🇫🇷Data Processing, Files and Liberties Act

← Back to laws in France

Data Processing, Files and Liberties Act

France applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act implements and supplements the GDPR in France and also contains distinct regimes for health, law-enforcement, intelligence and electronic-communications processing.

National additions and variations

• Article 45 sets 15 as the age at which a child may consent alone to a directly offered information-society service; below 15, the Act calls for joint consent of the child and parental-authority holder.
• Article 82 implements terminal-equipment and cookie rules, including information, consent and strictly necessary exceptions.
• The Act contains national health, genetic and biometric processing regimes, including formalities and CNIL reference methodologies in relevant cases.
• It provides rules for directives and rights concerning data of deceased persons.
• French procedure includes representative and group-action mechanisms and detailed CNIL investigation and sanction powers.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.