Esch-Belval, 22 September 2025 – The CNPD presented its 2024 annual report at a press conference today, highlighting key figures and major developments over the past year.
Ubiquitous technology, fundamental challenges
Artificial intelligence, once confined to research laboratories, has become part of our everyday lives. Algorithms analyse massive amounts of data to offer personalised recommendations, while intelligent robots are transforming entire sectors. This development raises major issues in terms of personal data protection, which has become essential to the functioning of AI systems.
The CNPD proposed as the competent authority for the AI Act
Having developed its AI expertise over recent years, the CNPD was proposed at the end of 2024 as the competent authority and coordinator for the national implementation of the European regulation on artificial intelligence, the AI Act, adopted on 13 March 2024. This text aims to promote trustworthy AI while ensuring respect for fundamental rights.
The bill tabled on 29 November 2024 provides for the CNPD to assume several key roles:
- Single point of contact and national coordination of competent authorities
- Default market supervisory authority
- Authority responsible for fundamental rights, alongside ALIA and ITM
- Responsible for setting up a regulatory sandbox
Demystifying AI and empowering stakeholders
The CNPD did not wait for the AI Act to take action. On 24 May 2024, it launched Sandkëscht, a secure environment enabling companies to test their digital innovations, particularly those based on AI, in compliance with the GDPR.
In December, it launched the DP4AI – Data Protection Basics: Artificial Intelligence training course to introduce participants to the fundamentals of AI and its implications for data protection.
Throughout the year, the CNPD participated in numerous AI events and organised six DaProLabs workshops, bringing together AI experts and data protection professionals to discuss best practices and regulatory challenges.
Preparation for the implementation of the Data Governance Act (DGA)
At the same time, the CNPD has launched an internal project to prepare for its future tasks under the Data Governance Act (DGA). Draft bill 8395A designates the CNPD as the competent authority for data intermediation and altruism. This initiative aims to develop the necessary skills and ensure a smooth transition to these new European responsibilities.
A year full of milestones
Beyond artificial intelligence, 2024 saw several major advances:
- Launch of DAAZ (‘Data Accountability from A to Zen’), an e-learning platform co-funded by the European Union, aimed at SMEs and start-ups, to help them understand and apply the GDPR in their daily operations.
- Approval of the first sectoral code of conduct in Luxembourg, dedicated to temporary work, developed by the FSI and Fedil Employment Services, to adapt the GDPR to the specificities of the sector.
- Launch of a secure channel for whistleblowers, enhancing transparency and accountability within organisations.
- Publication of recommendations on key topics: video surveillance, election campaigns, cybersecurity, transparency in online services, as well as analyses of data breaches and processing related to the Covid-19 pandemic.
- Online campaign ‘Your data, your rights!’, launched in January 2024, to raise public awareness of individual data protection rights.
New benchmarks for an evolving authority
Present in all sectors where personal data is processed, the CNPD has a cross-cutting view of the challenges associated with digital developments. This central position comes with increasing responsibility and high expectations from citizens, businesses and institutions.
Faced with these challenges, the CNPD remains committed to rigorous personal data protection and a culture based on respect, transparency and the security of private information. Resolutely forward-looking, it adapts its methods, strengthens its skills and keeps pace with technological developments in order to fulfil its mission.