France applies the EU GDPR together with its 1978 Informatique et Libertés law, enforced by the CNIL, which can fine up to EUR 20 million or 4% of worldwide turnover. Breaches that create a risk must be reported to the CNIL within 72 hours. France has not yet adopted its NIS 2 cybersecurity law, so the expanded cyber obligations are coming but not yet binding. Electronic invoicing between French VAT-registered businesses started on 1 September 2026 and is a real systems project.
GDPR in practice: the CNIL as regulator
The CNIL is the French supervisory authority. It handles complaints, inspections and sanctions, and runs the online services for breach notification and DPO designation. Its ordinary sanction procedure allows fines of up to EUR 10 million or 2% of worldwide annual turnover, and up to EUR 20 million or 4% for the most serious breaches, plus compliance orders backed by daily penalties of up to EUR 100,000. A simplified procedure for less complex cases caps fines at EUR 20,000 and is not published.
A data protection officer is mandatory for public bodies and for organisations whose core activities involve large-scale monitoring of people or large-scale processing of sensitive or criminal-offence data. The appointment is registered on the CNIL website, so a foreign group with French operations should check whether its group DPO has been declared there.123
Breaches and international transfers
A personal data breach that creates a risk for individuals must be notified to the CNIL as soon as possible and no later than 72 hours after discovery, with a follow-up notification allowed. If the risk is high, the people affected must also be told. Incident response plans for French entities should name who files with the CNIL.
France has no general data localisation rule for private companies. Transfers outside the EEA follow the GDPR: an adequacy decision, or safeguards such as the Commission's standard contractual clauses or binding corporate rules, none of which need CNIL authorisation. Bespoke contractual clauses do need CNIL authorisation. Health data is the main French exception: anyone hosting personal health data for others must hold HDS certification, and the revised certification standard adds an EEA storage requirement.4567
Cybersecurity: NIS 2 still pending
The EU NIS 2 directive should have been transposed by 17 October 2024. As at mid-October 2026 the French bill, which also covers DORA and the critical entities directive, has passed the Senate and the National Assembly committee but has not been enacted. ANSSI, the national cybersecurity agency, describes the text as a draft and asks future essential and important entities to start preparing now.
ANSSI has published a Référentiel Cyber France (ReCyF) since 17 March 2026 setting out recommended measures for the NIS 2 objectives. It will not be mandatory, but entities that follow it can rely on it during inspection, which makes it the practical baseline for planning.8910
Electronic invoicing is now live
Since 1 September 2026 every VAT-registered business established in France must be able to receive electronic invoices, and large companies and ETIs must issue them. SMEs and micro-enterprises must issue electronic invoices from 1 September 2027. Invoices pass through platforms registered with the tax authority (DGFiP), which also transmit invoice and payment data to the administration. For a foreign group this is an ERP and supplier-onboarding project for its French entities, not only a tax question.11
| Obligation | Who it applies to | Rule | Status |
|---|---|---|---|
| Breach notification to CNIL | Controllers under the GDPR | Within 72 hours where risk to individuals | In force |
| DPO designation | Public bodies; large-scale monitoring or sensitive data | Designate and declare on CNIL website | In force |
| Transfers outside EEA | Any exporter of personal data | Adequacy, SCCs or BCRs; bespoke clauses need CNIL authorisation | In force |
| HDS certification | Hosts of personal health data for others | Certificate of conformity; EEA storage in revised standard | In force (final revised standard not confirmed) |
| NIS 2 transposition | Future essential and important entities | Draft projet de loi Résilience; ReCyF as reference | Not yet enacted |
| E-invoicing (receive) | All VAT-registered businesses established in France | Receive via registered platform | From 1 September 2026 |
| E-invoicing (issue) | Large companies and ETIs; then SMEs and micro-enterprises | Issue via registered platform | 1 September 2026; 1 September 2027 |
How it works, step by step
- Map French processing, appoint or confirm the DPO where mandatory and declare the designation online3CNIL
- Put transfer tools in place for any flows outside the EEA (SCCs, BCRs) and record transfer assessments6CNIL (authorisation only for bespoke clauses)
- Build a breach procedure that can notify within 72 hours and inform individuals where the risk is high45CNIL
- Run the NIS 2 eligibility check and align security measures with ReCyF pending the law89ANSSI
- Connect French entities to a registered e-invoicing platform and test receipt and issue flows11DGFiP
No timings or fees are shown unless an official source states them.
Documents usually needed
- Record of processing activities (GDPR Article 30)
- DPO designation confirmation from the CNIL online service (where mandatory)
- Executed standard contractual clauses or approved BCRs for transfers outside the EEA
- Data breach register and incident response plan
- HDS certificate from any provider hosting personal health data
- Contract with a registered e-invoicing platform
Common mistakes
- Assuming a group DPO in another country covers France without declaring the designation to the CNIL.
- Using edited or bespoke transfer clauses without realising they need CNIL authorisation, unlike the Commission's standard clauses.
- Choosing a cloud provider for health-related services without checking it holds HDS certification.
- Waiting for the French NIS 2 law before starting cyber work, when ANSSI already points to ReCyF as the reference.
- Treating e-invoicing as a tax-team task only and discovering late that suppliers and ERP flows are not ready.
When the business crosses borders
- Under the GDPR one-stop-shop, a group whose main EU establishment is in another member state usually deals with that lead authority, but the CNIL remains competent for local complaints and purely French matters.
- Transfers from France to a group company outside the EEA need an adequacy decision or an Article 46 safeguard such as SCCs.
- NIS 2 will apply to entities by sector and size across the EU; a group operating in several member states should track each country's transposition, as France is late.
- The e-invoicing mandate covers transactions between businesses established in France; e-reporting rules for cross-border flows were not confirmed.
Questions businesses ask
Does France require personal data to be stored in France?
Not as a general rule. GDPR transfer rules apply. The main French-specific requirement is HDS certification for hosting personal health data, with an EEA storage requirement in the revised standard.67
Is NIS 2 already in force in France?
No. As at October 2026 the transposition bill has not been enacted. ANSSI asks future entities to prepare and offers ReCyF as the reference framework.8910
When do we need to issue electronic invoices in France?
Large companies and ETIs from 1 September 2026; SMEs and micro-enterprises from 1 September 2027. All VAT-registered businesses established in France must be able to receive them from 1 September 2026.11
How large can CNIL fines be?
Up to EUR 20 million or 4% of worldwide annual turnover for the most serious breaches, with daily penalties of up to EUR 100,000 for non-compliance with an order.1
What this guide does not yet confirm
These points need checking with a qualified local professional in France before you rely on them.
- Final text, entity scope, registration deadlines and sanctions of the French NIS 2 law: not enacted at 18 October 2026; the National Assembly debate was postponed on 6 October 2026 (secondary report).
- Adoption date and transition period of the revised HDS certification standard: esante.gouv.fr could not yet be checked; only the 2023 notified draft was confirmed.
- E-reporting obligations for B2C and cross-border transactions under the e-invoicing reform were not confirmed on an official page.
- Loi Informatique et Libertés national specifics (for example age of consent for online services, rules on employee data) were not confirmed because Légifrance could not yet be checked.
- CNIL cookie and tracker rules were not reviewed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Under the ordinary sanction procedure, the CNIL can impose fines of up to EUR 10 million or 2% of annual worldwide turnover, rising to EUR 20 million or 4% for the most serious breaches, and compliance orders with penalties of up to EUR 100,000 per day of delay. Applies to companies; the higher of the fixed amount and the turnover percentage applies under the GDPR. The CNIL can also restrict or ban processing, suspend data flows to third countries and publish its decision.
Under the CNIL's simplified sanction procedure, fines are capped at EUR 20,000 and compliance-order penalties at EUR 100 per day, and the sanction cannot be made public. Used for less complex cases.
A data protection officer (DPO) must be designated by public bodies, by organisations whose core activities involve large-scale regular and systematic monitoring of individuals, and by organisations whose core activities involve large-scale processing of sensitive data or criminal-offence data; the designation is made online on the CNIL website. Courts acting in their judicial capacity are excluded from the public-body case. Voluntary designation is possible in other cases.
A personal data breach that poses a risk to individuals' privacy must be notified to the CNIL as soon as possible and at the latest within 72 hours, using the CNIL online notification service. Controllers subject to the GDPR whose breach is notified in France. An initial notification can be supplemented later; reasons must be given if the 72-hour limit is missed.
The CNIL page on the online notification service (cnil.fr/fr/notifier-une-violation-de-donnees-personnelles) could not yet be checked to automated access; the CNIL Direct answer was used instead.
Where a breach poses a high risk to individuals, the affected people must also be informed; the CNIL can advise whether this is needed. Applies in addition to notification to the CNIL.
Transfers of personal data outside the EEA based on European Commission standard contractual clauses, binding corporate rules, approved codes of conduct or approved certification need no CNIL authorisation; transfers based on bespoke contractual clauses require CNIL authorisation. Applies where no Commission adequacy decision covers the destination. Derogations under GDPR Article 49 are available only in specific situations.
Page notes that the Commission updated its standard contractual clauses on 4 June 2021.
Every host of personal health data must hold a certificate of conformity (HDS certification) under articles L.1111-8 and R.1111-10 of the Public Health Code, and the revised HDS certification referential notified to the EU in 2023 adds a requirement to store health data within the EEA. Applies to providers hosting personal health data on behalf of others (for example cloud and SaaS providers to healthcare actors).
This is the draft as notified. The final adopted order, its date and the transition period for existing certificates were not confirmed because the Agence du numérique en santé pages (esante.gouv.fr) returned no content to automated access.
France has not yet enacted its NIS 2 transposition law: ANSSI refers to the national implementing text as the draft 'projet de loi Résilience' and asks future essential and important entities to begin securing their systems now. The EU transposition deadline was 17 October 2024. Status as at 18 October 2026.
Entity counts, sector lists and sanctions under the French text are not stated on this page and will only be fixed once the law and implementing decrees are adopted.
Since 17 March 2026 ANSSI has published the Référentiel Cyber France (ReCyF), listing recommended measures for the NIS 2 security objectives; under the draft law it is not mandatory but entities applying it can rely on it during an ANSSI inspection. Working document pending adoption of the transposition law.
The NIS 2 transposition bill (projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité) has passed the Senate at first reading and been adopted by the National Assembly committee at first reading; no later stage is shown. The same bill also transposes the DORA directive and the critical entities resilience (CER) directive.
The page does not show dates. Press reporting (next.ink, 6 October 2026) states that the National Assembly removed the bill from its 7 October 2026 agenda and no new date was set; that is a secondary source.
From 1 September 2026 all VAT-registered businesses established in France must be able to receive electronic invoices and large and mid-sized companies (ETI) must issue them; SMEs and micro-enterprises must issue electronic invoices from 1 September 2027. Covers purchases and sales of goods and services between businesses established in France and subject to VAT. Invoices pass through platforms registered by the DGFiP.
The page dates from October 2024. E-reporting obligations for cross-border and B2C transactions are not covered on it and were not confirmed.
Questions on this topic
11 statements on data protection, cybersecurity and digital filing in France
