Contact
Share
Discover our News & Publications
Posted on 19 October 2026 in News > > Media, Data & Technologies

Newsflash – Cyberincidents au Luxembourg : cinq enseignements juridiques issus des nouvelles recommandations opérationnelles

Dans le contexte de la loi luxembourgeoise du 5 mai 2026 mettant en œuvre le cadre européen de cybersécurité NIS2 [1], de nouvelles recommandations opérationnelles ont été publiées le 28 septembre 2026 afin d’aider les organisations à faire face aux cyberincidents malveillants.

Le guide intitulé Operational Guidance for Incident Handling (le « Guide ») [2] a été publié conjointement par l’Agence nationale de la sécurité des systèmes d’information (« ANSSI »), l’autorité de surveillance du secteur financier (« CSSF »), le Computer Incident Response Center Luxembourg (« CIRCL »), l’équipe gouvernementale de réponse aux incidents informatiques (« GovCERT »), le Haut-Commissariat à la protection nationale (« HCPN ») et l’Institut luxembourgeois de régulation (« ILR ») (collectivement, les « Autorités »).

Champ d’application du Guide

Le Guide constitue un outil pratique destiné aux organisations confrontées à un cyberincident malveillant. Il comprend un cadre général d’évaluation initiale et d’orientation des incidents, suivi de huit protocoles spécifiques couvrant :

  • les attaques par déni de service ;
  • les logiciels malveillants (y compris les rançongiciels) ;
  • les attaques utilisant les canaux de communication (telles que le phishing ou hameçonnage) ;
  • le vol d’identifiants et la compromission de comptes ;
  • l’exploitation de vulnérabilités ;
  • les menaces internes ;
  • l’exfiltration de données ; et
  • les attaques affectant la chaîne d’approvisionnement informatique.

Les erreurs humaines et les défaillances des systèmes ne relèvent pas du champ d’application du Guide.

Le Guide ne remplace pas les politiques et procédures internes et, surtout, ne traite pas des obligations légales découlant d’un cyberincident (par exemple, le dépôt d’une plainte ou les notifications à la CSSF, à l’ILR ou à la CNPD). Ces obligations doivent donc faire l’objet d’une analyse distincte.

Cinq enseignements juridiques clés

  • Prendre en compte les délais de notification dès l’évaluation initiale de l’incident. Le Guide prévoit que les délais de notification obligatoires (notamment ceux découlant de NIS2, du règlement sur la résilience opérationnelle numérique (« DORA ») et des réglementations sectorielles) doivent être pris en considération dès la phase initiale d’évaluation de l’incident. L’analyse juridique correspondante doit donc être menée parallèlement à la réponse technique, dès le premier jour.
  • Un cyberincident peut également constituer une violation de données à caractère personnel. En cas d’exfiltration de données à caractère personnel, le Guide recommande une coordination avec le délégué à la protection des données (« DPO »), en faisant expressément référence au règlement général sur la protection des données (« RGPD »). La question de savoir si cette violation doit être notifiée à la Commission nationale pour la protection des données (« CNPD ») ou aux personnes concernées nécessite une analyse juridique de la part du DPO et des équipes chargées de la conformité et des questions juridiques.
  • Ne pas payer de rançon. En cas d’attaque par rançongiciel, le Guide indique que les organisations ne devraient pas payer la rançon, dans la mesure où ce paiement ne garantit pas la récupération des données et pourrait contrevenir aux régimes de sanctions nationaux, européens ou internationaux.
  • Les enquêtes internes doivent respecter les droits des salariés. En présence de menaces internes, les opérations de surveillance et de collecte de preuves doivent être réalisées à l’aide d’outils et de procédures approuvés, tout en respectant la législation applicable et les politiques internes. Les équipes des ressources humaines et les services juridiques devraient donc être associés dès le début des investigations.
  • Anticiper le recours à des experts externes et les dispositions contractuelles. Le Guide recommande de mobiliser rapidement, si nécessaire, des experts internes ou externes en cybersécurité, des consultants et des conseils juridiques, ainsi que d’envisager une prise de contact précoce avec des équipes externes de réponse aux incidents ou avec l’assureur cyber lorsque des accords contractuels existent. En cas d’incident affectant la chaîne d’approvisionnement informatique, il recommande également de réexaminer les risques liés aux fournisseurs et d’envisager des clauses contractuelles de sécurité ainsi que des droits de désactivation d’urgence (« kill-switch »), permettant à une organisation de désactiver un produit, une mise à jour ou un flux de données.

Prochaines étapes pour les organisations

L’efficacité du Guide dépend avant tout du niveau de préparation des organisations.

Nous recommandons de vérifier que les procédures de réponse aux incidents prévoient une remontée rapide des informations, la préservation des preuves, l’implication en temps utile des équipes juridiques, de conformité et des ressources humaines, ainsi qu’une évaluation précoce des obligations de notification.

Il est également recommandé de réexaminer dès à présent les polices de cyberassurance et les contrats conclus avec les fournisseurs informatiques, plutôt que d’attendre la survenance d’une crise.

—

[1] Loi du 5 mai 2026 relative à des mesures visant à assurer un niveau élevé de cybersécurité et portant modification de la loi modifiée du 14 août 2000 relative au commerce électronique, de la loi modifiée du 23 juillet 2016 portant création d’un Haut-Commissariat à la protection nationale et de la loi du 17 décembre 2021 sur les réseaux et les services de communications électroniques.

[2] Operational Guidance for Incident Handling, publié le 28 septembre 2026.

 

Pour en savoir plus : Media, Data & Technologies

Posted on 19 October 2026 in News > > Media, Data & Technologies

Newsflash – Cyber incidents in Luxembourg: five legal takeaways from the new operational guidance

In the context of the Luxembourg law of 5 May 2026 implementing the NIS2 cybersecurity framework [1], new operational guidance was published on 28 September 2026 to help organisations respond to malicious cyber incidents.

The Operational Guidance for Incident Handling (the “Guidance”) [2] was jointly published by the National Cybersecurity Agency (“ANSSI”), the financial sector supervisory authority (“CSSF”), the Computer Incident Response Center Luxembourg (“CIRCL”), the governmental incident response team (“GovCERT”), the High Commission for National Protection (“HCPN”) and the Luxembourg Regulatory Institute (“ILR”), (collectively the “Authorities”).

Scope of the Guidance

The Guidance is a practical tool for organisations facing a malicious cyber incident. It consists of a general triage and routing framework followed by eight incident-specific rulebooks covering:

  • denial-of-service attacks,
  • malware (including ransomware),
  • attacks through communication channels (such as phishing),
  • theft of credentials and compromised accounts,
  • exploitation of vulnerabilities,
  • insider threats,
  • data exfiltration, and
  • attacks affecting the IT supply chain.

Human error and system failures remain outside the Guidance’s scope.

The Guidance does not replace internal policies and procedures and, importantly, does not address the legal obligations triggered by a cyber incident (e.g. filing a complaint or notifying the CSSF, the ILR or the CNPD), and these remain to be assessed separately.

Five key legal takeaways

  • Start the reporting clock at triage. The Guidance requires mandatory reporting timelines (such as NIS2, Digital Operational Resilience Act (“DORA”) and sector-specific rules) to be considered immediately at triage. The corresponding legal analysis should therefore run in parallel with the technical response from day one.
  • A cyber incident may also be a personal data breach. Where personal data is exfiltrated, the Guidance recommends coordinating with the Data Protection Officer (“DPO”), with an express reference to the General Data Protection Regulation (“GDPR”). Whether or not the breach must be notified to the Luxembourg data protection authority (“CNPD”) or to data subjects remains subject to a legal assessment for the DPO, compliance and legal teams.
  • Do not pay any ransom. For ransomware incidents, the Guidance states that organisations should not pay the ransom as payment does not guarantee recovery and may breach national, EU or international sanctions law.
  • Insider investigations must respect employees’ rights. For insider threats, monitoring and evidence gathering should use approved tools and procedures but must also comply with applicable laws and internal policies. Human resources and legal teams should therefore be involved from the outset.
  • Prepare external support and contracts. The Guidance recommends rapidly onboarding internal or external cyber experts, consultants and legal counsel where needed, and considering early contact with external incident-response teams or the cyber-insurance provider where contractual arrangements exist. For IT supply-chain incidents, it also recommends reviewing vendor risk, and considering contractual security clauses and “kill-switch” rights allowing an organisation to disable a product, update or data flow.

Next steps for organisations

The Guidance is only as effective as an organisation’s preparation. We recommend checking that incident-response procedures provide for rapid escalation, evidence preservation, timely involvement of legal, compliance and HR teams, and early assessment of reporting obligations, as well as reviewing cyber-insurance policies and IT supplier contracts now rather than during a crisis.

—

[1] Law of 5 May 2026 on measures aimed at ensuring a high level of cybersecurity and amending the amended Law of 14 August 2000 on electronic commerce, the amended Law of 23 July 2016 establishing a High Commission for National Protection, and the Law of 17 December 2021 on electronic communications networks and services.

[2] Operational Guidance For Incident Handling published on 28 September 2026.

 

To read more about our practice: Media, Data & Technologies

Posted on 11 August 2026 in News > > Employment, Pensions & Immigration

Luxembourg : les absences pour cause de maladie peuvent-elles justifier un licenciement ?

Dans un jugement du 12 juin 2026, le Tribunal du travail de Luxembourg rappelle dans quelles conditions des absences pour maladie peuvent justifier un licenciement avec préavis.

Les conditions d’un licenciement pour absences pour cause de maladie

Les absences du salarié pour cause de maladie peuvent constituer un motif de licenciement lorsque trois conditions cumulatives sont réunies :

1. un absentéisme habituel pour raison de santé (périodes d’absence anormalement longues ou fréquentes pour cause de maladie), et

2. cet absentéisme provoque une gêne indiscutable au fonctionnement de l’entreprise (une désorganisation/perturbation de celle-ci), et

3. l’employeur ne peut plus compter sur la collaboration suffisamment régulière du salarié pour les nécessités du fonctionnement de l’entreprise.

Maladie professionnelle et accident du travail

Il existe toutefois une limite importante : lorsque les absences trouvent leur origine dans une maladie professionnelle ou un accident du travail, elles ne peuvent pas justifier le licenciement. Elles relèvent alors des risques que l’employeur doit supporter dans le cadre de son activité.

La désorganisation de l’entreprise doit-elle être prouvée dans tous les cas ?

Non, le Tribunal rappelle que la perturbation du fonctionnement de l’entreprise peut être présumée lorsque la fréquence des absences est telle que l’employeur ne peut plus compter sur une collaboration régulière et efficace du salarié.

Celui-ci conserve néanmoins la possibilité de renverser cette présomption en démontrant que ses absences n’ont pas désorganisé le service.

Enfin, la nature et l’envergure de l’entreprise, de même que l’affirmation selon laquelle un salarié serait facilement remplaçable, ne suffisent pas à exclure l’existence d’une perturbation. Celle-ci doit être appréciée concrètement, au regard des circonstances propres à chaque situation.

 Tribunal du travail de Luxembourg, jugement du 12 juin 2026.

Posted on 11 August 2026 in News > > Employment, Pensions & Immigration

Luxembourg: can sickness absences justify dismissal?

In a judgment dated 12 June 2026, the Luxembourg Labour Court reiterated the circumstances in which sickness absences can justify dismissal with notice.

Conditions for dismissal based on sickness absences

Absences due to illness may constitute valid grounds for dismissal where the following three cumulative conditions are met:

1. the employee has a pattern of health-related absenteeism, characterised by unusually long or frequent periods of absence due to illness;

2. those absences cause a clear disruption to the organisation and operation of the business; and

3. the employer can no longer rely on the employee’s sufficiently regular attendance to meet the operational needs of the business.

Occupational illness and workplace accidents

There is a significant limitation: where the employee’s absences are due to an occupational illness or a workplace accident, the employer cannot justify dismissal.

Such absences are regarded as forming part of the risks inherent in the employer’s business and must therefore be borne by the employer.

Must disruption to the business be proved in any case?

The Labour Court reiterated that disruption to the business may be presumed where the frequency of the employee’s sickness absences is such that the employer can no longer rely on their regular and effective attendance.

The employee may nevertheless rebut this presumption by demonstrating that their absences did not disrupt the organisation or operation of the relevant department.

Finally, the nature or size of the business, as well as the assertion that an employee can be easily replaced, are not sufficient alone to rule out disruption. Whether disruption occurred must be assessed in light of the specific circumstances of each case.

Luxembourg Labour Court, judgment dated 12 June 2026.

Posted on 27 July 2026 in News > > Media, Data & Technologies

Besprechungen aufzeichnen: Die richtigen DSGVO-Maßnahmen

Das Aufzeichnen von Besprechungen ist inzwischen mit wenigen Klicks möglich. Nach dem Start der Aufnahme übernimmt ein mittlerweile durch künstliche Intelligenz unterstütztes Transkriptionstool die Erstellung eines nahezu sofort verfügbaren Protokolls.

Die Vorteile liegen auf der Hand: Die Beteiligten erhalten unkompliziert eine zuverlässige schriftliche Wiedergabe der Gespräche, Missverständnisse lassen sich vermeiden und getroffene Entscheidungen können leichter nachverfolgt werden. Was aus organisatorischer Sicht praktisch erscheint, wirft jedoch auch wichtige rechtliche Fragen auf.

In Luxemburg ist eine berufliche Besprechung kein öffentlicher Raum. Unabhängig davon, ob sie unter Kolleginnen und Kollegen, mit einem Kunden, einem Dienstleister oder den Mitgliedern eines Vereins stattfindet, handelt es sich grundsätzlich um einen privaten Austausch. Sobald die Besprechung aufgezeichnet wird, werden die Stimmen, die getätigten Äußerungen und gegebenenfalls auch die zum Ausdruck gebrachten Meinungen zu personenbezogenen Daten. Damit fällt die Verarbeitung in den Anwendungsbereich der DSGVO [1].

Die CNPD [2] hat dies in ihrem Themendossier über Tonaufzeichnungen von Besprechungen [3] ausdrücklich klargestellt: Eine solche Praxis ist nicht grundsätzlich verboten. Sie muss jedoch gerechtfertigt, klar geregelt und verhältnismäßig sein.

Vorherige Information der Teilnehmenden

Der erste Schritt sollte nicht technischer, sondern menschlicher Natur sein. Die Teilnehmenden müssen darüber informiert werden, dass die Besprechung aufgezeichnet wird, zu welchem Zweck dies geschieht, wie die Aufnahme verwendet wird und wie lange sie gespeichert bleibt.

Ein kurzer Hinweis zu Beginn der Besprechung reicht nicht immer aus, insbesondere wenn Aufzeichnungen regelmäßig erfolgen. Im beruflichen Kontext ist der Arbeitgeber zu besonderer Vorsicht verpflichtet. Die Beschäftigten müssen die Tragweite der Maßnahme und ihre konkreten Auswirkungen nachvollziehen können.

Die Aufzeichnung darf weder zu einem Klima permanenter Überwachung führen noch zweckentfremdet werden. Eine Audiodatei, die zur Erstellung eines Protokolls gespeichert wurde, sollte beispielsweise nicht zu einem späteren Zeitpunkt zur Bewertung der Leistung einer Mitarbeiterin oder eines Mitarbeiters verwendet werden.

Die Rechtsgrundlage für die Aufzeichnung

Die CNPD nennt zwei mögliche Rechtsgrundlagen [4].

Die erste Rechtsgrundlage ist die Einwilligung. Theoretisch erscheint die Lösung einfach: Alle Beteiligten erklären sich mit der Aufzeichnung einverstanden. In der Praxis gestaltet sich dies jedoch deutlich schwieriger. Im Rahmen eines Arbeitsverhältnisses kann sich eine Mitarbeiterin oder ein Mitarbeiter kaum völlig frei fühlen, eine Einwilligung zu verweigern, insbesondere wenn die Aufzeichnung vom Arbeitgeber oder von einer vorgesetzten Person vorgeschlagen wird.

Als zweite mögliche Rechtsgrundlage kommt das berechtigte Interesse in Betracht. Dieses kann einschlägig sein, wenn die Aufzeichnung einem tatsächlichen Bedarf dient, etwa der Erstellung einer zuverlässigen Transkription einer komplexen oder besonders wichtigen Besprechung. Es muss jedoch nachgewiesen werden, dass die Aufzeichnung erforderlich ist und keine weniger intrusive Alternative zur Verfügung steht. Denkbar wären beispielsweise handschriftliche oder digitale Notizen, ein von den Teilnehmenden bestätigtes Protokoll oder eine Transkription, bei der die Audiodatei nicht dauerhaft gespeichert wird.

Die richtigen Maßnahmen

Bevor Sie eine Besprechung aufzeichnen, sollten Sie sich einige einfache Fragen stellen:

Warum muss diese Besprechung aufgezeichnet werden? Wer erhält Zugriff auf die Datei? Wie lange wird sie gespeichert? Wurden die Teilnehmenden ordnungsgemäß informiert? Ist die Aufzeichnung tatsächlich erforderlich oder lediglich bequem?

Wird die Aufzeichnung von Besprechungen zu einer regelmäßigen Praxis, sollte sie durch eine interne Richtlinie oder eine Charta geregelt werden. Bei Besprechungen mit externen Teilnehmenden sollte bereits in der schriftlichen Einladung auf die geplante Aufzeichnung hingewiesen werden. Ergänzend kann ein Link zu einem Datenschutzhinweis bereitgestellt werden. Auf diese Weise lassen sich klare Regeln festlegen und improvisierte Vorgehensweisen vermeiden, die häufig mit den größten Risiken verbunden sind.

Die Aufzeichnung von Besprechungen sollte daher nicht zu einem Automatismus werden. Die CNPD weist darauf hin, dass jede Situation anhand ihres jeweiligen konkreten Kontexts beurteilt werden muss [5].

Bei Fragen zur Rechtmäßigkeit der Aufzeichnung Ihrer Besprechungen oder zur Erstellung geeigneter interner Dokumente, wie etwa einer Richtlinie, einer Charta oder eines Datenschutzhinweises, steht Ihnen unser Team Media, Data & Technology gerne zur Verfügung, um Sie zu begleiten und individuell zu beraten.

[1] Verordnung (EU) 2016/679 des Europäischen Parlaments und des Rates vom 27. April 2016 zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten, zum freien Datenverkehr und zur Aufhebung der Richtlinie 95/46/EG (Datenschutz-Grundverordnung).

[2] Nationale Kommission für den Datenschutz (Commission Nationale pour la Protection des Données).

[3] CNPD, Themendossier „Enregistrement sonore des réunions“ vom 1. April 2026.

[4] Ebenda.

[5] Ebenda.

Posted on 27 July 2026 in News > > Media, Data & Technologies

Recording meetings: best practices under the GDPR

Recording meetings has become commonplace. With a single click, an AI-powered transcription tool can produce a written record almost instantly.

The benefits are clear: easy access to an accurate written transcript of the discussion, fewer misunderstandings, and easier follow-up on decisions. But what seems practical from an organisational point of view also raises significant legal questions.

In Luxembourg, a business meeting is not a public forum. Whether held among colleagues or with a client, a service provider or members of an association, it is generally a private exchange. Once the meeting is recorded, participants’ voices, statements and, in some cases, opinions are captured as personal data. The GDPR [1] therefore applies.

As the CNPD [2] explained in its recent guidance on the audio recording of meetings [3], the practice of recording meetings is not prohibited but must be justified, appropriately governed, and proportionate.

Informing participants in advance

The first consideration should be a human aspect, rather than a technical one. Participants must be informed that the meeting will be recorded, why it is being recorded, how the recording will be used, and how long it will be retained.

A brief announcement at the start of the meeting may not always be sufficient, particularly where meetings are regularly recorded. In an employment context, employers must be particularly careful. Employees must be given sufficient information to understand the nature and scope of the arrangement, and its practical implications.

Recording should not create a climate of constant surveillance or be used for purposes other than those for which it was originally made. For example, an audio recording retained to prepare minutes should not subsequently be used to assess an employee’s performance.

The legal bases for recording

The CNPD identifies two possible legal bases [4].

The first is consent. In theory, this appears straightforward: everyone agrees to the recording. In practice, however, it is far more complicated. In an employment relationship, an employee may not feel genuinely free to refuse, particularly where the recording is proposed by their employer or line manager.

The second possible basis is legitimate interests. This may be appropriate where the recording meets a genuine need, such as producing a reliable transcript of a complex or important meeting. However, it must still be demonstrable that the recording is necessary and that no less intrusive alternative is available, such as taking notes, preparing minutes to be approved by the participants or producing a transcript without retaining the audio recording.

Best practice considerations

Before recording a meeting, you should ask yourself a few simple questions.

Why does this meeting need to be recorded? Who will have access to the recording? How long will it be retained? Have the participants been properly informed? Is the recording genuinely necessary, or is it merely convenient?

Where recording meetings becomes a regular internal practice, it is advisable to set out the applicable arrangements in an internal policy or set of guidelines. For meetings involving external participants, advance notice of the intended recording may be provided in the meeting invitation, for example by including a link to a privacy notice. These measures help to establish a clear framework and avoid ad hoc practices, which often pose the greatest risks.

Recording a meeting should therefore never become the default. The CNPD emphasises that each situation must be assessed in light of its particular context [5].

If you have any questions about the lawfulness of recording your meetings or need assistance preparing appropriate internal documents, such as a policy, set of guidelines or privacy notice, our Media, Data & Technologies team is available to assist you and provide advice tailored to your needs.

—

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

[2] Commission Nationale pour la Protection des Données (National Commission for Data Protection).

[3] CNPD, Guidance on ‘Enregistrement sonore des réunions’ dated 1 April 2026.

[4] Ibid.

[5] Ibid.

Posted on 27 July 2026 in News > > Media, Data & Technologies

Enregistrer une réunion : les bons réflexes RGPD à adopter

L’enregistrement des réunions est devenu un réflexe facile. Un clic, puis un outil de transcription désormais dopé à l’intelligence artificielle se charge de produire un compte rendu presque instantané.

L’intérêt est évident : disposer facilement d’une retranscription écrite fidèle des échanges, éviter les malentendus et faciliter le suivi des décisions. Mais ce qui paraît pratique sur le plan organisationnel soulève aussi de vraies questions juridiques.

Au Luxembourg, une réunion professionnelle n’est pas un espace public. Qu’elle se tienne entre collègues, avec un client, un prestataire ou les membres d’une association, elle reste en principe un échange privé. Dès lors qu’elle est enregistrée, les voix, les propos tenus et parfois les opinions exprimées deviennent des données à caractère personnel. Le champ d’application du RGPD [1] entre donc en jeu.

La CNPD [2] l’a rappelé dans son dossier thématique consacré à l’enregistrement sonore des réunions [3], cette pratique n’est pas interdite mais elle doit être justifiée, encadrée et proportionnée.

L’information préalable des participants

Le premier réflexe ne devrait pas être technique, mais humain. Les participants à la réunion doivent savoir qu’ils sont enregistrés, pourquoi ils le sont, ce qui sera fait de l’enregistrement et pendant combien de temps il sera conservé.

Une simple phrase lancée au début de la réunion ne suffira pas toujours, surtout si les enregistrements deviennent réguliers. Dans un contexte professionnel, l’employeur doit être particulièrement vigilant. Les salariés doivent pouvoir comprendre la portée du dispositif et ses conséquences concrètes.

L’enregistrement ne doit pas créer un climat de surveillance permanente, ni être détourné de son objectif initial. Un fichier audio conservé pour établir un compte rendu ne devrait pas, par exemple, être réutilisé plus tard pour apprécier la performance d’un salarié.

La base légale de l’enregistrement

La CNPD évoque deux bases juridiques possibles [4].

La première est le consentement. Théoriquement, la solution paraît simple : chacun accepte d’être enregistré. En pratique, elle l’est beaucoup moins. Dans une relation de travail, un salarié peut difficilement se sentir totalement libre de refuser, surtout si l’enregistrement est proposé par son employeur ou son supérieur hiérarchique.

La seconde base possible est l’intérêt légitime. Elle peut être pertinente lorsque l’enregistrement répond à un besoin réel, comme obtenir une transcription fiable d’une réunion complexe ou importante. Mais encore faut-il démontrer que cet enregistrement est nécessaire et qu’il n’existe pas de solution moins intrusive, comme une prise de notes, un procès-verbal validé par les participants ou une transcription sans conservation durable de l’audio.

Les bons réflexes

Avant d’enregistrer, vous devez vous poser quelques questions simples.

Pourquoi cette réunion doit-elle être enregistrée ? Qui aura accès au fichier ? Combien de temps sera-t-il conservé ? Les participants ont-ils été informés correctement ? L’enregistrement est-il vraiment nécessaire ou seulement confortable ?

Lorsque la pratique devient récurrente, il est préférable de l’encadrer dans une politique interne ou une charte. Pour les réunions auxquelles participent des personnes externes, l’enregistrement devrait être annoncé dès l’invitation écrite, éventuellement au moyen d’un lien vers une notice d’information. Cela permet de fixer des règles claires et d’éviter les usages improvisés, qui sont souvent les plus risqués.

L’enregistrement des réunions ne doit donc pas devenir un automatisme. La CNPD rappelle que chaque situation doit être analysée au regard de son contexte propre [5].

Si vous avez des questions concernant la légalité de l’enregistrement de vos réunions ou la mise en place de documents internes adaptés, tels qu’une politique, une charte ou une notice d’information, notre équipe Media, Data & Technology se tient à votre disposition pour vous accompagner et vous fournir des conseils adaptés.

—

[1] Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données).

[2] Commission Nationale pour la Protection des Données.

[3] CNPD, Dossier thématique « Enregistrement sonore des réunions » du 1er avril 2026.

[4] Ibid.

[5] Ibid.

Posted on 11 July 2026 in News > > Employment, Pensions & Immigration

Transparence salariale: agir sans attendre

Posted on 11 July 2026 in News > > Employment, Pensions & Immigration

Pay transparency: act now!

The deadline for transposing the European Directive on pay transparency has passed. Yet no bill has been introduced in Luxembourg to date. Employers must nevertheless prepare for these new obligations, which will fundamentally reshape their salary practices.

A delay in transposition does not exempt employers

Directive (EU) 2023/970 of 10 May 2023 on pay transparency was to be transposed by Member States by 7 June 2026 at the latest. However, in Luxembourg, no bill has been introduced to date[1]. This delay should not, however, encourage employers to remain passive. Although, in principle, a directive that has not been transposed by the deadline does not impose obligations on private individuals, it can nonetheless influence the interpretation of national law[2]. Moreover, the principle of equal pay for women and men is already enshrined in the Labor Code, which provides for sanctions against employers who fail to guarantee equal pay for the same work or work of equal value[3]. The Directive will strengthen the effectiveness of this right through obligations of transparency, reporting, and deterrent sanctions.

Unprecedented Obligations for Businesses

The Directive imposes salary transparency at all stages of the employment relationship. From the recruitment stage, candidates must be informed of the initial salary or the expected salary range, and employers will no longer be able to request candidates’ salary history. Every employee will have the right to information on average pay, broken down by gender, for identical work or work of equal value. Companies with more than 100 employees will be required to regularly publish pay gaps between women and men. If a gap exceeds 5% and is not justified by objective and non-sexist criteria, a joint assessment with employee representatives will be mandatory, with a requirement to address the gap.

The Directive also requires jobs to be classified according to objective criteria, some of which are mandatory, including skills, effort, duties, and working conditions, agreed upon with employee representatives. Discretionary bonus clauses, which are widespread in Luxembourg, could become more vulnerable to challenge in light of these requirements for objectivity and justification. Finally, where an employee establishes facts giving rise to a presumption of discrimination, or where the employer fails to comply with its transparency obligations, the burden of proof will fall on the employer to provde that no discrimination has occurred.

Preparing now: a strategic imperative

Despite the absence of implementing legislation, we have been advising the employers we support since last year to begin preparing now. There is sufficient certainty regarding the substance of the forthcoming legislation to justify a proactive compliance strategy: mapping jobs and classification criteria, identifying pay gaps within job categories, documenting the objective criteria justifying these gaps, developing transparent salary structures, reviewing bonus schemes, and implementing monitoring tools.

The involvement of employee representatives is strongly recommended, as the Directive envisages an enhanced role for workers’ representatives in defining job-classification criteria and jointly evaluating compensation. Employers that take a proactive approach and voluntarily disclose their salary data are likely to strengthen both their attractiveness as employers and their reputation for social responsibility.

Such preparation will enable employers to approach the entry into force of the implemeting legislation with confidence, and to turn a regulatory obligation into a competitive advantage.

Régis Muller, Partner – Employment, Pensions & Immigration, Molitor Avocats à la Cour

Other HR challenges on the horizon

Beyond salary transparency, Luxembourg employers are facing a number of other HR challenges, including the right to disconnect, which must be effectively implemented by 1 July 2026. The challenge lies in striking the right balance between a policy that is too general to provide meaningful protection to employees, and one that is so rigid that it proves unworkable in practice. Employers must therefore develop practical, tailored arrangements that reconcile employee protection with the operational needs of the business.

The use of AI is also of major concern, as is the prevention of workplace harassment, which remains more relevant than ever given the number of cases (proven or not) that employers continue to face.

They must ensure that their internal reporting and complaint-handling procedures are effective and comply with legal requirements.

Conclusion: preparing to stand out

The Directive marks a paradigm shift. The traditional approach, based on contractual freedom and salary confidentiality is giving way to a requirement for justification and transparency. Employers that anticipate these changes will be well positioned to attract and retain talent, while also limiting their legal risks. Compliance with pay equality requirements is therefore also becoming a driver of attractiveness.

[1] NB: Article finalised on 15 June 2026

[2] No horizontal direct effect of directives

[3] Articles L. 225-1 to L. 225-5 of the Labour Code, introduced by the law of 15 December 2016


Paperjam Experts – Human Resources

Published on Paperjam

Posted on 2 July 2026 in News > > Litigation & Dispute Resolution

Luxembourg restructuring law: case law insights

Analysis of court decisions rendered in 2024 and 2025 in respect of the law of 7 August 2023 on the preservation of businesses and the modernisation of insolvency law

The 2019 Directive on restructuring and insolvency (the Directive) provides Member States with a number of options in terms of transposition, including the formation of voting classes, the classification of secured and unsecured claims, and who may vote on a plan. The law of 7 August 2023 on the preservation of businesses and the modernisation of insolvency law (the 2023 Law) adopts an approach that may lead, in some respects, to complications in the preparation and the adoption of a plan, notably because the 2023 Law provides only two voting classes, produces a de facto absolute‑priority outcome for dissenting secured creditors in cram‑down, omits an express bifurcation rule for under‑secured claims, contains no exclusion from voting for subordinated or related‑party creditors, and imposes a double majority (headcount and amount) within each class.

Certain decisions of the Luxembourg District Court rendered in 2024 and 2025 show the practical application of the 2023 Law, as described below.

Luxembourg’s 2023 Law implements the EU Restructuring Directive with only two voting classes, which may compress creditors with materiality divergent interests into the same class.

I. The implementation of the Directive by the 2023 Law

The Directive requires that affected parties be grouped into classes reflecting a sufficient commonality of interest on objective and verifiable criteria and, at a minimum, that secured and unsecured creditors vote in separate classes (Article 9.4). The 2023 Law provides only two classes, ordinary stayable creditors (CSO) and extraordinary stayable creditors (CSE). The CSE are defined in the 2023 Law as creditors holding claims secured by a special lien or mortgage, retention-of-title creditors’ claims, as well as stayable claims of tax authorities and social security agencies whilst the CSO are stayable creditors other than the CSE (Article 1).

This approach may, from an economic perspective, group heterogeneous creditors into two classes. As noted in literature[1], secured creditors’ positions vary by collateral type, value, lien rank, and coverage. A single unsecured class may also group senior and contractually subordinated lenders, bondholders, trade creditors, and small claimants alongside large institutions. Creditors with materially divergent interests may therefore vote together in one class.

The 2023 Law additionally permits categories within each class with differentiated treatment, subject to two requirements: (i) equal treatment within the category and (ii) proportionality to the amount of claims in that category (Article 43(2)). Voting, however, is tallied at class level, as the 2023 Law provides no separate vote by category (Article 49).

Categories allow differentiated economics for sub‑groups, but their votes are aggregated at class level, which can complicate approval.

The statutory definition of CSE lists mortgages and special liens but does not expressly mention pledgees. Given that a pledge is a security right in rem, in light of the Directive’s minimum split between secured and unsecured creditors, pledgees affected by a plan should be treated as CSE. Separately, it is commonly held that a pledge governed by the law of 5 August 2005 on financial collateral is immune from the reorganisation procedure and therefore that pledge could be enforced without being affected by such procedure. As a result, a pledgee that can and intends to enforce outside the plan should not be an “affected” party and should therefore not vote[2].

In practice, a plan is rarely viable if key pledged assets (typically shares in a subsidiary) are at real enforcement risk and hence a debtor would likely not even consider filing such a plan. The CSE characterisation of a pledgee should come into play in a scenario in which secured creditors elect to restructure through a plan rather than enforce (e.g., in syndicated financings).

The Directive permits Member States to calibrate secured status to collateral value by bifurcating an under‑secured claim into (i) a secured portion up to collateral value and (ii) an unsecured deficiency, i.e. the bifurcation rule. The 2023 Law does not expressly adopt this option. As one scholar notes, given the silence of the 2023 Law and the lack of precedent, it is uncertain whether an under‑secured claim is CSE only up to collateral value, with the balance treated as CSO[3].

The 2023 Law requires, for each class, that there is a majority in headcount and at least 50% of the principal of uncontested or provisionally admitted claims. In homogeneous classes this can be a sensible safeguard against domination by a single large creditor. In two heterogeneous classes, headcount can magnify the influence of many small or related‑party claims. In this respect, it has been rightly noted that the interests of small or otherwise vulnerable claimants could be better protected with the tool of formation of separate class[4].

The Directive permits either a relative or absolute priority approach in cross‑class cram down (Articles 11.1.c and 11.2). Under the 2023 Law, a de facto absolute priority rule is applicable because dissenting CSE must be paid in full if CSO receive anything[5].

Finally, the Directive allows Member States to exclude the votes of related parties with conflicts of interest and contractually subordinated creditors (Articles 9. 3. (b) and (c)). These options have not been transposed in the 2023 Law. The consequence is that subordinated creditors and intra‑group lenders may vote in the CSO class.

II. Case law analysis

A. Intra‑group creditors

In its decision of 19 December 2024 (TAL‑2024‑03607), the court examined a plan submitted to both classes. Among the CSO, the plan included a category of intra‑group creditors who would waive almost the entirety of their claims in exchange for a symbolic EUR 1. The court held that these creditors were not “affected” by the plan within the meaning of Article 48 of the 2023 Law because of this waiver. The court also incidentally characterised their conduct as a voluntary renunciation in contradiction with their own corporate interest, and referred to the Belgian doctrine of auto‑affectation whereby one shall be wary of a creditor that voluntarily engineers its own “affectation” to influence the ballot. External CSO (i.e., not related to the debtor) voted, almost unanimously, against the plan, and this underscores that including the intra‑group votes could have distorted the class outcome.

Article 48 of the 2023 Law allows only affected stayable creditors to vote. In the same decision, the court decided, in respect of another category of creditors to be immediately paid in full, that a creditor whose claim was neither reduced nor rescheduled nor staged was not affected and hence decided rightly that these creditors were not affected by the plan. Treating intra‑group waiver creditors as “not affected” does not appear to be consistent with the interpretation of an affected creditor. The waiver is indeed a component of the plan, stipulated therein and effective only upon confirmation. If the plan is not confirmed, the waiver does not materialise and the claim subsists in full. Therefore, those creditors’ rights are obviously modified by the plan.

In our view, the court’s reasoning should be understood as a pragmatic response to the absence of an express exclusion of related parties from voting pursuant to Article 9.3(c) of the Directive in a narrow situation. As an aside, the debt waiver should not have been the subject of criticism given this is common in a restructuring plan, which is to the benefit of external creditors.

However, in the absence of an express statutory exclusion of related parties, turning to a Belgian court precedent of 2023 which neutralised the negative vote of certain creditors based on an abuse of rights[6], that mechanism could possibly be considered in a scenario involving related parties but the threshold would certainly be very high.

Luxembourg’s 2023 Law does not adopt the bifurcation rule for under-secured claims, leaving uncertainty whether the secured portion is treated as CSE and the deficiency as CSO.

B. Categories and classes

Two decisions rendered in 2025 illustrate that plans may create multiple categories within each class with differentiated treatment, provided creditors are treated equally within each category and proportionately to their claim amounts, and that voting results are tallied at the class – not category – level.

A decision rendered on 22 May 2025 (TAL‑2024‑03627) applied this framework to CSO categories with ascending maturities and, for the largest claims, a discount over time. Then, a decision rendered on 27 November 2025 (TAL‑2024‑09043) applied it to CSE categories corresponding to different German‑law real estate securities, one repaid in full and the other receiving residual proceeds after the first and the CSO. In both cases, the court did not raise any issue in respect of the categorisation of creditors based on the requirements of equal treatment and proportionality under paragraph 2 of Article 43 of the 2023 Law and the plans were approved following an approval at the class level.

By contrast, in the December 2024 decision, the plan had foreseen four categories of creditors but did not make any distinction between CSE and CSO. The court emphasised that creditors voted at the class level and not category level and the votes were assessed accordingly.

The November 2025 decision also illustrates that the 2023 Law does not expressly provide for an exclusion of the votes of under-secured creditors. In this case, the debtor owned a single encumbered property with a market value materially below the secured stack. It appears that one CSE category may have been economically under‑secured and thus out of the money. The decision mentions that the CSE and CSO unanimously cast a favorable vote, their claims representing 100% of all claims and taken into account for the calculation of majorities. That decision therefore does not appear to have characterised the under-secured creditors at least partly into CSO.

In our view, it remains to be seen what solution would be adopted by the court in the scenario of a contentious restructuring in which the characterisation of under-secured creditors as CSE or CSO would be debated between the debtor and the creditors. In this respect, arguments could be certainly built upon the fact that, to the extent that it can be established, the value in the case of enforcement of the security shows that the creditors benefiting from that security are under-secured, that portion of the claim shall be characterised as CSO, as from an economic standpoint, it has no economic value as a secured claim. On the other hand, that type of argument is uncertain given that the 2023 Law does not expressly make such distinction. It is worth noting a controversy took place on that subject for years in Belgium over the last decade[7], the 2023 Law being primarily inspired by Belgian legislation passed in 2009 and 2013. Now, the Belgian law of 7 June 2023 implementing the Directive expressly applies the bifurcation rule[8].

To generally address the heterogenous nature of the classes of creditors, one could consider  including directed voting provisions in intercreditor agreements, under which junior creditors undertake to vote in favour of any restructuring plan that the senior creditors accept. Intercreditor agreements may indeed include provisions for relevant creditors to exercise their voting rights in a certain way in restructuring proceedings[9]. The enforceability of such provision in the context of a Luxembourg judicial reorganisation is untested, but such covenants could potentially reduce the risk that junior votes in a single class frustrate a plan that respects the agreed waterfall.

Luxembourg’s 2023 Law allows multiple categories within each voting class with differentiated treatment, but voting is aggregated at class level rather than by category.

C. Best interests of creditors

Under the 2023 Law, the court shall apply the best interests of creditors test only if a creditor challenges that such test is met in a reasoned manner (paragraph 7 of Article 49 and Article 50). The 2023 Law provides that the plan satisfies the best interests of creditors test in that no creditor is left worse off under the plan than it would be if the normal order of priorities were applied, whether in the case of bankruptcy or judicial liquidation, or in the case of the next best alternative, if the plan were not confirmed (paragraph 3 of Article 43).

In the decision rendered on 25 September 2025 (TAL-2025-01208), the plan offered CSO 10% and claimed only 4.4% would be recoverable in bankruptcy. A CSO creditor challenged the complete lack of evidence regarding the alleged recoverability of the CSO. The plan having been approved by the CSE, the court determined, in the context of the application of the cross-class cram down, that the debtor actually failed to provide evidence of the recoverability figure of the CSO. It is worth noting that the court held that the debtor provided no assessment of the dismantlement value of its assets, whether the net asset value of isolated assets, the overall value of a business transfer, or even the going-concern value established by projecting into the future the present value through the effect of the plan.

In a decision rendered on 13 October 2025 (TAL-2024-07754), the case related to a plan providing for a partial payment of the only CSO, to be financed by a third party, and the CSE being paid in full. The debtor alleged that the only asset was an indirect claim held by the parent company, evidenced by a foreign judgment the enforcement of which would require costly and uncertain action abroad, whilst the creditor argued that it would be in a better position if the company were bankrupt. As part of the application of the cross-class cram down, the court found that bankruptcy would likely produce nothing for CSO, whereas the plan delivered partial, staged distributions financed from external funds and hence, the test was satisfied and the plan homologated.

In a decision rendered on 6 November 2025 (TAL-2025-05408), the court homologated a plan with CSO approval and CSE dissent after verifying that dissenting CSE, composed exclusively of public creditors, would be repaid in full (principal and interest) over a defined period and that, in the scenario of the debtor’s bankruptcy, based on the available accounting information, they would likely not be repaid in full. The court also determined that CSE were treated more favourably than CSO (who accepted a substantial haircut over a longer duration), which illustrates the actual application of the de facto absolute priority rule.

If these decisions illustrate that Luxembourg courts verify that sufficient valuation evidence be provided, it also shows that the judicial debate on valuation will take place at the last stage of the homologation of the plan, which can create some uncertainty for the parties involved[10].

—

 

[1] See INSOL Europe, Guidance Note on the Implementation of Preventive Restructuring Frameworks under EU Directive 2019/1023: Claims, Classes, Voting, Confirmation and the Cross-Class Cram-Down, Tomáš Richter & Adrian Thery (April 2020), available at https://ssrn.com/abstract=3575511, n° 52

[2] Thomas Mastrullo, “Transposing the Directive (EU) 2019/1023: The new Luxembourg preventive restructuring law”, European Insolvency and Restructuring Journal (EIRJ), 2024-4, n° 106

[3] T. Mastrullo, op. cit., n°119

[4] T. Richter and A. Thery, op.cit., n° 82

[5] T. Mastrullo, op. cit., n° 128

[6] Tribunal de l’entreprise du Hainaut, div. Charleroi (RG Q/21/00072), quoted in Nicolas Ouchinski, La procédure de réorganisation judiciaire par accord collectif pour grandes entreprises et les classes de créanciers, available at :  https://blog.oeccbb.be/fr/article/la-procedure-de-reorganisation-judiciaire-par-accord-collectif-pour-grandes-entreprises-et-les-classes-de-creanciers/29553

[7] See for example Bernard Leroy, Créancier et réorganisation judiciaire, Forum Financier Belge Comité de Verviers Eupen, Séminaire du 18 février 2016, p. 5 and seq. https://www.financialforum.be/sites/financialforum.be/files/media/1660E%20B.%20Leroy.pdf

[8] The Code of economic law (Code de droit économique) has been amended by including article XX. 75/2 and article XX.83/9 for such purpose.

[9] Mika J. Lehtimäki, Intercreditor Agreements in Leveraged Buyouts (D.Phil. thesis, University of Oxford, 2020), pp. 225–226

[10] This issue has been stressed in a decision rendered by the Tribunal de l’entreprise Liège, division de Namur (4e chambre), dated 23/01/2024, J.L.M.B. 24/080, n°104


This article is reproduced from the International Insolvency and Restructuring Review 2026/27, published by Beaumont Capital Markets Ltd in June 2026.

Subscribe to our news updates