Can we record the simulation call in Luxembourg?

Not safely on the face of the statute. The 1982 privacy law punishes recording words spoken in private without the speaker's consent, and exempts nobody for being a party to the call. Keeping or using the recording is separately criminal. Take this one to Luxembourg counsel before you record anything.

Who has to be told before the campaign runs?

The staff delegation, in advance, and the notice content is prescribed: a detailed description of the purpose, how the system will be implemented, the retention period or its criteria, and a formal undertaking not to use the data for any other purpose. A delegation is mandatory from fifteen employees.

Can the staff delegation stop the campaign?

It cannot veto it, but it can freeze it. Within fifteen days of the notice the delegation may ask the data protection regulator for a prior opinion, and that request suspends the processing for the month the regulator has to answer. Co-decision applies only above one hundred and fifty employees, for other purposes.

Does Luxembourg ban presenting a number we do not hold?

No, and that is not the constraint. A 2024 regulation lets terminating operators block calls presenting Luxembourg geographic numbers that originate abroad where they can deduce a fraudulent objective, deciding on an unblocking request within forty-eight hours. Use a number you hold, and terminate domestically.

Compliance

Voice phishing simulations in Luxembourg

Phone numbers in LuxembourgProvisioned by Callstrike after approval

Two things make a Luxembourg voice phishing simulation different from its neighbours' and both belong in the plan rather than in the review. Being a party to the call does not make it lawful to record, and the notice you owe the staff delegation before you start gives them fifteen days to ask the regulator for an opinion that suspends the whole programme for a month.

Phone numbers

Supplied by Callstrike

Local numbers in Luxembourg, after a one-time approval.

Running a simulation

Permitted

The staff delegation cannot veto it, but it can stop the clock for a month.

Consent

Open in statute, doubted by the regulator

The labour code opens all six grounds; the regulator says employment agreement rarely qualifies.

Getting a phone number in Luxembourg

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Luxembourg numbers are not released from open inventory, so your workspace is cleared once and Callstrike then provisions a dedicated Luxembourg number against it. The clearance is short by the standards of this batch: the company's name and an address inside the Grand Duchy, both evidenced from the commercial register.

Plan the origination path in the same breath, because Luxembourg gives the decision to somebody else. A 2024 regulation recites that Luxembourg geographic numbers are intended for exclusive use on national territory, and it permits operators to block calls carrying such a number that originate outside the country wherever they have material to deduce a fraudulent purpose, with a maximum of forty-eight hours to decide an unblocking request. Nothing about that makes your campaign unlawful. It means the call may not arrive, and the person deciding is not you. Terminating domestically on a number genuinely held avoids it.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Luxembourg is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Business name	Excerpt from the commercial register
Business addressMust be within Luxembourg	Excerpt from the commercial register, Utility bill, Tax notice, Rent receipt, Title deed

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Luxembourg?

The position in short, before your counsel reads the detail below.

Yes, and the marketing rule that catches most European campaigns does not catch this one, for a reason worth knowing precisely. Luxembourg's transposition is scoped to direct marketing in every operative limb, and it is stricter than the European floor in extending the same opt-in to live human calls rather than only to automated systems. So what takes an internal exercise outside the article is its purpose, not the fact that a person rather than a machine is speaking. Nothing changes if you put an operator on the line.

The basis question has a genuine split in it. Since 2018 the labour code has permitted monitoring on any of the six grounds in the Regulation, opened rather than narrowed, and the closed list of five purposes that every secondary source still quotes was repealed eight years ago. But the regulator says that given the dependence and imbalance of power in the relationship, employees are very rarely in a position to refuse or withdraw, so agreement can very rarely be considered freely given, and its own stated view is the balancing ground. Statute and regulator now point opposite ways on the same question, and the safe reading is the regulator's.

Recording is where Luxembourg stands alone in this portal, and the answer is not a matter of degree. A 1982 privacy statute punishes listening to, recording or transmitting words spoken in private by a person without that person's consent, with imprisonment of eight days to one year. Nothing in it asks whether you were on the call. The only presumption in the article is for acts done in the course of a meeting openly and to the knowledge of its participants, which a covert simulation is by definition not, and a second article separately reaches keeping or replaying the recording. Design the programme to capture outcomes and no audio.

The employee side is information rather than co-decision, and it comes with a clock. You inform the staff delegation in advance, in a notice whose contents are prescribed, and within fifteen days the delegation or the employees concerned may ask the data protection regulator for a prior opinion, which it must give within a month and which suspends the programme meanwhile. Co-decision exists but is confined to three listed purposes in businesses of at least a hundred and fifty people, and an awareness test is none of those. Getting the information duty wrong is criminal rather than administrative.

What your company needs to do

6 items, in the order you will need them.

Write the prescribed notice, including the undertakingLuxembourg-specificFour elements: a detailed description of the purpose, how the system will be implemented, the retention period or the criteria for it, and a formal undertaking not to use the data for any purpose other than the one stated. That last one is a document you sign rather than a paragraph you write, so decide before signing whether measuring susceptibility could ever need to become something else.
Budget a month for the suspensive opinionLuxembourg-specificWithin fifteen days of your notice the delegation or the employees concerned may ask the regulator for a prior opinion, and the request suspends the programme for the month the regulator has to answer. Plan the campaign date around that possibility rather than discovering it in week three.
Record no audio at allLuxembourg-specificThe offence turns on the speaker's consent, not on your presence in the conversation, and keeping or replaying the recording is separately reachable. Capture whether the call was answered, whether a credential was disclosed and where the person disengaged. The custodial range is the reason this is a design rule rather than a preference.
Do not quote the repealed purpose list at yourselfLuxembourg-specificSecurity and health, protection of company assets, control of the production process, temporary performance control and flexitime is the 2002 text, replaced in 2018. Protection of company assets is not a permitted purpose in Luxembourg law; it is a phrase that was deleted. Those three surviving purposes are a co-decision trigger, not a permission list.
Document the balancing ground, not the agreementThe statute formally opens every ground, which makes it tempting to reach for the easy one. The regulator's published view is that employment agreement can very rarely be considered freely given and that the balancing ground is the appropriate condition. Write the assessment to the regulator's position and note in it that the statute is wider.
Plan for the AI transparency duty rather than around itThe European duties apply here directly and need no national act, even though Luxembourg has still not designated its authorities and the bill remains in committee. The exception on the face of the text covers use authorised by law to detect or prosecute criminal offences, which your own sign-off is not. An undesignated supervisor is not an absent duty.

The controls that do the work

How Callstrike is configured, and which provision in Luxembourg each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

The prescribed notice makes you state the purpose in detail and then undertake formally never to use the data for anything else, so the smaller the data set the easier that undertaking is to give and to keep. A call that ends the moment an employee begins to give up a credential produces a record of behaviour and no credential at all, which is both the narrowest thing you could put in the notice and the least likely to attract a request for the regulator's opinion.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

Where a delegation is deciding within fifteen days whether to send your programme to the regulator, what the exercise feels like to the person tested is not a soft consideration. A second voice that breaks character as the call ends, followed by vishing training in writing, is the difference between a monitoring system and a teaching one, and it is the part of the design worth describing in the notice rather than leaving to be discovered.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

The regulator says employment agreement can very rarely be considered freely given, so this is not the ground your assessment rests on. Its job here is the information layer beneath the delegation notice: a dated, attributable record of what individual staff were told, or a hashed copy of the policy or agreement you already rely on with a signed attestation of the scope.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

For a country where recording is criminal and the delegation can suspend the telephone programme for a month, having a second route matters more than usual. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after the module, and a call a person opens in their own browser is not a telephone call carrying a Luxembourg geographic number, so neither the marketing article nor the operator blocking regulation has anything to attach to.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

Every basis is open, and the regulator says one of them is not

Luxembourg legislates employee monitoring directly, which is unusual, and the version most sources quote is the wrong one. Since 2018 the labour code provides that processing personal data for the purpose of monitoring employees may be implemented by the employer only in the cases referred to in Article 6(1)(a) to (f) of the GDPR, and in accordance with the article. That is all six bases, opened rather than narrowed.

What it replaced was a closed list, and it is still quoted everywhere as if it were current: security and health of workers, protection of the undertaking's assets, control of the production process bearing only on machines, temporary control of production or of the worker's performance where that is the only means of determining exact pay, and flexitime. That list is the 2002 law, marked as not in force by the official register and replaced in 2018. Protection of company assets is not a permitted purpose in Luxembourg law; it is a phrase that was deleted eight years ago.

The same amendment reversed the consent position, and the reversal is the opposite of what a reader would guess. The repealed text said in terms that the data subject's consent does not render processing implemented by the employer legitimate. The current text formally opens consent along with the other five bases. The regulator, meanwhile, says that consent is in principle not an appropriate basis, that given the dependence and imbalance of power in an employer and employee relationship employees are only very rarely in a position to refuse or withdraw consent without fearing unfavourable consequences, and that consent can therefore very rarely be considered freely given. Its own view of the appropriate condition, stated generally, is the legitimate interests of the controller.

So the statute and the regulator now point in opposite directions on the same question, and the safe reading is the regulator's. What neither supplies is anything about a security test. We searched the regulator's thematic dossiers, opinions and decisions: it addresses video surveillance, vehicle geolocation, monitoring of internet use and email, and audio recording of meetings, and says nothing about awareness testing. That gap is real and we would rather name it than fill it.

The enforcement powers are the ordinary ones with one carve-out worth knowing: the regulator may impose the administrative fines provided for by Article 83 of the GDPR, except against the State or the communes, and may impose periodic penalty payments of up to five per cent of average daily turnover.

A 1982 statute that asks the speaker, not the listener

This is the section to read before anything else, because Luxembourg is the single country in our coverage where taking part in the call does not answer the question.

The controlling text is not in the criminal code. A 1982 statute on the protection of private life punishes, by imprisonment of eight days to one year and a fine or one of those penalties only, whoever has intentionally infringed the intimacy of another's private life by listening to or causing to be listened to, recording or causing to be recorded, transmitting or causing to be transmitted, by means of any device whatsoever, words spoken in private by a person, without that person's consent.

Read what the offence turns on. It is the consent of the person who spoke the words. Nothing in the provision asks whether the recorder was present, was addressed, or was the other party to the conversation. The single consent presumption in the article is for acts carried out in the course of a meeting openly and to the knowledge of its participants, and a covert simulation is by definition neither open nor known to the person being tested. The only other exclusion is for someone charged with maintaining or supervising a telephone network who listens in the exercise of those functions to check that the link is working.

A second article closes the obvious workaround. It applies the same penalties to anyone who, without the consent of the persons concerned, has knowingly kept, brought or allowed to be brought to the knowledge of the public or of a third party, or used, publicly or otherwise, any recording obtained through one of those acts. Retaining the audio and playing it back in a debrief are separately reachable.

On the money: the 1982 text still reads in old francs, and the conversion rule in the 2001 euro changeover law multiplies court-imposed franc fines by 0,025 and rounds up, which puts the fine at roughly sixty to twelve hundred and fifty euros. That is small and it is not the point. The custodial range is up to a year, the statute provides for destruction of the recordings, and a criminal conviction is not an operating cost.

One correction, because it recurs in every secondary source we checked. Articles 460 and 461 of the Luxembourg criminal code are not the interception provisions: 460 is the secrecy of a letter entrusted to the post and 461 opens the chapter on theft. Those numbers belong to Belgian law. We read the consolidated criminal code through for a general interception offence and there is none.

The last thing worth flagging is that the data protection regulator's own material will not warn you about any of this. Its guidance on audio recording of meetings, updated in July 2026, analyses recording purely under Article 6 of the GDPR and states that audio recording is not prohibited by law and can be concretely useful to a controller. That is defensible inside its remit, because the 1982 statute is enforced by criminal courts rather than by the regulator, but a reader who stops there will miss a custodial offence. The same guidance is worth borrowing on retention: recordings must be deleted once the minutes have been drawn up, signed and approved.

Marketing is the gate, and Luxembourg shuts it on live calls too

The Luxembourg transposition of the European rule on unsolicited communications is purpose-scoped in every operative limb, and that is what puts an internal security test outside it.

The first paragraph permits the use of automated calling and communication systems without human intervention, fax machines or electronic mail for the purposes of direct marketing only where it targets a subscriber or user who has given prior consent. A later paragraph extends the same prior consent requirement to unsolicited communications for the purposes of direct marketing by means other than those, which in Luxembourg brings live human calls inside the opt-in as well. That is stricter than the European floor and it is why the purpose scoping matters so much here: what takes a simulation outside the article is its purpose, not the fact that a person rather than a machine is speaking.

Two further limbs are worth knowing. The article prohibits sending electronic messages for the purposes of direct marketing while disguising, concealing or misrepresenting the identity of the sender, which is again confined to messages and to marketing. And the opt-in paragraphs apply to subscribers who are natural persons, so corporate lines sit outside them entirely. Breach carries eight days to one year and a fine of two hundred and fifty-one to one hundred and twenty-five thousand euros.

An honest currency note, because this portal has been caught by exactly this shape before. The only consolidated compilation the official register serves for that law is coordinated to 5 July 2018, and every later date we probed in the filestore returns nothing. The gazette record for the law itself reads as in force. We did not establish that the article is unamended since 2018, and we are not going to imply that we did.

The European transparency rule reaches Luxembourg directly and needs no national act. Article 50 of the AI Act has applied since 2 August 2026: a system built to interact with people must be designed so the person is informed they are dealing with an AI system, and a deployer of a system generating or manipulating audio constituting a deep fake must disclose that the content is artificially generated, in each case at the latest at the time of the first interaction or exposure. Both exceptions are narrow: use authorised by law to detect, prevent, investigate or prosecute criminal offences, and evidently artistic or satirical work. An employer authorising its own exercise is not authorisation by law.

There is a second article of that Regulation that a voice product should think about before it ships a feature rather than after. Article 5(1)(f) prohibits placing on the market or using AI systems to infer emotions of a natural person in the workplace, except for medical or safety reasons, and it has applied since 2 February 2025 at up to thirty-five million euros or seven per cent of worldwide turnover. It is gated by the definition of an emotion recognition system, which is confined to inference from biometric data, and the recitals exclude the mere detection of readily apparent expressions or characteristics of a person's voice such as a raised voice. Recording who disclosed what is untouched by it. Scoring how stressed a named employee sounded is an argument about a definition at seven per cent of turnover.

Luxembourg has still not designated its national authorities under that Regulation. The bill was deposited in December 2024, received the Conseil d'État's opinion in July 2026, and remains in committee; the deadline was 2 August 2025. The regulator has announced that it is to be the single point of contact and default market surveillance authority, but that is a statement about a bill. The duties bind regardless of who supervises them.

No spoofing ban, and an operator licence to block you anyway

Luxembourg has no statutory prohibition on presenting a number you do not hold. We read the caller identification provision of the 2005 law, which is entirely about the subscriber facilities to present or withhold a calling line identity and contains no such ban, and we read the numbering title of the 2021 electronic communications act in full. The control in Luxembourg is not a prohibition on the caller. It is a permission given to the operator at the other end.

Start with the numbering rules that do bind. The regulator grants and withdraws the rights of use for all national numbering resources under the national numbering plan, and numbering resources may not be transferred, assigned or made available to third parties other than end users. That second sentence is the one that constrains a vendor arrangement: a supplier cannot simply lend you a Luxembourg number to originate from.

Then the rule that actually decides whether your campaign connects. A 2024 regulation recites that Luxembourg geographic numbers are by definition intended for exclusive use on national territory, and that fraudulent calls using Luxembourg geographic numbers from abroad have increased. It provides that operators supplying fixed or mobile call termination may block calls coming from Luxembourg geographic numbers originating in a country other than the Grand Duchy where they have sufficient material to deduce that those calls pursue fraudulent objectives, and that they bear full responsibility for doing so. An operator must decide on an unblocking request within a maximum of forty-eight hours.

Stated plainly for a buyer: a platform terminating calls into Luxembourg while presenting a Luxembourg geographic number from infrastructure outside the country is squarely inside what that regulation authorises operators to block, at their discretion, with a forty-eight hour cycle to argue about it. Nothing makes the call unlawful. It just may not arrive, and the person who decides is not you.

The route that avoids the problem is the boring one. Use a number the employer or its supplier genuinely holds a right of use in, and terminate domestically.

What the country matrix holds for Luxembourg

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

A prescribed notice, a fifteen-day clock, and a suspensive opinion

Luxembourg tells you what the notice has to contain, which almost no other country in this portal does, and it gives the people you notify a way to stop the clock.

The employer must inform in advance the joint committee or, failing that, the staff delegation or, failing that again, the labour and mines inspectorate. The prior information must contain a detailed description of the purpose of the envisaged processing, the manner in which the surveillance system will be implemented, where applicable the retention period or the criteria for retention, and a formal undertaking by the employer not to use the data collected for any purpose other than the one explicitly stated in the prior information.

That last element is the unusual one and it is the concrete deliverable. A formal undertaking about future use is a document you sign, not a paragraph you write, and it has an operational consequence a security programme should think about before signing: if the notice says the purpose is measuring susceptibility, the results cannot later be repurposed into a performance record. A staff delegation is mandatory from fifteen employees, so above that threshold there is always somebody to inform.

Then the clock. Within fifteen days of the prior information, the staff delegation or, failing that, the employees concerned may submit a request for a prior opinion to the data protection regulator, which must give its opinion within a month of being seised, and the request has suspensive effect during that period. A Luxembourg campaign can therefore be frozen for a month by people who read the notice and did not like it. Plan the timeline around that rather than discovering it.

What Luxembourg does not give the delegation is a veto. Co-decision, where decisions must be taken by common agreement between employer and staff delegation, bites on the introduction or application of technical installations intended to check the behaviour and performance of the employee at the workstation, but only in undertakings employing at least one hundred and fifty people, and only where the processing is for one of three listed purposes: employees' safety and health, control of production or performance where that is the only means of determining exact pay, or flexitime. An awareness test is none of those. On the face of the statute a vishing simulation triggers information, not co-decision.

Getting it wrong is criminal rather than administrative. Carrying out processing in breach of the monitoring article is punished by imprisonment of eight days to one year and a fine of two hundred and fifty-one to one hundred and twenty-five thousand euros, or one of those penalties only.

One curiosity that tells you how old the drafting is. The article still requires prior information of the joint committee, a body abolished in 2015, and still applies an article L.423-1 that no longer exists in the labour code. The regulator's own summary quietly drops the dead cross-reference. Read the surviving limbs.

A law that says train, and a delegated regulation that says social engineering

Luxembourg transposed the European network and information security directive by a law of 5 May 2026, which the regulator published as entering into force on 10 May 2026. Its minimum measures include basic cyber hygiene practices and cybersecurity training, and essential entities must notify the measures they take to the competent authority. Nothing in the law names phishing, vishing or social engineering, and nothing in it requires a simulation. The telecoms regulator is competent generally, and the financial supervisor is the competent authority for cybersecurity in the banking sector and for financial market infrastructures.

A currency warning for anyone checking that for themselves: the official register's own machine-readable in-force flag on that law reads not in force, while its temporal coverage reads 10 May 2026 and the regulator published an entry into force notice five days later. The same field reads in force on an older law that does have a consolidated version. Do not use it as a currency check in Luxembourg.

For financial entities the European digital operational resilience Regulation has applied since 17 January 2025 and it is direct law. It makes ICT security awareness programmes and digital operational resilience training compulsory modules in staff training schemes, applicable to all employees and to senior management, at a level of complexity commensurate with their functions. Its list of testing types runs from vulnerability assessments through to penetration testing and does not include social engineering, and its threat-led penetration testing is defined against critical live production systems. The Regulation does not require a vishing simulation.

The text that does reach people is the delegated regulation on threat-led penetration testing, and for a Luxembourg financial entity it is the strongest documentation hook in this whole area. Its recitals describe the exploitation phase as one where the testers' goal is to compromise the entity's servers and networks and exploit its staff through social engineering, and require the test to be covert, with staff outside the control team made aware only where there are cogent reasons and with the prior agreement of the test managers. Its annex on the content of the red team test plan requires the plan to record the tactics, techniques and procedures allowed and not allowed, including the ethical boundaries for social engineering. Where a vishing simulation runs inside such a test, that document is a regulatory requirement rather than good practice, and everyone else can read it as the best available template.

The national framework sits on top. The implementation document for the Luxembourg threat intelligence based ethical red teaming framework, published in June 2025, was revised following the Regulation and the European framework's own 2025 revision, and the cyber team is operated jointly by the central bank and the financial supervisor. Entities in scope include those mandated to perform such a test and others selected by the two authorities that agree to test voluntarily.

The financial supervisor's information and communications technology circular asks for less than people assume. It says institutions should establish a training programme, including periodic security awareness programmes for all staff and contractors, at least annually. We searched it for phishing, vishing and social engineering and found none of them.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in LUXEMBOURG. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored and no audio is recorded. The staff delegation has been informed in advance.

Verify or correct each proposition below against primary Luxembourg sources:

1. ⚠ Loi du 11 aout 1982, art. 2, 1 turns on the SPEAKER's consent and exempts no participant; the only presumption is for a meeting 'au vu et au su de ses participants'. Art. 4 separately criminalises keeping or using the recording.
2. ⚠ Code penal arts 460 and 461 are NOT the Luxembourg interception provisions (460 is postal secrecy, 461 opens the chapter on theft); those numbers are Belgian.
3. Code du travail art. L.261-1 opens all six GDPR Art 6(1) grounds. ⚠ The 'exhaustive purpose list' (security and health, company assets, production process, temporary performance control, flexitime) is art. 11(1) of the loi du 2 aout 2002, REPEALED.
4. The L.261-1 prior information must contain the purpose, the implementation, the retention, and a formal undertaking not to repurpose; the delegation has 15 days to seek a CNPD opinion with suspensive effect for a month.
5. Co-decision under L.414-9 is confined to three purposes and to 150+ employees.
6. Loi du 30 mai 2005, art. 11 is purpose-scoped to direct marketing and extends the opt-in to live calls. ⚠ CURRENCY UNESTABLISHED: Legilux's only consolidation is coordinated to 5 July 2018. Confirm it is unamended.
7. Reglement ILR/T24/1 permits operators to block Luxembourg geographic CLI originating abroad, with a 48-hour unblocking decision.

Flag anything that has changed since September 2026. ⚠ Do not use Legilux's legislationLegalForce field as a currency check; it is unreliable here.

Common questions

Can we record the simulation call in Luxembourg?: Not safely on the face of the statute. The 1982 privacy law punishes recording words spoken in private without the speaker's consent, and exempts nobody for being a party to the call. Keeping or using the recording is separately criminal. Take this one to Luxembourg counsel before you record anything.
Who has to be told before the campaign runs?: The staff delegation, in advance, and the notice content is prescribed: a detailed description of the purpose, how the system will be implemented, the retention period or its criteria, and a formal undertaking not to use the data for any other purpose. A delegation is mandatory from fifteen employees.
Can the staff delegation stop the campaign?: It cannot veto it, but it can freeze it. Within fifteen days of the notice the delegation may ask the data protection regulator for a prior opinion, and that request suspends the processing for the month the regulator has to answer. Co-decision applies only above one hundred and fifty employees, for other purposes.
Does Luxembourg ban presenting a number we do not hold?: No, and that is not the constraint. A 2024 regulation lets terminating operators block calls presenting Luxembourg geographic numbers that originate abroad where they can deduce a fraudulent objective, deciding on an unblocking request within forty-eight hours. Use a number you hold, and terminate domestically.

Elsewhere in Western Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.