Your questions

Businesses established in Luxembourg

Will employees of British nationality be allowed to continue their salaried activity after the United Kindgom's withdrawal from the EU? Do they need a work permit?

British employees working and residing in Luxembourg at the time of Brexit will be allowed to continue working after the United Kindgom's withdrawal from the EU using their current residence document. However, they must apply for a residence permit for third country nationals for one of the categories that enables them to pursue a salaried activity. If the British national is a family member of a Union citizen, he/she will have to apply for a residence card. The application must be submitted 9 months after the withdrawal date at the latest.

It is important to point out that the Luxembourg Government has decided to grant certain procedural facilitations when processing applications. The details of these facilitations will be communicated later.

The current residence document issued to British nationals, as EU citizens, will be considered a valid residence permit during a one-year period after the withdrawal date, pending the issuance of a new residence permit.

Can a company established in Luxembourg hire British employees after the United Kindgom's withdrawal from the EU? What are the steps to take?

The steps depend on the situation of the person who will be hired.

If the person concerned has already resided in Luxembourg before the United Kindgom's withdrawal from the EU, they may begin a salaried activity between during a one-year period after the withdrawal date using their residence document issued before the withdrawal date as a citizen of the Union. If they have already replaced this document with a residence permit when starting the salaried activity, they will have to, if necessary, apply for a change of category of residence permit if the category of their residence does not automatically allow them to work. Such a request for a change of category of the residence permit will be processed under certain procedural facilitations.

If the person concerned has already resided in Luxembourg before the United Kindgom's withdrawal from the EU and if their salaried activity starts after the end of the one-year period after the withdrawal date, the British national will be subject to the general rules applicable to third country nationals. Thus, they will have to change, if necessary, the category of residence permit, if the category of their residence permit does not allow them to work. Such a request will be dealt with according to the general rules in force for third country nationals.

If the person concerned is not yet resident in Luxembourg, they will be subject to the common rules applicable to third country nationals. They must therefore apply for a residence permit which must be notified favorably before entering the territory and beginning their salaried activity.

Can a British employee who, at the time of Brexit, works in Luxembourg but lives in France, still work in Luxembourg after Brexit?

A British employee who works in Luxembourg and who resides in another EU Member State at the time of the Brexit is authorised to continue his salaried activity in Luxembourg after the United Kindgom's withdrawal from the EU. However, he must apply for a work permit.

A British employee who resides in another EU Member State and wishes to start work after the United Kindgom's withdrawal from the EU must apply for a work permit, in accordance with the general procedure in place. He must wait for said work permit to be issued before beginning the exercise of the salaried activity.

These rules are also applicable to British employees who reside in the United Kingdom and wish to engage in paid employment in Luxembourg as a cross-border.

I am a company established in Luxembourg and employ British workers. Wich provisions in terms of social security will apply to these employees after the United Kindgom's withdrawal from the EU?

EU regulations will not apply anymore and the provisions applicable will depend on national legislation.

Under Luxembourg legislation, any person undertaking a professional activity on behalf of an employer is covered by the Luxembourg social security. Therefore, British workers working in Luxembourg remain covered by Luxembourg's social security scheme after the United Kindgom's withdrawal from the EU.

I am a company established in Luxembourg and I would like to post an employee temporarily to the United Kingdom after the United Kindgom's withdrawal from the EU. Which provisions in terms of social security will apply?

As EU regulations will no longer be applicable, the provisions applicable will depend on national legislation.

The potential coverage of your worker by the British social security during his temporary occupation in the United Kingdom will depend on British legislation.

Under Luxembourg legislation, employees normally working in Luxembourg and posted abroad temporarily by their employer remain covered by the Luxembourg social security. This possibility does not necessarily exclude the potential coverage by the British social security under British legislation.

I am a company established in Luxembourg and before the United Kindgom's withdrawal from the EU, I posted an employee to work temporarily in the United Kingdom for a posting period extending beyond that date. Which provisions in terms of social security will apply after the withdrawal date?

As EU regulations will no longer be applicable after the United Kindgom's withdrawal from the EU, the provisions applicable will depend on national legislation.

After the United Kindgom's withdrawal from the EU, the potential coverage of your worker to by the British social security scheme during his temporary activity in the United Kingdom will depend on British legislation.

Under Luxembourg legislation, employees normally working in Luxembourg and posted abroad (to third countries) temporarily by their employer may remain covered by the Luxembourg social security scheme.

The employee’s continued coverage by the Luxembourg social security scheme will be operated by the Centre commun de la sécurité sociale. Information on this subject will be provided.

Requests for annual extensions will have to be submitted to the Centre Commun de la Sécurité Sociale. Continued coverage by the Luxembourg social security scheme is possible for a posting period of up to five years maximum.

I bought products online from a company based in Luxembourg. This company transmits my purchase history to one of its subsidiaries in the United Kingdom for the purpose of its stock management. Is the Luxembourg company authorised to transfer my personal data to its UK subsidiary after the United Kingdom’s withdrawal?

In the absence of a Withdrawal Agreement, the European regulation will cease to apply in the United Kingdom after the United Kingdom’s withdrawal. This means that the United Kingdom will be considered a third country within the meaning of the General Data Protection Regulation.

In relation to the Luxembourg company, the rights to which the data subject is entitled under the General Data Protection Regulation, including the right to information, are maintained. Anyone who decides to process a data subject’s personal data, is obliged to inform the data subject of

  • their identity;
  • the purpose of collecting data and whether the provision of the data is mandatory or optional;
  • the recipients of the data;
  • the rights granted to the data subject under the General Data Protection Regulation;
  • any transfers of data to a country outside the European Union.

The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.

The Luxembourg company must therefore inform the data subject of the transfer of his/her personal data to its UK subsidiary and of the legal basis on which the transfer is based.

Finally, subject to compliance with the general principles of the General Data Protection Regulation, including the right to information, the Luxembourg company, in order to transfer personal data to its UK subsidiary lawfully and in the absence of a formal adequacy decision by the European Commission, must base the transfers on one of the legal mechanisms provided for by the General Data Protection Regulation. For example, the Luxembourg company may use standard data protection clauses. These are model contracts for the transfer of personal data adopted by the European Commission. The use of such clauses offers an appropriate level of protection for the data subject’s personal data for such a transfer, as the UK subsidiary of the Luxembourg company running the website will have to respect the data protection obligations contained in these clauses.

I bought products online from a company established in the United Kingdom. Will I have the same rights as currently under the General Data Protection Regulation after the United Kingdom’s withdrawal?

In the absence of a Withdrawal Agreement, the current European regulation will cease to apply in the United Kingdom after the United Kingdom’s withdrawal. This means that the United Kingdom will be considered a third country within the meaning of the General Data Protection Regulation. The national legislation of the United Kingdom will, in principle, become applicable.

In addition, the UK data protection authority has clarified that the UK Government intends to adopt a law similar to the General Data Protection Regulation, in the event of a “no deal” Brexit.

The data subject will also be able to lodge a complaint with the National Commission for Data Protection (CNPD) in the event of a dispute with the controller, which the CNPD will then forward to its British counterparts.

If necessary, the CNPD could be competent in this case on the basis of an indirect application of the General Data Protection Regulation.

I am employed in Luxembourg and regularly travel to the UK for professional reasons. In this context, my Luxembourg employer systematically sends my personal data (name, first name, telephone number, etc.) to an entity based in the United Kingdom, which is responsible for managing my work-related journeys. Will my employer have the right to continue to transfer my data after the United Kingdom’s withdrawal?

In the absence of a Withdrawal Agreement, the European regulation will cease to apply in the United Kingdom after the United Kingdom’s withdrawal. This means that the United Kingdom will be considered a third country within the meaning of the General Data Protection Regulation.

The rights to which the data subject is entitled under the General Data Protection Regulation, including the right to information, continue to apply with respect to his/her Luxembourg employer. Anyone who decides to process a data subject’s personal data, is obliged to inform the data subject of their:

  • identity;
  • the purpose of collecting data and whether the provision of the data is mandatory or optional;
  • the recipients of the data;
  • the rights granted to the data subject under the General Data Protection Regulation;
  • any transfers of data to a country outside the European Union.

The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.

The Luxembourg employer must therefore inform the data subject of the transfer of its personal data to the entity established in the United Kingdom and of the legal basis on which the transfer is based.

As such, subject to compliance with the general principles of the General Data Protection Regulation, including the right to information, the Luxembourg employer, in order to transfer personal data to its UK entity lawfully and, in the absence of a formal adequacy decision by the European Commission, must base the transfer on one of the legal mechanisms provided for by the General Data Protection Regulation. For example, the Luxembourg employer may use standard data protection clauses. These are model contracts for the transfer of personal data adopted by the European Commission. The use of such clauses offers an appropriate level of protection of the data subject’s personal data for such a transfer, as the UK entity in charge of managing the data subject’s business travel will have to respect the data protection obligations contained in these clauses.

However, should occasional business trips be carried out in the framework of a work contract, the transfer may take place on a different legal basis, i.e. on the basis of one of the derogations provided for by the applicable legislation in force (for example, if the data subject’s employer can justify that this transfer is necessary to fulfill the obligations of said work contract). However, this does not exempt the data subject’s employer from providing the former with the information referred to above.

I am a natural person holding shares in a Luxembourg investment fund. The financial institution which set up the investment fund, is established in the UK and wishes to receive my personal data for statistical purposes. Is the Luxembourg investment fund authorised to transfer my personal data to the UK financial institution after the United Kingdom’s withdrawal?

In the absence of a Withdrawal Agreement, the European regulation will cease to apply in the United Kingdom after United Kingdom’s withdrawal. This means that the United Kingdom will be considered a third country within the meaning of the General Data Protection Regulation after it leaves the EU.

In relation to the Luxembourg investment fund, the rights to which the data subject is entitled under the General Data Protection Regulation, including the right to information, are maintained. Anyone who decides to process a data subject’s personal data, is obliged to inform the data subject of their:

  • identity;
  • the purpose of collecting data and whether the provision of the data is mandatory or optional;
  • the recipients of the data;
  • the rights granted to the data subject under the General Data Protection Regulation;
  • any transfers of data to a country outside the European Union.

The controller must provide these elements in plain and clear language when personal data are collected or, at the latest, within one month following the data collection, if the data are not collected directly from the data subject.

The Luxembourg investment fund must therefore inform the data subject of the transfer of its personal data to the financial institution established in the UK and of the legal basis on which the transfer is based.

Finally, subject to compliance with the general principles of the General Data Protection Regulation, including the right to information, the Luxembourg investment fund, in order to transfer personal data to the UK financial institution lawfully and in the absence of a formal adequacy decision by the European Commission, must base the transfers on one of the mechanisms provided for by the General Data Protection Regulation. For example, the Luxembourg investment fund may use standard data protection clauses. These are model contracts for the transfer of personal data adopted by the European Commission. The use of such clauses offers an appropriate level of protection for the data subject’s personal data for such a transfer, as the UK financial institution will have to respect the data protection obligations contained in these clauses.

Last update