INTRA/LULuxembourg
What the record establishes for Luxembourg, measure by measure, and what each source requires of the measure it governs.
| Control | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|
| 12Mandatory | |||
| AW002/LUTransparency notice on what is observedMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026Délibération n° 1FR/2022Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | Beside the individual information of articles 12 and 13, the staff representation receives collective prior information of the purpose, the modalities, the retention, and the undertaking not to use the data for another purpose. Information is given in two layers, a sign and the full content of article 13. Employees are informed individually, with the controller’s identity and contact details, the DPO’s contact details, the purposes, the legitimate interests or the legal basis, the recipients, the retention per purpose, and their rights. |
| CP004/LUReliance on material obtained in breachMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | Breach of article L.261-1 is a criminal offence, eight days to one year of imprisonment and a fine of EUR 251 to 125,000, and the court may order the processing to cease on penalty; whether a court admits evidence so obtained is not stated by the article. |
| DP004/LUAccess control and least privilegeMandatory | Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026 | That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks. | Access to the geolocation software is by individual accounts, identifier and password, created only for the persons for whom access is strictly necessary to their tasks; shared accounts breached article 32. |
| DP012/LURetention and disposal of program recordsMandatory | Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de géolocalisation des véhicules mis à la disposition des salariésCommission nationale pour la protection des données · read 5 Oct 2026 | That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks. | Location data are kept two months at most; where the system is the only means of checking working time, three years (five in the public sector); where used as billing evidence, the necessary data one year. Location data kept two years and four months for tracking, protection of goods, and working time exceeded the purposes; the retention is set per purpose, two months, one year for billing, three years for working time. |
| DP013/LUSeparation of program dataMandatory | Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026 | That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks. | Individual accounts on the monitoring system only for those whose tasks strictly require access. |
| GV007/LULawful basis registerMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | Processing for the surveillance of employees in the employment relationship rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, and the employer undertakes formally not to use the data for a purpose other than the one stated in the prior information. |
| GV010/LUWorker representative engagementMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | Before surveillance is introduced the délégation du personnel, or failing one the Inspection du travail et des mines, is informed collectively of the purpose in detail, the modalities of the system, the retention period or criteria, and the formal undertaking not to use the data otherwise; within 15 days the délégation, or failing it the employees concerned, may ask the CNPD for a prior opinion on the project, which suspends it until the CNPD rules within one month; where the surveillance serves health and safety, control of production or performance as the only means of fixing exact pay, or flexible working hours, articles L.211-8 and L.414-9 apply. |
| GV014/LUAnswering a request from the personMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | A complaint to the CNPD by an employee concerned is neither a grave nor a legitimate ground of dismissal. |
| IV001/LUInternal reporting channelMandatory | Loi du 16 mai 2023 portant transposition de la directive (UE) 2019/1937Chambre des Députés · read 5 Oct 2026 | That private-law legal persons with 50 or more workers over twelve consecutive months, and public ones, establish channels and procedures for internal reporting and follow-up, that those of 50 to 249 may share resources and were reached from 17 December 2023, that the channel may be run by a designated person or service or by a third party, that it is designed so as to guarantee the confidentiality of the reporter and of any third party named and to bar unauthorized staff, that receipt is acknowledged within seven days, that an impartial person or service follows up, and that feedback comes within three months of the acknowledgement. | A private-law legal person with 50 or more workers over twelve consecutive months, and a public one, has channels and procedures for internal reporting and follow-up, run by a designated person or service or by a third party, designed to guarantee the confidentiality of the reporter and of any third party named and to bar unauthorized staff; receipt is acknowledged within seven days, an impartial person or service follows up, and feedback comes within three months; those of 50 to 249 may share resources and were reached from 17 December 2023. |
| MD014/LUVideo surveillance of the workplaceMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026Délibération n° 1FR/2022Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | Video surveillance aimed at employees is surveillance under article L.261-1 and follows its information and prior-opinion procedure. Employees have in principle the right not to be under continuous and permanent surveillance; the inside of an office, an open space, a workshop, or a restaurant kitchen with permanent workstations is disproportionate, a camera on a till is pointed at the till and the customers’ side, the field of view is limited to the surface the purpose needs, and no camera films toilets, changing rooms, the smoking corner, rest areas, the kitchenette, or the délégation’s room. Cameras inside the agencies of a transport company and a camera reaching a neighbouring plot breached minimisation and were ordered removed or reoriented; employees not informed individually of the controller, the DPO, the purposes, the legitimate interests, the recipients, and their rights were owed that information within four months; the fine was EUR 4,900. |
| MD015/LUGeolocation of vehicles and devicesMandatory | Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Délibération n° 1FR/2022Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de géolocalisation des véhicules mis à la disposition des salariésCommission nationale pour la protection des données · read 5 Oct 2026 | That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks. | Geolocation of a vehicle given to an employee is always surveillance under article L.261-1; the employer does not monitor the employee outside working hours, leave, sick days, lunch breaks, home-to-work trips, medical visits, and weekends included; a vehicle also used privately carries a deactivation in the employee’s hands, and a vehicle for professional use only may stay located permanently. Employees are informed individually of a geolocation system, its purposes, its legal basis, the retention per purpose, the recipients, and their rights. |
| MD016/LUMeasurement of pace and performanceMandatory | Code du travail, articles L.261-1 and L.261-2Chambre des Députés · read 5 Oct 2026Lignes directrices en matière de géolocalisation des véhicules mis à la disposition des salariésCommission nationale pour la protection des données · read 5 Oct 2026Lignes directrices en matière de vidéosurveillanceCommission nationale pour la protection des données · read 5 Oct 2026 | That processing for the surveillance of employees rests only on one of the bases of article 6(1)(a) to (f) of the Regulation, that the representation of the staff is informed collectively beforehand of the purpose, the modalities, the retention, and a formal undertaking not to use the data for another purpose, that the délégation, or failing it the employees, may within 15 days ask the CNPD for a prior opinion with suspensive effect, the CNPD ruling within one month, that for three purposes articles L.211-8 and L.414-9 apply, that a complaint to the CNPD is neither a grave nor a legitimate ground of dismissal, and that breach is a criminal offence. | Location data are not used to observe performance or behaviour outside the initial purposes; a system installed against theft does not serve to check speeding, time between clients, or the route taken. Checking that employees work and do not spend too long on their phones, keep their hours, follow instructions, or behave appropriately with customers are not purposes a camera can pursue. Control of the production or performance of the employee as the only means of fixing exact pay is one of the three purposes for which articles L.211-8 and L.414-9 apply. |