# Accounting company: Non-compliance with general data processing principles

- Type: Enforcement
- Source: National Commission for Data Protection (CNPD)
- Date: 2025-12-16
- Original: https://www.enforcementtracker.com/ETid-3400
- Canonical: https://overview.legal/posts/607210
- Topics: Records of processing activities, Accountability, Processing, Supervision, Pseudonymization, Insurance

## Summary

The Luxembourg National Commission for Data Protection (CNPD) fined an unnamed accounting company €5,000 for non-compliance with general data processing principles, specifically regarding failures under Article 30(1) obligations to maintain records of processing activities. The enforcement action, issued on December 16, 2025, concerned the finance and consulting sector.

## Full text

National Commission for Data Protection (CNPD) fined Accounting company €5,000 on 2025-12-16 for: Non-compliance with general data processing principles.
GDPR Articles: Art. 30 (1) a), c), e), f) GDPR
Sector: Finance, Insurance and Consulting
Country: Luxembourg
Source: https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2025/dcision-nr-5fr-2025-version-pseudonymise.pdf

## Cited law provisions (2)

### GDPR — gdpr-art-30-par-1-en

Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:

### GDPR — gdpr-art-30-en

Records of processing activities

---
Generated by overview.legal · https://overview.legal/posts/607210 · 2026-11-14