Recruitment Privacy Notice

Last update: october 2026

As part of its recruitment process, the Commission de Surveillance du Secteur Financier (hereinafter the “CSSF”) collects and processes personal data relating to job applicants. The CSSF is committed to being transparent about how it collects and uses such data and to complying with its data protection obligations, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the “GDPR”), as well as with the applicable Luxembourg legislation in this area.

About the CSSF

The CSSF is the supervisory authority for the Luxembourg financial sector. Its duties and scope of powers are defined in Section 2 of the Law of 23 December 1998 establishing a Commission de Surveillance du Secteur Financier (hereinafter the “Organic Law”). The CSSF carries out its prudential and market supervision duties with the aim of contributing to the soundness and stability of the financial sector, exclusively in the public interest.

In the context of its recruitment and selection procedures, the CSSF processes personal data in accordance with the GDPR and the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and implementing the general framework on data protection.

This Recruitment Privacy Notice explains how the CSSF processes personal data of:

• Job candidates (for permanent/contract roles).
• Interns/students (for structured university internship programs).

Data Controller:

Commission de Surveillance du Secteur Financier (CSSF)

283, route d’Arlon, L-1150 Luxembourg

Data Protection Officer (DPO)

You may contact our Data Protection Office at:

Email: dpo@cssf.lu

Commission de Surveillance du Secteur Financier (CSSF)

283, route d’Arlon, L-1150 Luxembourg

Attn : DPO

Tél : (+352) 26 25 1 – 1

What information does the CSSF collect and how?

The CSSF collects a range of personal information. This includes:

A. Identification & Contact Data (Mandatory)

• Full name, last name
• Address (residential)
• Telephone number
• Email address
• Copy of identity card or passport

B. Personal Characteristics (Mandatory)

• Date of birth, place of birth
• Gender
• Nationality (EU/EEA only – legal requirement)
• Marital status (if relevant for social security purposes, requested only at the end of the recruitment process, as part of the onboarding process.) ,

C. Educational & Professional Qualifications (Mandatory )

• Diplomas & certificates (copies required)
  • For foreign diplomas (outside Luxembourg, Belgium, or the Netherlands): proof of equivalence (may be transmitted later)
• Professional experience:
  • Employer name, job title, job description
  • Dates of employment, place of work, specialization
• Language & IT skills

D. Employment Data (Mandatory if invited for an interview)

• Social security affiliation certificate (or equivalent)

E. Additional Documents : CV, Cover Letter (Mandatory)

• Curriculum Vitae (CV) – concise overview of professional/educational background
• Cover letter – explaining motivation and suitability for the role

F. Criminal Record

• Recent extract of criminal record (no older than 3 months)
• Where required for the position, prior to signing the contract,  candidates may be required to provide criminal record extract for the purpose of verifying your conduct, integrity and suitability for the position and where applicable, verifying that the candidate satisfies applicable statutory or regulatory requirements

G. Assessment Data (Mandatory if invited for an interview)

• Technical & language test results
• Personality & reasoning test results (online assessment)

This information will be obtained from your application file and/or documents requested during the recruitment process. More details about the application file can be found under “Application & recruitment process“

The CSSF does not use the information you provide to make any automated decisions that might affect you.

Data will be stored in different places, including in your application record, in the CSSF’s HR management systems and email system, all of which are in Luxembourg.

The CSSF does not use the information you provide to make any automated decisions that might affect you.

Why does the CSSF process your personal data?

We process your personal data in the context of recruitment and selection in accordance with applicable Luxembourg and European data protection laws. This process is strictly limited to what is necessary to manage the recruitment process, assess and verify candidates’ qualifications, experience and integrity and ensure that individuals joining the CSSF meet the high standards required to carry out its public interest mission as the supervisory authority of the financial sector.

Legal basis:

• Standard data

Identification & Contact Data, Personal Characteristics, Educational & Professional Qualifications, Employment Data, Additional Documents : CV, Cover Letter,:

• • Public Task (art. 6(1)(e) GDPR) – Processing is necessary for the performance of a task carried out in the public interest (financial supervision carried out pursuant to the Organic Law).

• Criminal records:

• • Legal Obligation (art. 6(1)(c) GDPR and art. 10 GDPR) and in accordance with art. 8‑5(1) of the Law of 29 March 2013 on the organisation of the criminal record. Access to the criminal records extract is restricted to authorized CSSF personnel who require access for the purposes of recruitment.
• Health data (if applicable):
  • As a public authority we require all new hires to undergo a medical examination within 3 months of starting employment.
  • If you request reasonable adjustments due to a disability, we will process your health data to comply with our obligations (art. 6(1)(c) GDPR and under Luxembourg administrative code and EU Directive 2000/78/EC (equal treatment in employment), in accordance with art. 9(2)(b) GDPR (processing necessary for carrying out obligations in employment law).

Who has access to data?

In the process of analysing your application, your personal data may be shared internally within the CSSF. This includes members of the Human Resources department, people involved in job interviews and recruitment managers within the recruiting departments.

At a more advanced stage of the recruitment process, you may be asked to share your data with third parties in connection with the completion of questionnaires or tests.

How does the CSSF protect your data?

The CSSF takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its personnel in the proper performance of their duties.

For how long does the CSSF keep your data?

If your application for employment is unsuccessful, your data will be kept for a period of maximum 4 months. After that period, your application file will be deleted or destroyed (unless it needs to be retained for longer to exercise or defend any legal claims). The CSSF will keep record of your application for a period of 5 years after which this record will also be deleted.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your employee file and retained during your employment.

Criminal record extract: We process your criminal record extract solely for the purpose of assessing your suitability for the role.

Your criminal record extract will be retained only for as long as necessary to complete and document the relevant assessment. Where retention of the extract is not required by law, the extract will be securely deleted or destroyed once the assessment has been completed (no later than one month after the conclusion of your employment contract).

Specific provisions for student candidates and trainees

Applications for traineeship positions are submitted and assessed through the CSSF’s standard recruitment process, including review of applications and interviews.  If selected, the candidate enters into a tripartite internship agreement concluded between the CSSF (as host organisation), the relevant university or educational institution and the student.

The CSSF processes personal data of trainees pursuant to art.  6(1)(e) GDPR, as such processing is necessary for the performance of its statutory mission and organisational functioning as a public supervisory authority established by law. To the extent that certain processing operations are strictly necessary for the performance of the traineeship agreement, art. 6(1)(b) GDPR may apply in parallel. Following signature of this agreement, the Authority processes additional personal data necessary for the organisation and management of the traineeship, which has a maximum duration of six (6) months.

Such processing includes the allocation of tasks, supervision of activities and the preparation of an evaluation of the trainee’s performance, as provided for in the internship agreement.

The CSSF acts as an independent data controller for all personal data it processes in the context of the recruitment procedure and the subsequent traineeship.  The university or educational institution acts as a separate controller for processing operations carried out under its own academic and administrative responsibilities.

Your rights

As a data subject, you have a number of rights under data protection law. Without prejudice to the limitations provided by the GDPR, you can:

• access and obtain a copy of your data on request;
• require the CSSF to change incorrect or incomplete data;
• require the CSSF to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where the CSSF is relying on its legitimate interests as the legal ground for processing; or
• ask the CSSF to transfer your data to another organisation.

If you have a complaint about the use of your information by the CSSF, we invite you to contact the CSSF directly so that your complaint can be addressed. However, you may also contact the CNPD via their website at www.cnpd.lu or write to them at:

Commission nationale pour la protection des données (CNPD)
Service des réclamations
15, Boulevard du Jazz
L-4370 Belvaux

What if you do not provide personal data?

You are under no statutory or contractual obligation to provide data to the CSSF during the recruitment process. However, if you do not provide the information, the CSSF may not be able to process your application.

External sssessment providers

The CSSF uses external specialised assessment providers to administer and / or evaluate recruitment examinations. Depending on the assessment concerned, the providers may receive the candidate’s identification details and information necessary to administer the examination, and may generate assessment scores, results or reports that are provided to the CSSF for recruitment purposes.

Cookies

The CSSF uses cookies on the CSSF Careers website but they are not ‘intrusive’. This means that:

• they are not used to gather Personal Data about You in any way;
• the CSSF does not use targeting or advertising cookies that build up a profile.

When You use the CSSF Careers website notably to view the information the CSSF makes available, download documents or use online forms, a number of cookies are used by the CSSF and by third parties to allow the website to function and to collect useful information about visitors and to help to improve your user experience.

Updates to this privacy notice

The CSSF may periodically review and update this privacy notice to reflect changes in its activities, recruitment processes, personal data processing activities and applicable legal and regulatory requirements. The CSSF will ensure that this privacy notice remains accurate, transparent and up to date.