Data protection & privacy law in France (2026)

Legal framework

EU General Data Protection Regulation (Regulation (EU) 2016/679) as implemented nationally by the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés, as amended by Law No. 2018-493 of 20 June 2018 and Ordinance No. 2018-1125 of 12 December 2018). The Commission Nationale de l'Informatique et des Libertés (CNIL) is the national supervisory authority.

GDPR & data protection in France

In France, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Commission Nationale de l'Informatique et des Libertés (CNIL).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Commission Nationale de l'Informatique et des Libertés (CNIL)

Applies to

any organisation processing the personal data of people in France, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; France supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in France

1. 01Primary law and national adaptation

   The GDPR applies directly; France exercises Member State discretion through the Loi Informatique et Libertés (Law No. 78-17), substantially amended by Law No. 2018-493 of 20 June 2018 and Decree No. 2019-536 of 29 May 2019. This dual-layer system means GDPR sets the baseline and French law adds sector-specific rules (health data, criminal-justice files, minors, biometrics).

   cnil.fr regulations.ai

2. 02Supervisory authority — CNIL

   The Commission Nationale de l'Informatique et des Libertés (CNIL), created in 1978, is the independent administrative authority responsible for supervision, investigations, guidance, DPO registration and sanctions. It also serves as France's market surveillance authority for AI systems processing personal data ahead of the EU AI Act's high-risk obligations becoming applicable on 2 August 2026.

   cnil.fr dig.watch

3. 03Core controller obligations

   Controllers must respect GDPR principles (lawfulness, purpose limitation, data minimisation, storage limitation, security), maintain records of processing, conduct DPIAs for high-risk processing, ensure valid legal basis (including granular consent where required), and appoint a Data Protection Officer where the processing is by a public authority or involves large-scale monitoring or sensitive-data processing. DPO designation is made through CNIL's online procedure.

   cnil.fr cnil.fr

4. 04Data-subject rights and breach notification

   Individuals have GDPR rights of access, rectification, erasure, restriction, portability, objection and safeguards against solely automated decisions; controllers must respond within one month. Personal-data breaches likely to pose a risk must be notified to the CNIL without undue delay and where feasible within 72 hours; affected individuals must be informed where the risk is high.

   dlapiperdataprotection.com linklaters.com

5. 05Cookies and trackers (Article 82)

   The ePrivacy Directive is transposed into Article 82 of the Loi Informatique et Libertés. Non-essential cookies and trackers require prior, informed and freely-given consent that must be as easy to refuse as to accept; the CNIL recommends a maximum 13-month lifespan/consent-refresh. Cookie violations have been a leading enforcement theme, including fines against Google and Shein totalling roughly €475 million.

   iapp.org cnil.fr

6. 06Sanctions and enforcement intensity

   In 2025 the CNIL adopted 259 corrective decisions including 83 sanctions (78 with financial penalties) totalling €486,839,500, focused on cookies, workplace surveillance and data security. Recent 2026 fines include €5 million against France Travail (formerly Pôle Emploi) on 22 January 2026 for security failings and €5 million against IQVIA Operations France on 26 May 2026 for health-data-warehouse deficiencies. Maximum GDPR fines of €20 million or 4% of worldwide annual turnover apply.

   cnil.fr babl.ai

GDPR in France: FAQ

Timeline of decisions

1. 22 Jan 2026Enforcement · official
   CNIL fines France Travail €5 million over 43-million-record breach

   The CNIL sanctioned the national employment agency France Travail (formerly Pôle Emploi) €5M for failing to secure job-seeker data after a 2024 breach exposed personal data of up to 43 million people. It shows continued aggressive enforcement of GDPR security obligations against public bodies.

   CNIL

2. 1 Jan 2026Enforcement · official
   CNIL's record 2025 enforcement year: 83 sanctions, €486 million

   The CNIL reported 83 sanctions totalling roughly €487M in 2025, nearly nine times the 2024 total, driven by cookies, employee surveillance and data-security cases. It signals a sustained intensification of France's enforcement posture and 2026 priorities including generative AI and minors' data.

   CNIL

3. 22 Dec 2025Enforcement · official
   CNIL fines NEXPUBLICA France €1.7 million for data-security failures

   The CNIL penalised NEXPUBLICA France €1,700,000 for failing to implement sufficient security measures in its PCRM software. The case reinforces that Article 32 GDPR security duties are a primary enforcement target.

   CNIL

4. 23 Jan 2024Enforcement · official
   CNIL fines Amazon France Logistique €32 million for intrusive employee monitoring

   Following a 27 December 2023 decision, the CNIL announced a €32M fine over a scanner-based system that tracked warehouse workers' productivity and inactivity in excessive detail, plus inadequate video surveillance. A landmark on the limits of workplace surveillance under GDPR.

   CNIL

5. 17 Oct 2022Enforcement · official
   CNIL fines Clearview AI €20 million over facial recognition

   The CNIL imposed its maximum penalty on Clearview AI for unlawfully processing biometric data scraped from the web without a legal basis and ignoring data-subject rights, ordering it to stop collecting and to delete French residents' data. A defining European stance on facial-recognition scraping.

   CNIL

6. 10 Dec 2020Enforcement · official
   CNIL fines Google €100M and Amazon €35M over cookies

   The CNIL issued then-record fines totalling €135M for placing advertising cookies without prior consent and without adequate information, applying France's ePrivacy/cookie rules. It cemented strict French cookie-consent enforcement, later upheld by the Council of State.

   CNIL

7. 21 Jan 2019Enforcement · official
   CNIL fines Google €50 million, first major French GDPR sanction

   The data-protection authority penalised Google for lack of transparency and invalid consent for ad personalisation; upheld by the Conseil d'État in 2020, it set the tone for GDPR-driven security and consent enforcement in France.

   CNIL

8. 21 Jan 2019Enforcement · official
   CNIL fines Google €50 million, first major GDPR sanction

   Acting on complaints from NOYB and La Quadrature du Net, the CNIL's restricted committee fined Google LLC €50M for lack of transparency, inadequate information and invalid consent for ad personalisation. It was the first multi-million-euro GDPR fine in Europe.

   EDPB / CNIL

9. 20 Jun 2018Law · official
   Law No. 2018-493 adapts French law to the GDPR

   France enacted Law No. 2018-493 to align the 1978 Data Protection Act with the GDPR and transpose Directive 2016/680 for criminal-justice processing, strengthening the CNIL and setting national rules for sensitive data. The Act was later recodified by Ordinance 2018-1125 (in force 1 June 2019).

   Vie-publique (Gouvernement)

10. 25 May 2018Law · official
    GDPR becomes directly applicable in France

    EU Regulation 2016/679 took effect across all member states, becoming the directly applicable backbone of French data protection and supervised domestically by the CNIL. It introduced turnover-based fines, breach notification and strengthened data-subject rights.

    EUR-Lex (EU)

11. 6 Jan 1978Law · official
    Loi Informatique et Libertés creates the CNIL

    Prompted by the SAFARI file-interconnection scandal, France enacted Law No. 78-17, one of the world's first data-protection laws, and created the CNIL as its first independent administrative authority. It remains the foundation of French data protection and influenced the later GDPR.

    Légifrance

Sources

1. 1.cnil.fr/fr/entree-en-vigueur-de-la-nouvelle-loi-informatique-et-libertes
2. 2.cnil.fr/en/sanctions-and-corrective-measures-cnils-actions-2025
3. 3.cnil.fr/en/cnil-publishes-guide-dpos
4. 4.cnil.fr/sites/cnil/files/atoms/files/cnil-gdpr_practical_guide_data-protectio
5. 5.cnil.fr/en/evolution-practices-web-regarding-cookies-cnil-evaluates-impact-it
6. 6.dig.watch/updates/cnil-2026-gdpr-ai-guidance-agenda
7. 7.regulations.ai/regulations/RAI-FR-NA-N22J2XX-2018
8. 8.dlapiperdataprotection.com/?t=breach-notification&c=FR
9. 9.linklaters.com/en/insights/data-protected/data-protected---france
10. 10.iapp.org/news/a/cnils-eprivacy-fines-reveal-potential-enforcement-trend
11. 11.babl.ai/frances-data-protection-authority-issues-e486-8-million-in-fines-as-c