Data protection & privacy law in France (2026)

Yes. As an EU/EEA member, France applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Commission Nationale de l'Informatique et des Libertés (CNIL).

The Commission Nationale de l'Informatique et des Libertés (CNIL).

Up to €20 million or 4% of global annual turnover, whichever is higher.

A DPO is required where you carry out large-scale monitoring or process special-category data at scale.

Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.

The GDPR applies directly; France exercises Member State discretion through the Loi Informatique et Libertés (Law No. 78-17), substantially amended by Law No. 2018-493 of 20 June 2018 and Decree No. 2019-536 of 29 May 2019. This dual-layer system means GDPR sets the baseline and French law adds sector-specific rules (health data, criminal-justice files, minors, biometrics).

The Commission Nationale de l'Informatique et des Libertés (CNIL), created in 1978, is the independent administrative authority responsible for supervision, investigations, guidance, DPO registration and sanctions. It also serves as France's market surveillance authority for AI systems processing personal data ahead of the EU AI Act's high-risk obligations becoming applicable on 2 August 2026.

Controllers must respect GDPR principles (lawfulness, purpose limitation, data minimisation, storage limitation, security), maintain records of processing, conduct DPIAs for high-risk processing, ensure valid legal basis (including granular consent where required), and appoint a Data Protection Officer where the processing is by a public authority or involves large-scale monitoring or sensitive-data processing. DPO designation is made through CNIL's online procedure.

Individuals have GDPR rights of access, rectification, erasure, restriction, portability, objection and safeguards against solely automated decisions; controllers must respond within one month. Personal-data breaches likely to pose a risk must be notified to the CNIL without undue delay and where feasible within 72 hours; affected individuals must be informed where the risk is high.

The ePrivacy Directive is transposed into Article 82 of the Loi Informatique et Libertés. Non-essential cookies and trackers require prior, informed and freely-given consent that must be as easy to refuse as to accept; the CNIL recommends a maximum 13-month lifespan/consent-refresh. Cookie violations have been a leading enforcement theme, including fines against Google and Shein totalling roughly €475 million.

In 2025 the CNIL adopted 259 corrective decisions including 83 sanctions (78 with financial penalties) totalling €486,839,500, focused on cookies, workplace surveillance and data security. Recent 2026 fines include €5 million against France Travail (formerly Pôle Emploi) on 22 January 2026 for security failings and €5 million against IQVIA Operations France on 26 May 2026 for health-data-warehouse deficiencies. Maximum GDPR fines of €20 million or 4% of worldwide annual turnover apply.