Luxembourg
A small nation with outsized regulatory reach — Luxembourg's CNPD oversees dozens of global platforms
Commission Nationale pour la Protection des Données·CNPD
Enforcement profile
CNPD is a small authority with outsized responsibility as lead supervisor for major US tech companies that established EU operations in Luxembourg. Investigation timelines are long but outcomes can be extreme — the Amazon €746M fine remains the largest in GDPR history. Cooperation with other EU DPAs through the one-stop-shop mechanism is central to its workflow.
Notable enforcement decisions
Largest GDPR fine ever: unlawful advertising targeting system without valid consent.
Transparency failures in user data processing disclosures.
Active regulations
The 23-kilometre network of underground fortifications carved into the Bock promontory make Luxembourg City a UNESCO World Heritage site.
Enforcement data is based on publicly available decisions and may not reflect every action, appeal, reduction, or subsequent court ruling. Fine amounts are shown as reported at the time of the decision. This information is for intelligence purposes and does not constitute legal advice.