The Directive 2016/943 on the protection of undisclosed know-how and business information (trade secrets) is key in harmonising national laws concerning trade secrets.
The Law of 26 June 2019 on Trade Secrets (the Trade Secrets Act) implements into Luxembourg law the EU Directive No 2016/943 of 8 June 2016 on the protection of trade secrets against their unlawful acquisition, use and disclosure. The Law provides a legal definition of “trade secrets”, which was until now only defined by the courts. The Trade Secrets Law fills a gap for businesses for which trade secrets have significant commercial value but do not satisfy the conditions to be protected under intellectual property law or are not registered as an industrial property title (on a voluntary basis) because of their confidential nature.

It is reported that passive sharing of telecom infrastructure is not mandated by law, but it is practised in the mobile sector. Under Art. 44 of the Law on Electronic Communications Networks and Services, the regulator has the possibility of authorising the sharing and co-location of resources.
Directive 2014/61/EU (Art. 3.2) establishes that Member States shall ensure that, upon written request of an undertaking providing or authorised to provide public communications networks, any network operator must meet all reasonable requests for access to its physical infrastructure under fair and reasonable terms and conditions, including price, with a view to deploying elements of high-speed electronic communications networks. Such written request shall specify the elements of the project for which the access is requested, including a specific time frame.

It is reported that POST Luxembourg (formerly Entreprise des Postes et Télécommunications) is a wholly state-owned company. In addition, it is reported that LuxConnect is a wholly state-owned company. LuxConnect is a Luxembourg-based company that specialises in providing data centre and connectivity services. It operates as a national provider of ICT (Information and Communications Technology) infrastructure for Luxembourg's public and private sectors.

It is reported that there is no requirement for functional separation for operators with significant market power. However, accounting separation is required in certain cases, e.g. if annual turnover exceeds 50 Million Euros for the activities related to the operation of electronic communication networks and services.

It is reported that the Institut Luxembourgeois de Régulation (ILR), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Point 143 (b) of the Commission de Surveillance du Secteur Financier (CSSF, Financial Sector Supervisory Commission) Circular 22/806 requires resiliency of cloud computing services and, therefore, the localisation of at least one data centre in the European Economic Area.

Art. 8 of the Commercial Code requires that accounting books, financial records and supporting documents relating to branches or operational offices of foreign undertakings established in the Grand Duchy be kept in Luxembourg, while allowing these to be preserved either in paper or electronic form.

The European Union General Data Protection Regulation (GDPR) provides a comprehensive framework for data protection that applies to all EU Member States. Luxembourg implemented the GDPR in 2018 through the Act of 1 August 2018 on the Organization of the National Commission for Data Protection and Implementing the GDPR.

Under the EU Directive on Data Retention, operators were required to retain certain categories of traffic and location data (excluding the content of those communications) for a period between six months and two years and to make them available, on request, to law enforcement authorities for the purposes of investigating, detecting and prosecuting serious crime and terrorism. On 8 April 2014, the Court of Justice of the European Union declared the Directive invalid. However, not all national laws that implemented the Directive have been overturned.
Pursuant to Art. 5 and Art. 9 of the Act of May 30 2005, any telecom service provider or operator who processes traffic or location data shall be required to retain such data for a period of six months for the purposes of investigating and prosecuting criminal offences, and for the sole purpose of making information available to the judicial authorities where necessary. Although the Court of Justice of the European Union declared the EU directive on Data Retention, upon which the articles are based, invalid, Luxembourg has kept the data retention period of six months in its legislation. However, in order to (partly) comply with the Court's reasoning, the amended articles require that the retained data must be deleted irrevocably and without any delay at the expiration of the retention period.

It is reported that there are no specific restrictions on foreign ownership or control and no sectoral limitations. The country conducts a general review of foreign investments, similar to that applied to domestic investments.

The Luxembourg Act of 14 July 2023, which establishes a new foreign direct investment (FDI) regime, applies to investments in critical sectors such as telecommunications, data processing/storage, and media (Art. 2) by investors from outside the European Economic Area (foreign investors). These investments allow foreign investors to exercise direct or indirect control over entities established under Luxembourg law. According to Art. 3, any investment subject to this FDI regime must be notified to the Ministry of the Economy and receive authorisation before implementation.
Control is considered acquired when a foreign investor meets any of the following thresholds: holding 25% of the voting rights in the Luxembourg entity; holding a majority of the voting rights of shareholders or partners, with multiple notifications required for multi-stage acquisitions; having the right to appoint or remove the majority of board members while being a shareholder or partner; or controlling a majority of voting rights through agreements with other shareholders or partners.
The FDI Law also classifies as critical any research, production, or supplementary activities that could provide access to sensitive information or locations directly related to these sectors.

Art. 83 of the Law of July 20, 1992, on the Changes in the System for Patents for Invention (so-called Patent Act), establishes a local representation requirement for applicants without domicile or headquarters in the territory of the European Union.

Luxembourg is a party to the Patent Cooperation Treaty (PCT).

There is no general principle for the use of copyright-protected material comparable to the fair use/fair dealing principles. Directive 2001/29/EC defines an optional but exhaustive set of limitations from the author´s exclusive rights under the control of the “three-step test” in line with the Berne Convention that establishes three cumulative conditions to the limitations and exceptions of a copyright holder’s rights. The Directive has been transposed by Member States with significant freedom.
The Law on Copyright, Related Rights and Databases implements the EU copyright directive. Section 2 provides for a closed list of exceptions to the author’s copyrights under certain conditions. These exceptions include education purposes, private use, caching, press information and parody.