CNPD - Commission nationale pour la protection des données

What CNPD - Commission nationale pour la protection des données does

The Commission nationale pour la protection des données (CNPD) is Luxembourg's national data protection authority, established in its current form under the law of August 1, 2018, which aligned Luxembourg's framework with the EU General Data Protection Regulation (GDPR). It operates as an independent public establishment under the supervision of the Minister for Communications and Media (Elisabeth Margue), exercising statutory powers to investigate, sanction, certify, and advise on data protection matters within Luxembourg. The commission is led by President Tine A. Larsen, alongside commissioners Thierry Lallemang, Alain Herrmann, and Florent Kling, supported by reserve commissioners and approximately 54 staff, headquartered at 15, Boulevard du Jazz in Belvaux.

CNPD's core activities span enforcement (complaints handling, investigations, administrative fines up to €25,000), preventive guidance (opinions, thematic dossiers on payment service providers and communal administrations), and compliance tooling. Its product portfolio includes the Sandkëscht regulatory sandbox, the DAAZ self-assessment tool, the GDPR-CARPA certification scheme under Article 42, the DaProLab knowledge-exchange and research platform (jointly with CNIL and ICO), the RE.M.I. AI governance initiative with AI Factory, the Leonora youth education toolkit under the WTOON European project, and digital services such as complaint forms, breach notification forms, DPO declarations, and a whistleblowing platform mandated by Directive (EU) 2019/1937.

The organization's business model is non-commercial: CNPD is funded through the Luxembourg state budget rather than fees or charges, and operates with no traditional go-to-market motion. Distribution is domestic and conducted through its multilingual website (French, English, German), telephone support, physical mail, and newsletter (via Flexmail NV). CNPD participates actively in EDPB High-Level Meetings and international forums, and has issued 92+ formal decisions and deliberations across recent years.

Name

CNPD - Commission nationale pour la protection des données

Legal name

Commission nationale pour la protection des données

Website

https://cnpd.public.lu

Company type

Private

Founded year

2018

Operating status

Operating

Headcount range

51–100 employees

Short description

CNPD is Luxembourg's national data protection authority, exercising GDPR-mandated supervisory, investigative, sanctioning, and certification powers over organizations and individuals processing personal data within Luxembourg.

Ownership category

akta.pro rank

Headquarters

HQ city

Belvaux

HQ country

Luxembourg

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Infrastructure, Marketing or Sales

Revenue model

1. Government funding: As a public establishment under state supervision, CNPD is funded through the Luxembourg state budget rather than commercial revenue generation.

Go-to-market motion1 record

Distribution channels3 records

Marketing channels5 records

Core offering

CNPD is Luxembourg's national data protection authority that supervises GDPR and national data protection law compliance. It handles complaints from data subjects, conducts investigations, issues decisions and administrative fines, approves codes of conduct and certifications, and provides compliance tools, guidance, and educational resources to controllers and processors.

Product overview

CNPD (Commission nationale pour la protection des données) is Luxembourg's national data protection authority operating under the GDPR. Rather than a single commercial product, CNPD provides a portfolio of compliance support services and digital tools: compliance tools including RE.M.I. (AI community initiative), DAAZ (self-assessment tool), Sandkëscht (regulatory sandbox), and GDPR-CARPA (certification scheme); educational resources including the Leonora toolkit for youth digital literacy; training programmes such as DaProLab; and digital services including complaint forms, data breach notifications, DPO declarations, and a whistleblowing platform. CNPD also provides guidance on obligations, handles complaints, conducts investigations, and issues decisions and opinions on data protection matters.

Differentiator

Problem solved

Functional benefit

Brands

• Leonora: A toolkit launched by CNPD to raise young people's awareness of digital issues and data protection, developed under the European WTOON project with educational resources including webtoons, videos, and interactive games.
• DaProLab
• RE.M.I. - Regulation Meets Innovation
• Sandkëscht
• DAAZ - Data Accountability from A to Zen

Products and services

• RE.M.I. (Regulation Meets Innovation) Community initiative by CNPD and AI Factory fostering structured dialogue between AI stakeholders, regulators, and experts in Luxembourg to promote responsible AI development.
• Sandkëscht (Regulatory Sandbox) Regulatory sandbox allowing organizations to test innovative products or services in a controlled environment under CNPD supervision, with relaxed regulatory requirements during testing.
• DAAZ (Data Accountability from A to Zen) Self-assessment tool helping data controllers and processors evaluate and improve their data protection compliance posture through practical exercises and guidance.
• Leonora Educational Toolkit Educational toolkit for adolescents aged 12-16 including webtoons, videos, LMS platform with modules and quizzes, interactive digital games, and card games, developed under the WTOON European project to raise awareness about data protection and digital citizenship.
• GDPR-CARPA Certification Scheme CNPD-led certification scheme for data protection compliance under Article 42 GDPR, including criteria for certification and accreditation of certification bodies.
• Codes of Conduct Framework Framework for developing and approving codes of conduct under GDPR Article 40 to help sectors and associations demonstrate compliance with data protection rules.
• DaProLab Training Programme Knowledge exchange and training sessions for data protection professionals covering compliance topics, regulatory updates, and practical workshops.
• ALTO Self-Assessment Tool for SMEs Pilot project in collaboration with LHC-NC3 providing a self-assessment instrument for SMEs to evaluate GDPR compliance.
• Whistleblowing Platform Internal and external reporting channels for whistleblowers to report data protection violations under Directive (EU) 2019/1937, with protection against retaliation.
• Online Complaint Form Online form for data subjects to file complaints about alleged GDPR violations, facilitating submission and processing by CNPD.
• Data Breach Notification Form Form for data controllers to notify CNPD of personal data breaches within 72 hours per GDPR Article 33, with GPG encryption option for secure transmission.
• DPO Declaration Form Form for organizations to declare their Data Protection Officer (DPO) contact details to CNPD as required under GDPR Articles 37-39.
• Newsletter Email newsletter service delivering updates on events, publications, guidance, and CNPD activities to subscribers, managed via Flexmail NV.

Named customers2 records

Segments4 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Six partnerships are on record, tiered core and minor.

• CNIL (France)coreStrategic or Co-development Partner · 6 July 2026Joint research collaboration through DaProLab project on 'Evaluating the impact of data protection compliance on financial results'. The study combines economic analysis expertise from CNIL's Analysis Economics department with CNPD's Trust Devices division.
• ICO (UK)coreStrategic or Co-development Partner · 6 July 2026Collaborative research partnership through DaProLab on the financial impact study. ICO's Economic Analysis team works alongside CNPD and CNIL researchers.
• AI FactorycoreStrategic or Co-development Partner · 1 January 2026Collaboration for the RE.M.I. (Regulation Meets Innovation) initiative, designed to foster structured dialogue between AI stakeholders, regulators, and experts across Luxembourg.
• LHC-NC3 (Luxembourg House of Cybersecurity - National Cybersecurity Competence Center)minorStrategic or Co-development PartnerPartner in the ALTO project pilot phase for developing self-assessment tools for SMEs regarding GDPR compliance. CNPD and LHC-NC3 exchange information with participating institutions.
• WTOON ConsortiumcoreStrategic or Co-development PartnerEuropean project coordinated by CNPD, supported by the European Citizens, Equality, Rights and Values (CERV) programme. Involves developing educational tools for youth on digital privacy.
• EDPB (European Data Protection Board)coreStrategic or Co-development PartnerCNPD actively participates in EDPB activities, including High-Level Meetings, coordinated enforcement frameworks, and working groups on data protection harmonization.

Scale indicators3 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• CNPD Portugal (Comissão Nacional de Proteção de Dados): Portugal's national data protection commission, sharing the CNPD acronym. Comparable in mandate, statutes, and role enforcing GDPR and Portuguese data protection law within the EU/EEA framework.
• ICO (Information Commissioner's Office): The UK's information rights regulator, including data protection enforcement. Joint research partner with CNPD via DaProLab; directly comparable in scope of guidance, complaints handling, and supervisory powers.
• Garante per la protezione dei dati personali (Italy): Italy's data protection authority enforcing the Codice Privacy and GDPR. Comparable national-level mandate on guidance, certification, and enforcement — a direct peer among the larger EU-27 national DPAs.
• CNIL (Commission Nationale de l'Informatique et des Libertés): France's national data protection authority — the most directly comparable functional peer to CNPD. Recently partnered with CNPD on the DaProLab joint research project (financial impact of compliance) and shares the same role within the EU/EEA coordination framework.
• BfDI (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit): Germany's federal data protection commissioner, the largest EU national DPA by staffing. Comparable in mandate and statutory authority, and a key counterpart for EDPB coordination alongside CNPD.
• APD Belgium (Gegevensbeschermingsautoriteit / Autorité de protection des données): Belgium's data protection authority, a directly comparable EU national DPA in a neighboring jurisdiction. Enforces GDPR for both private and public organizations with similar investigation, guidance, and sanctioning functions.
• AEPD (Agencia Española de Protección de Datos): Spain's national data protection agency, enforcing LOPDGDD and GDPR. Comparable in advisory, supervisory, and sanctioning functions across a similarly-sized EU member-state jurisdiction.
• AP (Autoriteit Persoonsgegevens): The Netherlands' data protection authority enforcing AVG/GDPR. Comparable in supervisory mandate, sanctioning powers, and role as a member-state authority within the EU/EEA coordination framework.
• DPC (Data Protection Commission, Ireland): Ireland's data protection regulator, particularly active in cross-border Big Tech enforcement. Comparable mandate and a frequent counterpart in EDPB coordinated actions referenced in CNPD's international engagement.

Broad incumbents

• EDPB (European Data Protection Board): EU-level coordination body that CNPD actively participates in via High-Level Meetings, coordinated enforcement frameworks, and working groups. Operates broader cross-EU harmonization rather than single-state enforcement.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat3 records

Key risks5 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/cnpd---commission-nationale-pour-la-protection-des-donn-es

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CNPD - Commission nationale pour la protection des données