# LUXEMBOURG DPA: Insufficient involvement of data protection officer

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2021-10-13
- Original: https://www.enforcementtracker.com/ETid-895
- Canonical: https://overview.legal/posts/47010
- Topics: Supervisory Authorities, Controllers, Processing Agreement, Personal Data, Law Enforcement, Data Controller

## Summary

The DPA from Luxembourg has imposed a fine of EUR 13,200 on a company. According to the DPA, the controller firstly failed to involve the data protection officer in all matters relating to the protection of personal data. Second, the controller did not have a data protection control plan in place to demonstrate that the data protection officer was adequately performing its tasks.

## Full text

The DPA from Luxembourg has imposed a fine of EUR 13,200 on a company. According to the DPA, the controller firstly failed to involve the data protection officer in all matters relating to the protection of personal data. Second, the controller did not have a data protection control plan in place to demonstrate that the data protection officer was adequately performing its tasks.

GDPR Articles: Art. 38 (1) GDPR, Art. 39 (1) b) GDPR
Industry: Not assigned

---
Generated by overview.legal · https://overview.legal/posts/47010 · 2026-08-22