# Private security company: Non-compliance with general data processing principles

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2025-12-16
- Original: https://www.enforcementtracker.com/ETid-3399
- Canonical: https://overview.legal/posts/607209
- Topics: Records of processing activities, Accountability, Processing, Supervision, Pseudonymization

## Summary

The Luxembourg National Commission for Data Protection (CNPD) fined a private security company €2,780 on December 16, 2025, for non-compliance with general data processing principles under Article 30 of the GDPR. The enforcement action addressed the company's failure to meet its obligations regarding records of processing activities. This decision reflects CNPD's ongoing oversight of data protection compliance within the private security sector.

## Full text

National Commission for Data Protection (CNPD) fined Private security company €2,780 on 2025-12-16 for: Non-compliance with general data processing principles.
GDPR Articles: Art. 30 (1) a), c), d), e), f), g) GDPR
Sector: Industry and Commerce
Country: Luxembourg
Source: https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2025/dcision-nr-4fr-2025-version-pseudonymise.pdf

## Cited law provisions (2)

### GDPR — gdpr-art-30-par-1-en

Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:

### GDPR — gdpr-art-30-en

Records of processing activities

---
Generated by overview.legal · https://overview.legal/posts/607209 · 2026-11-14