ITER/LULuxembourg
What the record establishes for Luxembourg: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Commission Nationale pour la Protection des Données reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The Institut Luxembourgeois de Régulation, which organizes the regime and receives the notifications provisional | https://serima.lu/notificationchecked 2026-09-03 SERIMA, and it is the only channel in this record that is not only for one instrument. The same portal takes the notifications owed under NIS2, the GDPR, the electronic communications regime and CER, and it was built jointly by the Institute, the Commission nationale pour la protection des données, the Haut-Commissariat à la Protection nationale and the Luxembourg House of Cybersecurity. The notification module is open to everyone: an entity without an account can create one on the spot, which is the opposite of the credential problem in the Netherlands, Croatia and Poland. | lu communique nis2, ilr serima |
| Financial supervisorDORA, article 19 | Commission de Surveillance du Secteur Financier reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Commission de Surveillance du Secteur Financier (CSSF) reported | — | esma mar nca |
Transposition of NIS2 provisional
| Act | Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Mémorial A n° 225 du 6 mai 2026 |
|---|---|
| In force | Published 6 May 2026. The text read carries no commencement article; the Institute states the duty as running, without a date |
| Recipient | The competent authority, to which article 14(4) owes the submissions; the Institut Luxembourgeois de Régulation states that it is that authority, save for the sector the CSSF supervises |
| Moves a term | No. None. Article 14(4) owes the preliminary notification «dans les vingt-quatre heures après avoir eu connaissance de l'incident important», the incident notification «dans les soixante-douze heures» on the same footing, an interim report on request, and «un rapport final au plus tard un mois après la présentation de la notification d'incident»; where the incident is still running then, a progress report and the final report within one month of its handling. Trust service providers have twenty-four hours for the second stage. |
| Standing | Read in the law as published in the Mémorial. The report is owed to the competent authority, not to a CSIRT; which authority depends on the sector. |
| Source | lu communique nis2 |
An event in Luxembourg
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.