- Enforcing jurisdiction
- Luxembourg · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Company – €18,700 Fine (Luxembourg, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A company in Luxembourg was fined €18,700 for not providing clear contact details for its Data Protection Officer (DPO) on its website. The DPO also wasn't involved enough in important data protection matters. This matters because it shows that companies must ensure their DPOs are accessible and actively involved in data protection.
What happened
The Luxembourg DPA fined a company for failing to include direct contact details for its DPO and not involving the DPO sufficiently in data protection matters.
Who was affected
Visitors to the company's website who expected to find contact information for the DPO were affected.
What the authority found
The DPA found that the company did not meet the requirements for DPO accessibility and involvement, violating GDPR rules.
Why this matters
This case highlights the importance of having a well-integrated DPO in data protection practices. Companies should ensure their DPOs are easily reachable and involved in key decisions.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA of Luxembourg has imposed a fine of EUR 18,700 on a company. During its investigation, the DPA first found that the controller's public website did not include direct contact details for the DPO. Furthermore, the DPO was not sufficiently involved in all data protection matters. For example, they only participated in internal meetings by invitation. Moreover, there were several hierarchical intermediaries between the DPO and the highest management level of the controller, not granting them sufficient autonomy. Also, in the absence of formalized procedures, the DPO was not able to sufficiently monitor the consistency of data processing practices.
Related Enforcement Actions (0)
No other enforcement actions found for Company in LU
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
27 October 2021
Authority
Commission Nationale pour la Protection des Données
Fine Amount
€18,700
GDPRhub ID
gdprhub-4380About this data
Cite as: Cookie Fines. Company - Luxembourg (2021). Retrieved from cookiefines.eu
Last updated: