A parliamentary question about Luxembourg’s outsourcing of visa-application processing to VFS Global has exposed uncertainty over how the associated privacy risks were evaluated.
Foreign Minister 
The ministry said no formal data-protection impact assessment had been conducted. It instead carried out an analysis while drawing up the contract to ensure that the requirements of the EU Visa Code governing cooperation with external providers were included.
The answer does not explain why the ministry concluded that a formal assessment was unnecessary. Under EU data-protection rules, such assessments are required before processing that is likely to pose a high risk to people’s rights and freedoms.
Questions over access
Visa applications can contain extensive personal information. Luxembourg’s Foreign Ministry says applicants must provide personal data including a photograph and, where required, fingerprints for the examination of a short-stay visa application.
Clement also asked whether the ministry had ever become aware of a request by a foreign authority for access to applicants’ data. Bettel did not say whether any such request had been received.
The minister instead said the risk was limited because VFS Global processed the information exclusively on behalf of the Luxembourg authorities and was not authorised to use or disclose it for other purposes. In the event of a legally binding request, VFS Global and the Luxembourg authorities would be bound by the applicable law, contractual provisions and safeguards, he added.
Separate rules for optional services
Clement’s question followed information published by VFS Global warning that personal data could be transferred to affiliated companies, service providers, overseas servers or authorities in other countries.
The ministry said this general notice concerned activities for which VFS Global was itself responsible, such as creating an account on its portal or providing optional commercial services. It did not apply to the information collected and processed as part of a Luxembourg visa application, for which the Luxembourg state remains responsible.
For optional services such as returning documents by courier, sending text-message notifications or managing appointments, VFS processes information including names, contact details and application reference numbers. The ministry said only information needed to provide the service was used.
VFS Global is not authorised to process Luxembourg visa-application data independently for quality assurance, technical support or internal administration, according to Bettel. The use of any further subcontractors is subject to contractual provisions drawn up in line with EU data-protection rules.
The minister also said unannounced inspections covered the handling of application files, data stored in the provider’s system and compliance with contractual retrieval and deletion procedures. The practices of external providers are additionally examined during EU evaluations of the implementation of Schengen rules.
Correction, 22 September 2026: This article originally stated that data from Luxembourg visa applications could be stored in London or Mumbai, based on the ministerial answer available when it was published on 14 September. A revised answer subsequently clarified that those locations concerned visa applications for which Luxembourg was not responsible. The inaccurate references have been removed.
