Luxembourg

Accounting company

5,000 €

GDPR enforcement action by National Commission for Data Protection (CNPD) on 2025-12-16.

Rank · Sector

#252

of 343 in Finance, Insurance and Consulting

Rank · Luxembourg

#17

of 38

Rank · All fines

#1,987

of 3,267

Case details

Authority: National Commission for Data Protection (CNPD)
Date: 2025-12-16
Controller / Processor: Accounting company
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 30 (1) a), c), e), f) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The DPA of Luxembourg has imposed a fine of EUR 5,000 on an accounting company. The DPA opened an investigation into the controller's processing activities. The register of processing activities was an Excel file that the controller had kept since before the GDPR came into force. The register did not adequately name the DPO and two of the registered processing activities had the address of another entity instead of the controller's own. One of the descriptions for the processing activities was incomplete and two were found to be inadequately vague. For one processing activity, the retention period was not adequately specified.

Open original source Links to the regulator's original publication or another source.