ITER/LULuxembourg
What the record establishes for Luxembourg: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Commission Nationale pour la Protection des Données reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The Institut Luxembourgeois de Régulation, which organizes the regime and receives the notifications provisional | https://serima.lu/notificationchecked 2026-09-03 SERIMA, and it is the only channel in this record that is not only for one instrument. The same portal takes the notifications owed under NIS2, the GDPR, the electronic communications regime and CER, and it was built jointly by the Institute, the Commission nationale pour la protection des données, the Haut-Commissariat à la Protection nationale and the Luxembourg House of Cybersecurity. The notification module is open to everyone: an entity without an account can create one on the spot, which is the opposite of the credential problem in the Netherlands, Croatia and Poland. | lu communique nis2 · ilr serima |
| Financial supervisorDORA, article 19 | Commission de Surveillance du Secteur Financier reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Commission de Surveillance du Secteur Financier (CSSF) reported | — | esma mar nca |
Transposition of NIS2 provisional
| Act | Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité |
|---|---|
| In force | not stated in the source read |
| Recipient | The Institut Luxembourgeois de Régulation, which organizes the regime and receives the notifications |
| Moves a term | No. Nothing recorded moves a term, and only one term is recorded. The government's own announcement gives the first stage, «tout incident ayant un impact important dans un délai de 24 heures» as a preliminary notification, and stops there. It does not say what the twenty-four hours run from, and it does not give the stages after the first. |
| Standing | A government communiqué about the law, not the law. This record therefore holds one interval for Luxembourg and neither the anchor nor the rest of the cascade. The same position as France, and recorded the same way. |
| Source | lu communique nis2 |
An event in Luxembourg
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.