🇫🇷FranceActive
GDPR compliance in France
In France, the CNIL enforces GDPR alongside the Loi Informatique et Libertés. France has been one of the most active GDPR enforcers in Europe.
Enforcement authority
CNIL (Commission nationale de l'informatique et des libertés)
Maximum sanctions
CNIL has issued fines up to EUR 150 million. Maximum is 4% of global turnover.
Obligations
Key obligations
What GDPR requires from organizations operating in France.
Comply with CNIL cookie consent requirements (strict opt-in)
Register with CNIL if processing sensitive data at scale
Follow CNIL guidance on AI and automated decision-making
Implement data breach notification to CNIL within 72 hours
Conduct DPIA for high-risk processing as per CNIL list
Local context
Local context in France
The CNIL publishes regular guidance on cookies, AI, children's data, and workplace monitoring. It operates a restricted committee for sanctions.
Frequently asked questions
How does GDPR apply in France?
In France, the CNIL enforces GDPR alongside the Loi Informatique et Libertés. France has been one of the most active GDPR enforcers in Europe.
Who enforces GDPR in France?
CNIL (Commission nationale de l'informatique et des libertés)
What are the penalties for GDPR non-compliance?
CNIL has issued fines up to EUR 150 million. Maximum is 4% of global turnover.
GDPR in other jurisdictions
Check your GDPR compliance now
Start free scan to see your risk score and applicable obligations.