{
  "node_id": "lu-loi-1-aug-2018",
  "title": "Luxembourg Data Protection Law of 1 August 2018 - GDPR National Implementation",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-04-27",
  "bluf": "Luxembourg's Law of 1 August 2018 on the Organisation of the Commission Nationale pour la Protection des Données and the General Data Protection Framework (Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données), published in the Mémorial A No. 686 on 1 August 2018, is Luxembourg's primary national legislation supplementing the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) in Luxembourg. The GDPR is directly applicable Luxembourg law by virtue of Luxembourg's EU membership. The Law of 1 August 2018 provides national derogations, additions, and specifications that the GDPR permits EU member states to adopt and repeals the prior Luxembourg data protection law of 2 August 2002. Luxembourg is a unique jurisdiction of particular strategic importance in EU and global data protection: it is home to the registered offices and data processing operations of major global companies including Amazon (Amazon EU SARL registered in Luxembourg), PayPal, Skype, eBay, and numerous global financial institutions. Amazon has its European customer data processing anchored in Luxembourg, making the CNPD a significant supervisory authority for Amazon's EU data operations. Luxembourg's financial sector is the largest investment fund centre in Europe after the United States and a major banking and insurance hub, with significant personal data processing regulated by GDPR and sector-specific financial regulation. Enforcement: Commission Nationale pour la Protection des Données (CNPD - Luxembourg) is Luxembourg's independent data protection supervisory authority. The CNPD is Luxembourg's representative on the European Data Protection Board (EDPB) and participates in the EDPB's one-stop-shop mechanism for cross-border processing. Note: the Luxembourg CNPD should not be confused with the Portuguese CNPD (Comissão Nacional de Proteção de Dados) - both use the same acronym but are distinct authorities. Key Luxembourg national provisions: (1) Age of digital consent: Luxembourg has set the age of consent for information society services at 16 years (GDPR default maintained); (2) Financial sector - Luxembourg's significant financial sector (investment funds, banking, insurance) is subject to GDPR and sector-specific data protection obligations under supervision by the Commission de Surveillance du Secteur Financier (CSSF - Luxembourg Financial Regulator); CSSF and CNPD have separate but coordinated oversight roles; (3) Employment context - Luxembourg labour law (Code du Travail) provides provisions on employee data and monitoring; (4) Freedom of expression - exemptions for journalistic, literary, and artistic processing; (5) Health data - specific provisions for health data processing in Luxembourg's public health system. Fines: GDPR administrative fines apply in Luxembourg - up to EUR 20 million or 4% of global annual turnover. The CNPD has imposed significant fines including a EUR 746 million fine against Amazon Europe Core SARL (July 2021) for GDPR violations related to Amazon's advertising targeting system and data processing practices - the largest GDPR fine at the time of issuance and subsequently upheld by the Luxembourg Administrative Tribunal. The Amazon fine was reduced on appeal but remains one of the most significant GDPR enforcement actions globally.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "gdpr-article-5-data-principles",
    "coe-convention-108-plus",
    "iso-27001-2022"
  ],
  "primary_citations_count": 6
}