According to Article 33 of the GDPR, in the case of a personal data breach, the controllers shall, without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the CNPD, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 

In order to help controllers in their compliance process, the CNPD has developed a notification form for personal data breaches.

Notification of personal data breaches can be sent to the email address: databreach@cnpd.lu. 

The controller may use the public key provided by the CNPD to secure the transmission of information by encryption.