Luxembourg

Europe

Active Alerts

Tracked Regulations

GDPR (General Data Protection Regulation)

data-privacy

Lawful basis for processing personal data of EU residents
Data subject rights: access, rectification, erasure, portability, objection
Data Protection Impact Assessments (DPIAs) for high-risk processing
+4 more requirements

Up to EUR 20 million or 4% of global annual turnover, whichever is higher

NIS2 Directive

cybersecurity

Risk management measures for network and information systems
Incident reporting: 24h early warning, 72h notification to CSIRT
Supply chain security assessments
+3 more requirements

Deadline: 2024-10-17Up to EUR 10 million or 2% of global annual turnover for essential entities; EUR...

CSRD (Corporate Sustainability Reporting Directive)

esg

Double materiality assessment (impact materiality + financial materiality)
Report against ESRS (European Sustainability Reporting Standards) - 12 standards
Digital tagging in XHTML with iXBRL markup
+4 more requirements

Deadline: 2025-01-01Determined by EU member states; may include fines, public reprimand, and reporti...

Recent Regulatory Alerts

Luxembourg CSSF 26/906: Annual Compliance Attestation for FinTechs and PayTechs

MEDIUM

fintech

CSSF Circular 26/906 requires management body members of certain Luxembourg FinTechs and PayTechs to sign an annual written statement confirming full compliance. The circular is effective from 30 June 2026, with first attestation due in Q1 2027, shifting personal accountability to individuals.

CSSF Circular 26/906Commission de Surveillance du Secteur Financier (CSSF)July 6, 2026Source

GDPR Enforcement Action: Complaint Against Amazon for Automated Hiring Algorithm Violations

MEDIUM

B2C2's MiCA Authorisation: A Blueprint for Crypto Compliance in the EU

B2C2's MiCA authorisation from Luxembourg's CSSF marks a milestone in EU crypto regulation. This article analyses the MiCA framework, authorisation requirements, and what it means for firms seeking crypto compliance in the EU, with comparisons to US regulatory developments.

BLOG POST

May 15, 2026

A formal complaint has been filed with Luxembourg's data protection authority (CNPD) against Amazon for alleged GDPR violations related to automated decision-making in e-recruitment. The complaint highlights opaque algorithms rejecting workers without transparency or recourse, invoking GDPR Article 22 protections. This signals increased regulatory scrutiny of AI in hiring and potential fines for non-compliance.