Data Protection Monitor
Global Privacy & Data Protection Intelligence

France (FR) · Module Detail

France: Regulator & Framework

← Full France overview Build report with France Request deeper dive

#

Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle.

Primary frameworkGDPR (Regulation (EU) 2016/679) + Loi n° 78-17 du 6 janvier 1978 modifiée (Loi Informatique et Libertés)
Supervisory authorityCommission Nationale de l'Informatique et des Libertés (CNIL)
Traffic-light rationale — GreenComprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle.

Sub-modules (5)

Regulator And AuthorityGreen

CNIL is composed of 18 members drawn from Parliament, senior courts and qualified experts, and acts through a restricted sanctions committee.

Claims (1):

  • CLM-FR-a10001b1 (claim on file)

Act And InstrumentsGreen

National framework = GDPR + Loi Informatique et Libertés as consolidated by the 2018 law, 2018 ordonnance and 2019 decree.

Claims (1):

  • CLM-FR-a10002b2 (claim on file)

Material ScopeGreen

GDPR displaces national law on most points; national law retains 'marges de manœuvre' for health data, criminal-offence data, digital age of consent, post-mortem data, and remains sole basis for penal/security files.

Claims (2):

  • CLM-FR-a10003b3 (claim on file)
  • CLM-FR-a10004b4 (claim on file)

Territorial ScopeGreen

CNIL holds exclusive competence over Article 82 LIL / L.34-5 CPCE (cookies) compliance for users located in France, distinct from its GDPR jurisdiction over establishment-based controllers.

Claims (1):

  • CLM-FR-a10005b5 (claim on file)

Regulator Registration And FilingGreen

DPO designation, replacement and termination are handled exclusively via CNIL's dedicated online teleservice.

Claims (1):

  • CLM-FR-a10006b6 (claim on file)
Category narrative70 words

France applies the GDPR directly alongside the national Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés), as substantially rewritten by the Law of 20 June 2018, Ordonnance n° 2018-1125 and Décret n° 2019-536 to align French law with the GDPR and the Law Enforcement Directive. The CNIL is the supervisory authority, an 18-member independent commission with investigative and sanctioning powers exercised through its restricted committee (formation restreinte).

no periodic updates on record for this sub-brief