--- title: "France Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/france/ source_html: /jurisdictions/france/index.html description: "France data protection and privacy regulation: 10 categories, 45 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 38f44eb46be7fb10b105d7b7c47a8d2d2e61c1ed01f31806b2a5a7e7b234bb02 generator: "fe-fleet/md-twin@1.0" --- # France Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/france/), [World Payments](https://payments.gi/jurisdictions/france/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 45 claims · 107 sources in the cumulative register Download report (PDF) Expand all The CNIL closed out a wave of high-value sanctions across 2025 and into 2026. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=FRANCE)[Build Report](/reports/?j=FRANCE)[Compare](/compare/?j=FRANCE) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Commission Nationale de l'Informatique et des Libertés (CNIL) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 45 Claims 122 Tier-1 sources Traffic-light mix 4 green 5 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Law made at European Economic Area (Bloc) level that applies in France is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers France’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,234 Full executive summary 384 ###### Latest update · 20 October 2026 #### Lead Signal France's data protection regulator closed two significant injunction proceedings, both by decision dated 23 September 2026 and both confirming that the subject controllers had come into compliance rather than imposing a fresh sanction. The first closure concerned FRANCE TRAVAIL, closing the injunction order originally issued 22 January 2026, with the closure published on 8 October 2026; the second closed the injunction issued 1 September 2025 against GOOGLE LLC and GOOGLE IRELAND LIMITED, published 14 October 2026, in a matter understood to connect to parallel proceedings led by the Dutch data protection authority concerning automated decision-making by Uber. Neither closure liquidated a penalty payment, consistent with a finding of achieved compliance rather than continued breach. A second, distinct thread concerns the regulator's posture toward artificial intelligence oversight: secondary reporting indicates the CNIL is preparing to take on a role as market-surveillance authority for a subset of high-risk artificial intelligence systems under the European Union's AI Act, a designation that is understood to depend on the French implementing law and is reported with probable rather than confirmed confidence given that it has not been independently verified against the regulator's own programme text. #### Other Developments Two injunction closures confirm, rather than escalate, enforcement outcomes. The closure of the FRANCE TRAVAIL injunction and the closure of the injunction against the Google entities both represent the regulator confirming that the controllers concerned had remedied the underlying issues identified in the original orders. In neither case did the regulator proceed to liquidate the penalty payment associated with the injunction, which is the clearest signal available that compliance was found to have been achieved. The Google-related closure sits within a broader context connecting to automated-decision-making proceedings pursued by the Dutch data protection authority against Uber, in cooperation with the French regulator, indicating cross-border coordination on a matter involving the same category of concern. CNIL positions itself for an artificial intelligence oversight role. Reporting on the regulator's 2026 programme of controls describes preparation for a designation as market-surveillance authority over a subset of high-risk artificial intelligence systems under the EU AI Act. This designation, if and when it takes effect, is contingent on the French law implementing the AI Act domestically, and the claim is carried at probable rather than confirmed confidence because it rests on secondary commentary rather than the regulator's own primary programme document. #### Cross-Monitor Connections The automated-decision-making dimension of the Google-related closure links to parallel enforcement activity pursued by the Dutch data protection authority against Uber, illustrating cross-border regulatory cooperation on automated decision-making that extends beyond France's own jurisdiction; readers tracking artificial-intelligence governance developments more broadly should note the CNIL's anticipated role as an AI Act market-surveillance authority as a structural point of contact between the data protection and artificial-intelligence oversight regimes once the French implementing law is in place. #### Outlook The closure of both injunctions, without penalty liquidation in either case, suggests the regulator's compliance-confirmation process functioned as intended for these two matters; whether further injunctions working through the pipeline will close on a similar timeline is not yet established. The CNIL's anticipated artificial intelligence market-surveillance role remains contingent on the French implementing law and should be treated as a probable rather than settled development until independently confirmed against the regulator's own published programme. 2 earlier updates not shown here. ###### Standing brief · as of 29 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The CNIL closed out a wave of high-value sanctions across 2025 and into 2026. The CNIL fined Free Mobile and Free a combined €42 million, treating the two entities as separate controllers each responsible for its own subscriber data despite their corporate affiliation. The CNIL separately sanctioned Free Mobile and Free for incomplete Article 34(2) GDPR breach notifications to affected subscribers. The CNIL also found that Free failed to sort and delete former-subscriber data once it was no longer needed for accounting purposes. France Travail, the public employment agency, is understood to have been fined €5 million, partly because data protection impact assessments had already identified necessary security measures that were never implemented. The CNIL fined the health-data analytics firm IQVIA €5 million, holding that re-identifiable health-data-warehouse data was pseudonymous rather than anonymous. NEXPUBLICA drew a €1.7 million penalty for structural Article 32 security weaknesses in its processing of disability data. A reported 2025 aggregate sanctions figure of €486,839,500 is understood to be concentrated overwhelmingly, on the order of 97-98 percent, in two large multinational decisions issued the same day, separate from the France-specific 2026 sanction wave described above. The EU AI Act's transparency-risk obligations for chatbots and generative content become applicable on 2 August 2026, beginning to layer AI-specific duties onto the GDPR transparency regime the CNIL already enforces. #### Other Developments The CNIL consolidated its cookie and tracker guidelines and recommendation in January 2026, supplemented by 2026 recommendations on multi-device consent. The authority continues to require that consent to trackers be a clear positive act, freely revocable, with refusal exactly as easy as acceptance. The CNIL is understood to identify cookie walls, meaning the conditioning of site access on tracker acceptance, as a distinct compliance-risk pattern under GDPR consent-validity standards. The CNIL is understood to treat GDPR-governed advertising-data processing and Article 82 tracker-deposit rules as separate legal and jurisdictional regimes, avoiding double sanction for the same conduct. The CNIL processed 539 health-data-warehouse authorisation applications in 2025. The CNIL operates a sector-specific authorisation gate for health-data warehouses, such as IQVIA's LRX and EMR warehouses, rather than a blanket data-localisation mandate. The technical référentiel that Arcom must adopt for pornography-site age verification under the SREN law remains at consultation stage; the CNIL opined on the draft on 26 September 2024, favouring privacy-preserving proof-of-majority methods over facial recognition. The G7 group of data protection authorities, meeting in Paris in June 2026, is understood to have adopted a declaration on privacy-preserving age verification and a set of children's-protection principles. The EDPB is understood to have adopted a common breach-notification template together with generative-AI anonymisation, web-scraping and blockchain guidance. The CNIL has sanctioned the scraping-based creation of a facial-recognition database as unlawful Article 9 GDPR biometric processing, and treats biometric-identification cameras as excluded from its general smart-camera guidance. The CNIL and its EU peer authorities are reported to have called for prohibiting AI systems that categorise individuals by inferred protected characteristics such as ethnicity, sex, and political or sexual orientation, though this appears to be an advocacy position rather than an adopted rule. #### Cross-Monitor Connections The CNIL's treatment of banks and insurers as paradigm cases triggering mandatory DPO designation through large-scale client-monitoring activity intersects with financial-crime and data-sharing obligations tracked by the financial-integrity monitor. The Free Mobile and Free telecoms sanctions may also bear on payments-specific subscriber data flows tracked by the world-payments monitor. The EU AI Act's 2 August 2026 transparency-obligation date and its interface with GDPR data protection impact assessments are primarily AI-Act-first developments; readers seeking the regulation-specific analysis should consult the artificial-intelligence monitor, while this brief retains the data-protection angle. #### Outlook The trajectory in France points toward continued high-materiality enforcement of accountability, security and breach-notification duties, alongside a widening interface between GDPR and the incoming EU AI Act. The health-data pseudonymisation question tested in the IQVIA decision, and the unresolved status of France's collective-redress mechanism for data protection claims, both remain open threads for future cycles. Read full brief · 1234 words ###### Latest update · 28 September 2026 #### Regulatory Status France's data-protection enforcement posture escalated materially this cycle. CNIL imposed three major fines: €42 million combined against FREE MOBILE and FREE for inadequate security measures following an October 2024 breach exposing roughly 24 million subscriber contracts including IBAN data; €5 million against France Travail for a DPIA-implementation gap in jobseeker-data security; and €5 million against IQVIA Operations France for inadequate health-data-warehouse safeguards. Measured against CNIL's historical total of 83 sanctions worth approximately €486.8 million since GDPR's entry into force, this cluster of activity is analytically significant. Separately, CNIL's 14 April 2026 recommendation on email tracking pixels imposed a 14 July 2026 explicit-consent deadline for existing subscribers, now passed, with no transitional period for newly-collected contacts. #### Outlook CNIL has named information and transparency obligations as its 2026 enforcement priority; whether this produces a further wave of sanctions in the second half of the year, distinct from the security- and accountability-focused fines seen so far, is the key marker for France's trajectory next cycle. ###### Standing brief · as of 29 July 2026 #### Regulatory Status France's data protection regime rests on the GDPR read together with the Loi Informatique et Libertés, most recently realigned by the Law of 20 June 2018, Ordonnance n°2018-1125 and Décret n°2019-536. The CNIL, composed of 18 members acting through a restricted sanctions committee, retains exclusive national competence over health data, criminal-offence data, the digital age of consent, post-mortem data, and Article 82 tracker compliance for France-located users. The regulator's 2025-2026 sanction wave, including the Free Mobile and Free, FRANCE TRAVAIL, IQVIA and NEXPUBLICA decisions, is understood to demonstrate sustained high-materiality enforcement of accountability, security and breach-notification duties, notwithstanding the concentration of the 2025 aggregate sanctions figure in two unrelated multinational decisions. The EU AI Act's 2 August 2026 transparency-obligation application date is beginning to layer new AI-specific duties onto the existing GDPR framework the CNIL enforces, including in the area of biometric and automated-decision-making governance. #### Outlook France's regulatory posture is tightening: sustained CNIL sanction activity and the incoming EU AI Act transparency-obligation date together signal an environment of expanding scrutiny across enforcement, algorithmic governance and health-data reuse, even as evidentiary gaps persist around cross-border transfer practice and collective redress. Read full brief · 384 words Key regulatory facts for France Regulatory Dimension France Standing Position Jurisdiction France (FR) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 45 sourced findings) Regulator & Framework Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle. Lawful Processing & Special Data Well-evidenced, GDPR-aligned regime with active CNIL enforcement on special categories and anonymisation claims. Data Subject Rights Core rights well evidenced via CNIL guidance and enforcement; portability and response-window specifics lack direct T1/T2 evidence this cycle. Controller/Processor Duties Extensive, recent (2025-2026) CNIL sanction practice directly evidences most sub-modules; ROPA remains a gap. Primary Instruments Cited CNIL, France Official Instrument (cnil.fr actualites), CNIL, France Official Instrument (cnil.fr Sanction), CNIL Last Confirmed / Updated 2026-11-04 (107 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### France: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle. Primary framework GDPR (Regulation (EU) 2016/679) + Loi n° 78-17 du 6 janvier 1978 modifiée (Loi Informatique et Libertés) Supervisory authority [Commission Nationale de l'Informatique et des Libertés (CNIL)](https://www.cnil.fr/) Traffic-light rationale — Green Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle. #### Sub-modules (5) #### Regulator And AuthorityGreen CNIL is composed of 18 members drawn from Parliament, senior courts and qualified experts, and acts through a restricted sanctions committee. Claims (3): - CNIL is hosting the fifth Privacy Research Day on 24 June 2026 as part of the G7 Data Protection Authorities meeting. - Loi n° 78-17 du 6 janvier 1978 — in_force #### Act And InstrumentsGreen National framework = GDPR + Loi Informatique et Libertés as consolidated by the 2018 law, 2018 ordonnance and 2019 decree. Claims (2): - EDPB, at its 17 September 2026 plenary, adopted guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR and finalised guidelines on GDPR-DSA fine interaction. #### Material ScopeGreen GDPR displaces national law on most points; national law retains 'marges de manœuvre' for health data, criminal-offence data, digital age of consent, post-mortem data, and remains sole basis for penal/security files. Claims indexed in baseline register · source extraction in progress #### Territorial ScopeGreen CNIL holds exclusive competence over Article 82 LIL / L.34-5 CPCE (cookies) compliance for users located in France, distinct from its GDPR jurisdiction over establishment-based controllers. Claims indexed in baseline register · source extraction in progress #### Regulator Registration And FilingGreen DPO designation, replacement and termination are handled exclusively via CNIL's dedicated online teleservice. Claims indexed in baseline register · source extraction in progress France applies the GDPR directly alongside the national Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés), as substantially rewritten by the Law of 20 June 2018, Ordonnance n° 2018-1125 and Décret n° 2019-536 to align French law with the GDPR and the Law Enforcement Directive. The CNIL is the supervisory authority, an 18-member independent commission with investigative and sanctioning powers exercised through its restricted committee (formation restreinte). No periodic updates recorded in this cycle Sources and claims (3) - [CNIL](https://www.cnil.fr/en/news) — CNIL is hosting the fifth Privacy Research Day on 24 June 2026 as part of the G7 Data Protection Authorities meeting. - [https://www.cnil.fr/fr/actualites](https://www.cnil.fr/fr/actualites) — EDPB, at its 17 September 2026 plenary, adopted guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR and finalised guidelines on GDPR-DSA fine interaction. - [CNIL](https://www.cnil.fr/fr/le-cadre-national/la-loi-informatique-et-libertes) — Loi n° 78-17 du 6 janvier 1978 — in_force ### France: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Well-evidenced, GDPR-aligned regime with active CNIL enforcement on special categories and anonymisation claims. Primary framework GDPR Arts 6, 7, 9 + Loi Informatique et Libertés Arts 66, 82 Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Green Well-evidenced, GDPR-aligned regime with active CNIL enforcement on special categories and anonymisation claims. D2 · Lawful Processing — Full Module Record 4 sub-modules · 44 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core rights well evidenced via CNIL guidance and enforcement; portability and response-window specifics lack direct T1/T2 evidence this cycle. Primary framework GDPR Arts 12-22 Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Amber Core rights well evidenced via CNIL guidance and enforcement; portability and response-window specifics lack direct T1/T2 evidence this cycle. #### Sub-modules (5) #### Access RightGreen Even consent-exempt audience-measurement processing remains subject to GDPR Arts 15-22 rights. Claims indexed in baseline register · source extraction in progress #### Rectification And ErasureGreen GDPR's application strengthened minors' right to erasure within French law. Claims indexed in baseline register · source extraction in progress #### Restriction And ObjectionGreen CNIL requires refusal of trackers to be exactly as easy as acceptance. Claims indexed in baseline register · source extraction in progress #### Data PortabilityRed No FR-specific portability findings surfaced in this research cycle. #### Deadlines And Response WindowsRed No FR-specific deviation from standard GDPR response windows was evidenced this cycle. GDPR Articles 15-22 rights apply fully, including to processing nominally exempt from consent (e.g., audience measurement). CNIL has reinforced minors' erasure rights and equal-ease-of-refusal standards for trackers. Portability and specific response-deadline practice were not evidenced in this research cycle. No periodic updates recorded in this cycle ### France: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Extensive, recent (2025-2026) CNIL sanction practice directly evidences most sub-modules; ROPA remains a gap. Primary framework GDPR Arts 5, 24, 25, 28, 30, 32-35, 37-39 Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Green Extensive, recent (2025-2026) CNIL sanction practice directly evidences most sub-modules; ROPA remains a gap. Periodic update · new data 2026-10-20 #### Controller/Processor Duties Two closures of enforcement injunctions illustrate how controller and processor compliance obligations in France are supervised through to resolution rather than remaining open-ended. The CNIL closed, by decision of 23 September 2026 and published 8 October 2026, the injunction order it had issued on 22 January 2026 against FRANCE TRAVAIL, the French public employment service. The closure confirms that the controller remedied the underlying issue identified in the original order, and the regulator did not proceed to liquidate the associated penalty payment, which stands as the clearest available indicator that compliance was achieved rather than merely asserted. Separately, and by the same decision date, the regulator closed the injunction it had issued on 1 September 2025 against GOOGLE LLC and GOOGLE IRELAND LIMITED, publishing that closure on 14 October 2026. As with the FRANCE TRAVAIL matter, the closure was not accompanied by liquidation of the associated penalty, again consistent with a finding of remedied compliance. This matter sits within a wider context: it is understood to connect to parallel proceedings pursued by the Dutch data protection authority concerning automated decision-making practices at Uber, a connection that points to cross-border regulatory cooperation on overlapping controller obligations rather than two entirely unrelated enforcement tracks. Taken together, these closures are best read as confirmation events rather than new findings of breach. They demonstrate that the CNIL's injunction mechanism functions through to a defined endpoint, where a controller that remedies the conduct identified in an order can expect the matter to close without further penalty, and that the regulator tracks such matters over periods spanning many months, as the gap between the original FRANCE TRAVAIL order in January 2026 and its closure in September 2026 illustrates. Neither closure discloses what specific remedial steps were taken by either controller, and no indication was found of any new injunction being issued against either of these controllers in the period under review. The absence of any newly issued injunction or fresh controller-duties finding beyond these two closures should not be read as reduced regulatory attention; rather, these closures themselves represent the regulator working through its existing caseload of controller and processor compliance matters to a conclusion. #### Outlook Whether additional injunctions currently open against other controllers will close on a similarly extended timeline is not established from the material. The cross-border dimension visible in the Google-related matter, connecting to the Dutch authority's automated-decision-making proceedings against Uber, is worth continued attention as an indicator of how French and other European data protection authorities coordinate on shared controller-duties concerns involving multinational platforms. Periodic update · new data 2026-10-06 #### Controller/Processor Duties The CNIL fined HÔPITAL PRIVÉ DE LA LOIRE five hundred thousand euros on 3 September 2026 for failing to take appropriate measures to ensure the security of personal data, specifically patients' health data, a finding grounded in Article 32 of the GDPR. The sanction is confirmed by direct reference to the CNIL's own sanctions tag listing, a Tier 1 primary source, and sits at a materiality level the regulator reserves for security failures it regards as serious rather than merely technical. The health-data context of this sanction gives it particular analytical weight. Article 32's security-of-processing obligation applies to all categories of personal data, but a failure that exposes special-category health data under Article 9 carries a different risk profile than an equivalent failure touching ordinary contact or transactional data: the potential for harm to data subjects is generally regarded as more severe, and regulators across the EU have tended to treat health-sector security failures as warranting proportionately higher fines. The five-hundred-thousand-euro quantum here, while below the seven-figure fines the CNIL has levied in its largest cases, is substantial for a single-controller security-measures case and signals continued regulatory attention to the health sector specifically. This sanction is explicitly described in the underlying material as continuing a pattern rather than standing alone: it follows the CNIL's earlier, considerably larger sanction against France Travail, which the regulator's own enforcement cadence data situates within a broader run of approximately twenty-five sanctions and roughly thirty-five million euros in cumulative fines across 2026 to date. Read together, these two decisions, both grounded in security-of-processing failures rather than, for instance, consent or lawful-basis defects, suggest the CNIL's formation restreinte is currently prioritising Article 32 enforcement as a distinct enforcement line, separate from its historically larger focus on cookie-consent and direct-marketing matters. A separate but related development this cycle is procedural rather than substantive: the European Data Protection Board, at its 17 September 2026 plenary, adopted guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR, alongside finalised guidelines on how GDPR fines interact with fines imposed under the Digital Services Act. This guidance is understood to bear on how the CNIL's own fine-calculation methodology is applied going forward, though no CNIL decision explicitly applying the new EDPB methodology has been identified as of this cycle. The HÔPITAL PRIVÉ DE LA LOIRE sanction, issued 3 September 2026, predates the EDPB's 17 September 2026 guideline adoption, so it cannot itself reflect the new methodology; any future test of the guidance's practical effect would need to be found in a subsequent CNIL decision. #### Outlook The principal item to track is whether the CNIL's formation restreinte applies the EDPB's newly adopted fining-methodology guidelines in a forthcoming decision, which would be the first concrete test of how the 17 September 2026 guidance translates into an actual French sanction calculation. More broadly, the continuation of the security-of-processing enforcement line opened by the France Travail sanction and extended by the HÔPITAL PRIVÉ DE LA LOIRE decision suggests further Article 32 sanctions, particularly in sensitive sectors such as health, are a plausible continuing feature of the CNIL's enforcement docket through the remainder of 2026. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Two of this cycle's three major CNIL fines concern controller/processor security and accountability duties directly. CNIL fined France Travail €5 million on 22 January 2026 for failing to ensure the security of jobseekers' data; the central finding was that security measures identified in the organisation's own data protection impact assessments were never actually deployed into production, a gap between documented risk assessment and operational reality rather than an absence of risk assessment altogether. Separately, CNIL fined FREE MOBILE €27 million and FREE €15 million, a combined €42 million, on 13 January 2026, for inadequate security measures under Article 32, following an October 2024 breach that exposed approximately 24 million subscriber contracts including IBAN data. Both actions concern the same underlying duty, adequate technical and organisational security measures, but manifest differently: the France Travail case is an accountability and DPIA-implementation failure, where the organisation had correctly identified the necessary controls but did not deploy them, while the Free/Free Mobile case is a security-measures failure that resulted in a large-scale breach involving financially sensitive IBAN data. The combined scale of these two sanctions, €47 million between them, is a significant enforcement signal for the accountability and security-measures dimension of France's data-protection regime this cycle. #### Outlook Whether CNIL's 2026 enforcement-priority focus on information and transparency, discussed under Enforcement & Redress, extends to further Article 32 security-measures or Article 35 DPIA-implementation actions is the key marker to watch for this module next cycle. D4 · Controller & Processor — Full Module Record 7 sub-modules · 40 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No FR-specific T1/T2 evidence on transfer mechanisms, adequacy lists, SCC/BCR uptake or TIA practice was located this cycle; adequacy decisions are an EU-level Commission competence rather than a distinct French instrument. Primary framework GDPR Arts 44-49 (EU-level, applied uniformly in France) Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Red No FR-specific T1/T2 evidence on transfer mechanisms, adequacy lists, SCC/BCR uptake or TIA practice was located this cycle; adequacy decisions are an EU-level Commission competence rather than a distinct French instrument. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 37 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong evidence for financial, health, telecoms and employment overlays; credit-scoring and education overlays remain unevidenced gaps. Primary framework GDPR + Loi Informatique et Libertés Art 82 (ePrivacy) + Art 66 (health) Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Amber Strong evidence for financial, health, telecoms and employment overlays; credit-scoring and education overlays remain unevidenced gaps. Periodic update · new data 2026-10-06 #### Sectoral Watch The EU Data Act's design-for-access obligation under Article 3(1) took effect on 12 September 2026. From that date, connected products and related services placed on the market must be designed and manufactured so that the data they generate is, by default, easily, securely and directly accessible to the user free of charge. This is a confirmed, Tier 1-sourced application milestone, drawn directly from the CNIL's own published guidance on the Data Act, and it represents a substantive new obligation now binding on manufacturers and providers of connected products placed on the French and wider EU market from that date forward. What is notably incomplete, however, is the national enforcement architecture that would give this obligation domestic teeth in France specifically. The Data Act required Member States to notify the European Commission of their national administrative-penalty amounts for breaches of the Chapter III obligations, including the Article 3(1) design-for-access duty, by 12 September 2025. France is understood, per secondary commentary, to have missed that notification deadline. The implementing legislation intended to establish France's national penalty framework, the DDADUE bill, was adopted by the Senate on 18 February 2026 but remained before the National Assembly as of 27 September 2026, meaning more than a year after the original Commission notification deadline, France still had not completed its domestic implementing legislation. The practical consequence of this gap is a split regulatory position: the substantive obligation itself, the design-for-access duty under Article 3(1), is directly applicable EU law and is binding in France regardless of domestic implementing legislation, since the Data Act is a regulation rather than a directive. What remains unsettled is specifically the national administrative-penalty regime: the quantum and mechanism of domestic sanctions for breach of the Chapter III obligations cannot be finalised in France until the DDADUE bill completes its passage through the National Assembly and is enacted. This is analytically significant because it illustrates a now-familiar pattern in EU regulation-based (as opposed to directive-based) data-law instruments: the substantive obligation arrives on schedule because it requires no domestic transposition, while the enforcement architecture lags because administrative-penalty frameworks typically do require national implementing legislation. No information was identified this cycle regarding whether the European Commission has taken any formal step in response to France's apparent missed notification deadline, nor whether any other Member State's implementing legislation has progressed further. The current state of the record is limited to the Senate's 18 February 2026 adoption of the DDADUE bill and its status before the National Assembly as of 27 September 2026, with no further legislative milestone identified since that date within this cycle's research. #### Outlook The DDADUE bill's progress through the National Assembly is the single most consequential item to track in this domain: until it is enacted, France's national administrative-penalty amounts for Data Act Chapter III obligations, including the Article 3(1) design-for-access duty now in force since 12 September 2026, remain unsettled even though the underlying substantive obligation is already binding under directly-applicable EU law. A further item worth monitoring is whether the European Commission takes any visible step in response to France's apparent missed 12 September 2025 notification deadline, which would be the first indication of how the Commission is treating Member States that have fallen behind on Data Act implementing legislation. Periodic update · new data 2026-09-28 #### Sectoral Watch CNIL fined IQVIA Operations France €5 million on 26 May 2026 for failing to respect guarantees limiting risks to individuals in its management of a health-data warehouse. This is a sector-specific enforcement signal concerning the particular safeguards expected of health-data-warehouse operators, a category of controller handling especially sensitive categories of personal data at scale, and is distinct from the general-purpose security and accountability findings addressed elsewhere this cycle. The health-data-warehouse context carries heightened regulatory expectations precisely because of the sensitivity and scale of the data involved, and this fine indicates CNIL is prepared to enforce those heightened guarantees with fines of the same order of magnitude as its general Article 32 security-measures actions this cycle. The finding stands alongside the France Travail and Free/Free Mobile fines as one of three major 2026 CNIL sanctions identified this cycle, together forming the basis for the assessment that CNIL's enforcement posture has structurally intensified in 2026 relative to prior years. #### Outlook Whether further health-sector-specific enforcement actions follow the IQVIA fine, and whether CNIL articulates sector-specific guidance for health-data-warehouse operators in response, are the developments to watch for this module next cycle. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 29 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookies/trackers and cross-context advertising well evidenced; opt-out signals, clean rooms/DCR and direct marketing remain gaps. Primary framework Loi Informatique et Libertés Art 82 + GDPR Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Amber Cookies/trackers and cross-context advertising well evidenced; opt-out signals, clean rooms/DCR and direct marketing remain gaps. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy CNIL's final recommendation on email tracking pixels, published 14 April 2026, set a hard compliance deadline: organisations were required to obtain explicit consent from existing subscribers, or stop tracking them, by 14 July 2026, with no transitional period at all for contacts collected from 14 April 2026 onward. As of the current cycle, that deadline has passed, meaning any organisation that had not obtained the required explicit consent by 14 July 2026 is now operating outside CNIL's stated compliance expectation for email-tracking-pixel use. The absence of a transitional period for newly-collected contacts is a notably strict feature of the recommendation relative to typical phased-implementation approaches, since it applies the full consent requirement immediately to any contact acquired after the recommendation's publication date, even though the overall compliance deadline for existing subscribers extended a further three months. This recommendation reflects CNIL's continuing focus on granular consent mechanics in commercial email and tracking contexts, consistent with its broader 2026 enforcement-priority theme of information and transparency obligations. #### Outlook The key marker to watch is whether CNIL follows the passed 14 July 2026 deadline with enforcement action against organisations found not to have obtained the required consent, which would be the first concrete enforcement test of this specific recommendation. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 43 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong biometric and AI Act interface evidence; genetic-data-specific regime remains an evidenced gap. Primary framework GDPR Art 9 + EU AI Act (Regulation (EU) 2024/1689) as applied via CNIL guidance Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Amber Strong biometric and AI Act interface evidence; genetic-data-specific regime remains an evidenced gap. Periodic update · new data 2026-10-20 #### Algorithmic, Biometric & Surveillance Governance The most forward-looking signal in France's data protection environment concerns the CNIL's anticipated role under the European Union's AI Act. Secondary reporting on the regulator's 2026 programme of controls describes the CNIL preparing to be designated as market-surveillance authority for a subset of high-risk artificial intelligence systems. This designation, as reported, is understood to be contingent on the French law implementing the AI Act domestically, meaning the CNIL's formal authority in this space has not yet crystallised and remains dependent on a legislative step that has not been independently confirmed as complete. The claim is carried at probable rather than confirmed confidence, reflecting that it rests on commentary describing the regulator's work programme rather than on the CNIL's own primary programme document, which was not independently re-verified. This distinction matters for how the development should be read: it describes a regulator positioning itself for an anticipated role, not a regulator that has already assumed formal market-surveillance powers over high-risk artificial intelligence systems. If and when this designation takes effect, it would place the CNIL in a position with direct relevance to the governance of algorithmic systems more broadly, extending the regulator's institutional reach from its traditional personal-data protection mandate into supervision of a subset of high-risk artificial intelligence systems as defined under the EU framework. The scope of that subset, and the precise boundary between the CNIL's prospective market-surveillance role and the roles of other French and European authorities with overlapping competence in artificial intelligence oversight, was not detailed in the material available. No related finding on biometric data processing or surveillance-specific instruments was identified in France beyond this preparatory AI Act posture. The signal here is institutional and anticipatory rather than a concrete new rule or enforcement action. #### Outlook The CNIL's path toward a formal AI Act market-surveillance designation depends on the French implementing law, and confirmation of that designation, once the implementing legislation is in place, would be a more concrete development than the preparatory posture recorded. Readers tracking the interaction between data protection and artificial intelligence oversight in France should expect the precise boundaries of the CNIL's prospective role to become clearer once the implementing law and the regulator's own published programme can be independently reviewed. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 41 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong evidence on age of consent, parental consent and age-verification privacy safeguards; education-settings and dependent-adults sub-modules remain gaps. Primary framework GDPR Art 8 + Loi Informatique et Libertés Art 45 + Loi SREN (2024) Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Amber Strong evidence on age of consent, parental consent and age-verification privacy safeguards; education-settings and dependent-adults sub-modules remain gaps. D9 · Children's Privacy — Full Module Record 5 sub-modules · 49 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### France: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Very well evidenced, high-materiality enforcement activity across multiple 2025-2026 decisions plus recent 180-day developments. Primary framework GDPR Arts 58, 77-84 + Loi Informatique et Libertés Supervisory authority [CNIL](https://www.cnil.fr/) Traffic-light rationale — Green Very well evidenced, high-materiality enforcement activity across multiple 2025-2026 decisions plus recent 180-day developments. Periodic update · new data 2026-10-20 #### Enforcement & Redress France's data protection enforcement activity is characterised by confirmation rather than new sanction. The CNIL closed two separate injunction proceedings by decision of 23 September 2026: one against FRANCE TRAVAIL, closing the order originally issued 22 January 2026 and published 8 October 2026, and one against GOOGLE LLC and GOOGLE IRELAND LIMITED, closing the order originally issued 1 September 2025 and published 14 October 2026. In both instances, the regulator did not proceed to liquidate the penalty payment that had been attached to the original injunction, which is the strongest available signal that the underlying controllers had come into compliance by the time of closure. The Google-related closure is notable for its connection to a substantially larger enforcement action: the Dutch data protection authority, in cooperation with the CNIL, imposed a fine understood to be in the region of eight hundred and twenty-five million euros on UBER B.V. and UBER TECHNOLOGIES INC. for breaches related to automated decision-making, published 24 August 2026. While that fine falls outside the strict window of the own findings, it is carried forward here as recent context because it illustrates the scale of cross-border cooperative enforcement that French and Dutch authorities are capable of pursuing jointly on matters of overlapping concern, and because the CNIL's injunction closure against Google sits within the same broader automated-decision-making enforcement landscape. Taken as a pair, the two injunction closures signal an active, functioning enforcement pipeline in France: orders are issued, controllers are given the opportunity to remedy the underlying issue, and the regulator confirms closure once remediation is verified. No new sanction decision dated within the window was identified, and the absence of a new penalty should be read in that light, as a feature of the compliance-confirmation process rather than a gap in enforcement activity. #### Outlook The pattern of injunction closure without penalty liquidation observed in both matters suggests a functioning remediation-and-confirmation enforcement model; continued monitoring of whether other open injunctions in the French pipeline follow a similar closure pattern will help establish whether this is the regulator's consistent practice. The scale of the related Uber fine pursued jointly with the Dutch authority underscores that France's cross-border enforcement cooperation on automated-decision-making matters can produce outcomes of very substantial magnitude, even where the French regulator's own direct action in a given matter, as with the Google closure, resolves without a new penalty. Periodic update · new data 2026-10-06 #### Enforcement & Redress The CNIL's enforcement cadence remained elevated this cycle, anchored by the five-hundred-thousand-euro sanction against HÔPITAL PRIVÉ DE LA LOIRE on 3 September 2026 for security-of-processing failures affecting patients' health data. This sanction, confirmed via the CNIL's own primary sanctions listing, continues a pattern the regulator set with its considerably larger five-million-euro sanction against France Travail earlier in 2026, and sits within a broader run described in independent tracking as approximately twenty-five sanctions totalling roughly thirty-five million euros across 2026 to date. Whatever the precision of that aggregate figure, which derives from secondary commentary rather than a CNIL-published total, the pattern of two substantial, security-focused sanctions within a single year is itself a confirmed, primary-sourced feature of this cycle's enforcement record. Alongside this substantive sanction, the CNIL closed a procedural matter: by deliberation dated 17 September 2026, the regulator formally closed the cookie-consent injunction it had originally imposed on SOLOCAL MARKETING SERVICES on 15 May 2025. This is a lower-materiality item than the HÔPITAL PRIVÉ DE LA LOIRE sanction, representing the resolution of a prior enforcement matter rather than a new finding of breach, but it is a confirmed, Tier 1-sourced data point in the CNIL's ongoing enforcement docket and indicates the regulator continues to actively manage and close out its injunction caseload rather than leaving matters open indefinitely. A third item relevant to this domain is procedural and forward-looking rather than a completed enforcement action: the European Data Protection Board's adoption, at its 17 September 2026 plenary, of guidelines on the power to impose administrative fines in relation to other corrective powers under the GDPR, together with finalised guidelines on the interaction between GDPR fines and Digital Services Act fines. This guidance is understood to shape how the CNIL's formation restreinte calculates future fines, though its practical effect cannot yet be assessed since no CNIL decision applying the new methodology had been identified as of this cycle, and the HÔPITAL PRIVÉ DE LA LOIRE sanction itself predates the guideline's 17 September 2026 adoption by two weeks. Taken together, these three items describe a CNIL enforcement posture this cycle that is simultaneously active on substantive sanctions, methodical about closing out resolved procedural matters, and operating under a fine-calculation framework about to be reshaped by new EDPB guidance whose practical application remains untested. #### Outlook The clearest forward-looking marker for this domain is whether a future CNIL sanction decision visibly applies the EDPB's 17 September 2026 fining-methodology guidelines, which would be the first concrete evidence of how that guidance changes French fine calculation in practice. Separately, given the pattern of two substantial security-of-processing sanctions already recorded in 2026, continued CNIL attention to Article 32 compliance, particularly in sensitive sectors such as health, remains a plausible feature of the enforcement docket through the remainder of the year. Periodic update · new data 2026-09-28 #### Enforcement & Redress This cycle's enforcement activity in France is defined by the concurrence of at least three major CNIL fines: €42 million combined against FREE MOBILE and FREE (13 January 2026), €5 million against France Travail (22 January 2026), and €5 million against IQVIA Operations France (26 May 2026). Measured against CNIL's full historical enforcement record of 83 sanctions totalling approximately €486.8 million since GDPR's entry into force, these three 2026 actions together total roughly €52 million within a single reporting period, a concentration that exceeds typical historical annual norms and signals a structurally more aggressive enforcement posture rather than a one-off episodic spike. CNIL has named information and transparency obligations as its 2026 enforcement-priority theme, mirroring the EDPB's designated focus theme for the year. This forward-looking signal suggests that the three fines already identified this cycle, which concern security measures and DPIA implementation rather than transparency specifically, may be followed by a distinct wave of transparency-focused enforcement action later in 2026, rather than representing the totality of CNIL's enforcement focus for the year. #### Outlook Whether CNIL's transparency-focused enforcement priority materialises into further sanctions in the second half of 2026, and whether the pace of large fines observed in January and May continues, are the two developments most likely to confirm or revise the assessment that CNIL's enforcement posture has structurally intensified. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 63 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties