Luxembourg

• Lawful basis for processing personal data of EU residents
• Data subject rights: access, rectification, erasure, portability, objection
• Data Protection Impact Assessments (DPIAs) for high-risk processing
• +4 more requirements

• Risk management measures for network and information systems
• Incident reporting: 24h early warning, 72h notification to CSIRT
• Supply chain security assessments
• +3 more requirements

• Double materiality assessment (impact materiality + financial materiality)
• Report against ESRS (European Sustainability Reporting Standards) - 12 standards
• Digital tagging in XHTML with iXBRL markup
• +4 more requirements

A formal complaint has been filed with Luxembourg's data protection authority (CNPD) against Amazon for alleged GDPR violations related to automated decision-making in e-recruitment. The complaint highlights opaque algorithms rejecting workers without transparency or recourse, invoking GDPR Article 22 protections. This signals increased regulatory scrutiny of AI in hiring and potential fines for non-compliance.