What is the CNIL, and what can it do to your business?
France’s supervisory authority, with real powers. GDPR compliance in France starts with knowing who checks it: the Commission nationale de l’informatique et des libertés, or CNIL, an independent administrative authority that article 8 of the French data protection law n° 78-17 of 6 January 1978 (loi Informatique et libertés), checked October 2026, makes the national supervisory authority for the GDPR, with a duty to inform, guide and investigate.
Investigations: on site, online, under an assumed identity
Under article 19, CNIL members and authorised agents have access, from 6 a.m. to 9 p.m., to premises used for processing, after informing the public prosecutor; if the occupant objects, the visit needs a judge’s authorisation. They may request any document and access programs and data. Online, they may consult freely accessible data and, to check an online service, act under an assumed identity.
From a warning to a fine
Article 20, checked October 2026, ranks the measures. The CNIL’s president may warn you, remind you of your obligations or issue a formal notice, the mise en demeure, within a deadline of 24 hours in urgent cases, and make it public.
The formation restreinte, its restricted committee, may then order a call to order, an injunction with a penalty of up to 100,000 euros per day, a limitation or ban of the processing, a suspension of transfers, and a fine up to the ceilings of article 83 of the GDPR, set out in the fines table of the guide to the EU representative.
Where does France add to the GDPR?
In five places a business with French users meets every month. The GDPR applies directly; the loi Informatique et libertés fills the margins left to member states and transposes the ePrivacy directive on cookies; the CNIL turns both into guidelines, models and online services.
Row by row: a notice in French, with lines on minors and on data after death; cookie consent by a clear positive act, refused as easily as given, proved, kept six months; a CNIL model for the record, an online service for the DPO; a French list of fourteen processing types; breach notification to the CNIL online.
Minors: fifteen, not sixteen
Article 8 of the GDPR lets a child consent alone to an information society service from 16, and lets member states go down to 13. Article 45 of the loi n° 78-17, checked October 2026, sets 15 in France; below 15, the minor and the holders of parental authority consent together. Information for a minor is written in clear and simple terms.
Data after death
Article 85, checked October 2026, lets anyone give directives on the retention, erasure and communication of their data after death, with a trusted third party certified by the CNIL or, for particular directives, with you, by specific consent and never through your terms of use. Every online service tells users what becomes of their data at their death (article 85, III).
No prior formality for a business
A private company files no declaration with the CNIL before processing. The formalities the law keeps, in articles 31 and 32, concern processing on behalf of the State, from security to biometric identity data, by order or decree after a published position of the CNIL.
What does cookie consent require in France?
Consent before any tracker that is not strictly necessary, through an act as easy to refuse as to give. Article 82 of the loi n° 78-17, checked October 2026, transposes article 5(3) of the ePrivacy directive 2002/58/EC: the user is informed clearly and completely of the purpose of any access to or writing in the device, and of the means to object, and access or writing may only follow consent.
Two exemptions, read narrowly
Article 82 exempts operations that only enable electronic communication, and those strictly necessary to a service the user expressly requested. The CNIL’s guidelines of 17 September 2020, deliberation n° 2020-091, checked October 2026, list what may be exempt: the tracker remembering the user’s choice, authentication, a shopping basket, the language setting and some audience measurement trackers under conditions.
A clear positive act, and refusal as easy
Consent must be freely given, specific, informed and unambiguous, by a clear positive act. Browsing on, scrolling or a pre-ticked box is not consent; without a positive act, the user has refused. The user must know who the controllers are, the purposes, how to accept or refuse, the consequences of either and the right to withdraw. Refusing must take no effort, or an action as simple as consenting.
Recommendation n° 2020-092 of the same day, a practical guide rather than a rule, strongly recommends two buttons of the same format on the same screen, such as “tout accepter” and “tout refuser”: one click to accept against several to refuse biases the choice.
Proof and durations
You must be able to prove valid consent at any time (article 7(1) of the GDPR), for instance with timestamped screenshots of each banner. Keeping the user’s choice, consent or refusal, for 6 months is a good practice; audience measurement trackers exempt from consent should live 13 months, with 25 months of retention for the data. These durations are recommendations, not article 82.
Must your privacy notice be in French?
For a French public, write it in French, and add two French lines. The content comes from the GDPR; the language and the additions from French law.
What articles 13 and 14 require
Articles 13 and 14 of the GDPR, checked October 2026, list what you tell people when you collect their data, or within a month when you obtained it elsewhere: your identity and contacts, those of your EU representative and DPO where you have them, the purposes and legal basis, the recipients, transfers outside the Union, the retention period, the rights and any automated decision. Article 12 asks for clear and plain language.
The language, and two French lines
The GDPR names no language. Article 2 of the loi n° 94-665 of 4 August 1994 (loi Toubon), checked October 2026, makes French mandatory in the designation, offer, presentation, instructions for use and warranty terms of a product or service, in invoices and in advertising. A notice framing the service you offer in France belongs to that presentation: write it in French, with an English version for your staff.
Two lines come from French law alone: for minors, information in clear and simple terms (article 45); for an online service, the fate of users’ data at their death and the choice of a person to receive it (article 85, III). The language of your contracts is covered in the guide to doing business in France.
Do you need a register and a DPO in France?
A record of processing almost always; a DPO only in the cases of article 37.
The record of processing, and the CNIL’s model
Article 30 of the GDPR, checked October 2026, requires each controller, and each processor for what it does for clients, to keep a written record: contacts, purposes, categories of people and data, recipients, transfers, erasure periods and, where possible, security measures. The exemption below 250 persons falls away as soon as the processing is not occasional, likely to result in a risk, or involves sensitive or criminal data.
The CNIL reads that exemption as little more than a one-off campaign. It publishes a model register in spreadsheet form and recommends two registers where you are both controller and processor (page checked October 2026). The register is internal, but it is the first document an investigation asks for.
When a DPO is mandatory, and how you designate it
Article 37 of the GDPR, checked October 2026, requires a data protection officer for public bodies, for core activities that require regular and systematic monitoring of people on a large scale, and for core activities that process sensitive or criminal data on a large scale. French law adds no case for private businesses. The DPO, an employee or an outside provider, needs the competence, the means and the independence to act: the three conditions the CNIL asks you to check.
Designation, replacement and end of mission go exclusively through the CNIL’s online DPO service, page of 3 April 2026 checked October 2026, whose forms ask for your SIREN number. The DPO is neither the EU representative of the article 27 guide nor a Concord service.
What do impact assessments and breaches require in France?
An assessment before any high-risk processing, with a French list of fourteen types; a notification to the CNIL within 72 hours where feasible.
The CNIL’s list of fourteen processing types
Article 35 of the GDPR, checked October 2026, requires an impact assessment before processing likely to result in a high risk, and lets each authority list the processing that always requires one. The CNIL’s list, deliberation n° 2018-327 of 11 October 2018, checked October 2026, names fourteen types, among them profiling for human resources, constant monitoring of employees, whistleblowing alerts, profiling that may exclude a person from a contract and large-scale location data.
Outside the list, the CNIL applies the EDPB’s nine criteria: two met call for an assessment. The assessment describes the processing, weighs necessity and proportionality, evaluates the risks and sets the measures (article 35(7)); it goes to the CNIL only where the residual risk remains high, the prior consultation of article 36.
72 hours to notify the CNIL
Article 33 of the GDPR, checked October 2026: a breach is notified to the competent authority where feasible within 72 hours of becoming aware of it, unless it is unlikely to result in a risk; a later notification states the reasons for the delay. In France it goes through the CNIL’s online breach service, checked October 2026, which accepts an initial notification, then a complement when the facts are known.
Every breach is documented internally, notified or not. Where the risk is high, the people are informed too (article 34); the CNIL may order it, at your cost (articles 20 and 22 of the law). A processor notifies you, not the CNIL, within the hours agreed in the data processing agreement.
How does the CNIL sanction, and what is published?
Through two procedures, one of them public by name; both end on the CNIL’s website.
Two procedures
Under article 22 of the loi n° 78-17, checked October 2026, the formation restreinte decides on a report by a CNIL member who sits outside it; you receive the report and may be assisted or represented. The committee may make its decisions public, at your expense, and order you to inform each person concerned.
Article 22-1, checked October 2026, adds a simplified procedure before the committee’s president, or a member sitting alone, for cases without particular difficulty: a fine of 20,000 euros at most and a penalty of 100 euros per day, raised to 100,000 euros and 500 euros per day above 50 million euros of worldwide turnover. These decisions cannot be made public.
| Who decides | Measures | Ceiling | Article of the loi n° 78-17 |
|---|---|---|---|
| The CNIL’s president | Warning, reminder of obligations, formal notice, possibly public | Deadline it sets, 24 hours in urgent cases | Article 20, I and III |
| The formation restreinte | Call to order, injunction with penalty, limitation or ban, suspension of transfers, fine, publication | Penalty up to 100,000 euros per day; fine up to the ceilings of article 83 of the GDPR | Articles 20, IV and 22 |
| Its president alone, simplified procedure | Call to order, injunction, fine, never made public | Fine 20,000 euros and penalty 100 euros per day; 100,000 euros and 500 euros per day above 50 million euros of turnover | Article 22-1 |
What the published list shows
The CNIL’s page of sanctions, updated 14 April 2026 and checked October 2026, lists each decision since the GDPR by date, type of organisation and breaches. In the first months of 2026, a few fines in the millions against large operators sit beside a majority of simplified-procedure fines of a few thousand euros against small companies and associations, for information of individuals, access requests, video surveillance or cookies.
Concord’s GDPR compliance audit maps your processing against the GDPR and this French layer, builds the register and says whether you need an impact assessment or a DPO. The privacy policy and cookie notice, in French and English, carries the lines and the banner French users and the CNIL expect. Show us your site and your forms. The other data questions of a French client are in the guide to doing business in France.