Luxembourg

Private security company

2,780 €

GDPR enforcement action by National Commission for Data Protection (CNPD) on 2025-12-16.

Rank · Sector

#440

of 657 in Industry and Commerce

Rank · Luxembourg

#20

of 38

Rank · All fines

#2,311

of 3,267

Case details

Authority: National Commission for Data Protection (CNPD)
Date: 2025-12-16
Controller / Processor: Private security company
Sector: Industry and Commerce
Quoted Articles: Art. 30 (1) a), c), d), e), f), g) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The DPA of Luxembourg has imposed a fine of EUR 2,780 on a private security company. The authority requested the personal data processing register during an investigation into the controller. During the course of the investigation, the controller sent seven versions of the register to the DPA, containing 51 processing activities. The authority deemed the first register to be definitive. It was found that the controller and DPO's information was not adequately provided. For ten processing activities, no data category was given. For six activities, no recipient was given. There was no information on third-party transfers. Erasure periods were largely missing. Information on security measures was missing for five processing activities.

Open original source Links to the regulator's original publication or another source.