Expertise · Data protection
GDPR & personal
data protection
lawyer
Luxembourg & Greater Region. Precise legal support, grounded in the operational reality of organisations.
- GDPR · Regulation (EU) 2016/679
- CNPD Luxembourg
- CNIL France
- International transfers
- Data breaches
End-to-end
GDPR support
From the initial mapping of processing activities to breach management and relations with supervisory authorities, Mangrove covers the full GDPR spectrum.
Initial compliance
Audit, record of processing activities, GDPR documentation, data protection officer.
Impact assessments (DPIA)
Carrying out and validating DPIAs for high-risk processing.
Data subject rights
Response procedures, handling of access, erasure and portability requests.
Data breaches
Qualification, notification to the CNPD within 72 hours, communication to the data subjects.
Contracts & DPAs
Drafting and negotiation of Data Processing Agreements and Standard Contractual Clauses (SCCs).
How we work
Assessment
Analysis of your situation, identification of priority risks and of the scope of work.
Mapping
Inventory of all data processing, legal bases and retention periods.
Action plan
Prioritisation of measures, compliance roadmap, drafting of documents.
Ongoing follow-up
Long-term support, regulatory monitoring, documentation updates.
Frequently asked questions
The questions our clients ask most often about GDPR compliance in Luxembourg.
Does the GDPR apply to my organisation?
Any organisation processing personal data of individuals in the EU is concerned, whatever its size. Obligations vary according to the volume and sensitivity of the processing.
Do I need to appoint a DPO?
Appointment is mandatory for public authorities and for organisations carrying out large-scale monitoring or processing sensitive data. An outsourced DPO is often the most suitable solution.
What are the risks of non-compliance?
Fines can reach 20 million euros or 4% of annual worldwide turnover. Beyond fines, reputation and the trust of partners are at stake.
How long does a compliance project take?
An initial compliance project generally takes 2 to 6 months depending on the complexity of the processing. Maintaining compliance is then an ongoing process.
Need a GDPR
audit?
Initial consultation in strict confidence.