The Commission nationale pour la protection des données is Luxembourg's independent data protection authority. It supervises compliance with the GDPR and Luxembourg data protection law, investigates complaints and breaches, issues decisions and sanctions, and supports controllers and data protection officers. Because a number of large technology and financial groups have their European establishment in Luxembourg, the CNPD acts as lead supervisory authority under the one-stop-shop mechanism for processing that affects data subjects across the entire Union.
What the CNPD publishes
- Decisions and opinions on data protection matters
- Guidance documents on compliance obligations and specific processing contexts
- Material supporting data protection officers and breach notification
- Annual reports covering supervisory and enforcement activity
- Training and awareness resources
Why it matters for compliance teams
The lead authority role is what makes the CNPD disproportionately important for its size. A decision taken in Luxembourg under the one-stop-shop can determine how a service operates across the whole EEA, and it has issued some of the largest fines recorded under the GDPR.
Seqlense DOC indexes CNPD decisions and guidance alongside EDPB material — including the Article 65 decisions that resolve disputes over cross-border cases — so a privacy team can follow a Luxembourg decision through to its European effect.