---
title: "France — Regulator & Framework | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/france/regulator-and-framework/
source_html: /jurisdictions/france/regulator-and-framework/index.html
description: "France — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules Green ▾ # Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps ident"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 0d2324f70cb3d8287970c5ff105190f3cda6aa7325f5bef7030feca1bd699190
generator: "fe-fleet/md-twin@1.0"
---
# France — Regulator & Framework | Data Protection Monitor

### D1Regulator & Framework5 sub-modulesGreen▾#

Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle.

Primary framework GDPR (Regulation (EU) 2016/679) + Loi n° 78-17 du 6 janvier 1978 modifiée (Loi Informatique et Libertés)

Supervisory authority [Commission Nationale de l'Informatique et des Libertés (CNIL)](https://www.cnil.fr/)

Traffic-light rationale — Green Comprehensive, GDPR-aligned omnibus framework with an active, well-resourced regulator; no material gaps identified in this cycle.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

CNIL is composed of 18 members drawn from Parliament, senior courts and qualified experts, and acts through a restricted sanctions committee.

Claims (1):

- CLM-FR-a10001b1 (claim on file)

#### Act And InstrumentsGreen

National framework = GDPR + Loi Informatique et Libertés as consolidated by the 2018 law, 2018 ordonnance and 2019 decree.

Claims (1):

- CLM-FR-a10002b2 (claim on file)

#### Material ScopeGreen

GDPR displaces national law on most points; national law retains 'marges de manœuvre' for health data, criminal-offence data, digital age of consent, post-mortem data, and remains sole basis for penal/security files.

Claims (2):

- CLM-FR-a10003b3 (claim on file)
- CLM-FR-a10004b4 (claim on file)

#### Territorial ScopeGreen

CNIL holds exclusive competence over Article 82 LIL / L.34-5 CPCE (cookies) compliance for users located in France, distinct from its GDPR jurisdiction over establishment-based controllers.

Claims (1):

- CLM-FR-a10005b5 (claim on file)

#### Regulator Registration And FilingGreen

DPO designation, replacement and termination are handled exclusively via CNIL's dedicated online teleservice.

Claims (1):

- CLM-FR-a10006b6 (claim on file)

Category narrative 70 words

France applies the GDPR directly alongside the national Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés), as substantially rewritten by the Law of 20 June 2018, Ordonnance n° 2018-1125 and Décret n° 2019-536 to align French law with the GDPR and the Law Enforcement Directive. The CNIL is the supervisory authority, an 18-member independent commission with investigative and sanctioning powers exercised through its restricted committee (formation restreinte).

no periodic updates on record for this sub-brief

Evidence 0 — none recorded