The Luxembourg Data Protection Authority (CNPD) has published its first decisions following investigations of non-compliance with the General Data Protection Regulation (GDPR). The decisions relate to the role of the DPO, the geolocation of employees and video surveillance. This newsflash sets out the key takeaways on these three topics.