Complaints in the context of the DGA
Under the Data Governance Act (DGA) natural and legal persons are allowed to lodge a complaint where they consider that a data intermediation services provider or a data altruism organisation does not comply with the obligations laid down in the Regulation.
In Luxembourg, in accordance with the Law of 19 Decembre 2025, the CNPD is the competent authority for data intermediation services and data altruism. Any natural or legal person can thus lodge a complaint with the CNPD in case of an alleged infringement of the DGA.
To contact the “DGA” Department, please send an e-mail to dga@cnpd.lu.
Exercising your rights with the data controller
In accordance with the General Data Protection Regulation (GDPR) and the Act of 1 August 2018 on the protection of individuals with regard to the processing of personal data in criminal and national security matters (link), you may exercise your right of access and your rights to rectification, erasure and restriction of processing at any time with the data controller (i.e. the organisation that processes your personal data or on whose behalf your personal data is processed) as soon as your data is collected, recorded, used or processed.
To exercise your rights, you may send your request in writing (preferably by registered post). The data controller can, in principle, not charge a fee when you exercise your rights. Where the data controller has reasonable doubts about your identity, the data controller may ask you for additional information necessary to confirm your identity.
File a complaint with the CNPD
If the data controller has not responded to your request based on the GDPR or the Act of 1 August 2018 on the protection of individuals with regard to the processing of personal data in criminal and national security matters or if such a complaint proves difficult or impossible given the circumstances, you can contact the CNPD. One of its duties is to process complaints from data subjects.
During the complaint procedure, the CNPD first examines whether a complaint is justified, i.e. it verifies whether the facts alleged by the complainant relating to the processing of personal data are likely to constitute a violation of the applicable data protection legislation. Where the CNPD considers that the disputed data processing does indeed contravene the legislation, it will endeavour to remedy the situation without resorting to the coercive measures available to it under its statutory powers.
The CNPD may prohibit data processing in the event of non-compliance with the law. It may also order the deletion of data and refer the matter to the public prosecutor. Penalties may be imposed in the event of an infringement.
If you wish to lodge a national complaint, we strongly recommend that you use the CNPD's online form. Using this form will speed up the processing of your complaint.
You can also choose to print and fill in the form by hand.
In this case, please send it to the following address:
Commission nationale pour la protection des données
Service des réclamations
15, Boulevard du Jazz
L-4370 Belvaux
Information on the processing of personal data
If you have any questions, please contact the CNPD.
Exercising of your rights through the CNPD
If your request for access, rectification or erasure has been refused, or if your rights have been restricted, either in whole or in part, by the data controller, you can exercise your rights through the CNPD in accordance with the Act of 1 August 2018 on the protection of individuals with regard to the processing of personal data in criminal and national security matters.
In this case, the CNPD will review your case, carry out the necessary verifications with the data controller, and must subsequently inform you, at least, that such verifications or reviews have taken place.
To exercise your rights indirectly through the CNPD, please fill out the complaint form available above. In the section titled "Subject matter of the complaint," select "Other" and briefly state that you wish to exercise your rights indirectly, specifying the right concerned.
Referral to the court
If you are not satisfied by the actions taken by the National Commission, you are still entitled to apply to the court. In this case, it may be necessary to contact a lawyer who can advise you.
Legal action is also essential if you want to claim damages for breach of your rights to privacy.