls), Labour Code Article L.261-1 as replaced by Article 71: surveillance of employees – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) (5 controls), Title I: scope and the National Data Protection Commission (Articles 1 to 61) – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Labour Code Article L.261-1 as replaced by Article 71: surveillance of employees – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation)
| Code | Title |
|---|---|
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::L.261-1(1) | Labour Code L.261-1(1): monitor employees only on a GDPR Article 6(1) ground and within this article |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::L.261-1(2) | Labour Code L.261-1(2): inform the staff representatives in advance, with the purpose, the method, retention and a formal non-use commitment |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::L.261-1(3) | Labour Code L.261-1(3): follow the co-decision rules for safety, output-based pay and flexitime monitoring |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::L.261-1(4) | Labour Code L.261-1(4): allow the CNPD prior-opinion request and do not implement while it suspends the project |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::L.261-1(5) | Labour Code L.261-1(5): never treat an employee's complaint to the CNPD as grounds for dismissal |
Title I: scope and the National Data Protection Commission (Articles 1 to 61) – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation)
| Code | Title |
|---|---|
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.15 | Article 15: certification bodies issuing GDPR certifications must hold CNPD accreditation |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.51 | Article 51: never prevent or impede the CNPD in its tasks |
Title II: specific provisions under the GDPR (Articles 62 to 67) – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation)
| Code | Title |
|---|---|
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.62 | Article 62: apply the journalism and expression derogations only within their conditions |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.63 | Article 63: derogate from research data subjects' rights only where the rights would defeat the research, and only with the Article 65 measures |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.64 | Article 64: process special categories for research only when the Article 65 conditions are met |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.65 | Article 65: implement the twelve additional measures for research and statistical processing |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.65.exclusions | Article 65 (final subparagraph): document and justify, project by project, any excluded research measure |
| luxembourg-law-of-1-august-2018-on-data-protection-gdpr-implementation::Art.66 | Article 66: never process genetic data to exercise the controller's own rights in employment or insurance |
What is Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) and who does it apply to?
Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) is a compliance framework from Luxembourg with 3 domains and 13 controls. Luxembourg's Act of 1 August 2018, the national law that organises the CNPD and sets Luxembourg's own GDPR measures: accreditation of certification bodies by the CNPD, a criminal offence for obstructing it, periodic penalties up to 5 percent of daily turnover, derogations for journalism and expression, research derogations tied to twelve mandatory safeguards, a ban on genetic data in employment and insurance, and the Labour Code's procedure for monitoring employees (lawful basis, prior information with a non-use commitment, co-decision, the CNPD prior opinion and protection for complaints). As consolidated to 26 December 2025, with two amending bills pending. Built from the Act's own articles. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) actually require?
Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) has 13 controls organised across 3 domains. The largest domains are Title II: specific provisions under the GDPR (Articles 62 to 67) – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) (6 controls), Labour Code Article L.261-1 as replaced by Article 71: surveillance of employees – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) (5 controls), Title I: scope and the National Data Protection Commission (Articles 1 to 61) – Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) do I already cover?
Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation)?
Start your Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Luxembourg Law of 1 August 2018 on Data Protection (GDPR Implementation) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 13 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required