Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
France applies GDPR under CNIL enforcement, supplemented by the Loi Informatique et Libertés. As of September 2026, France has still not finished transposing NIS2 into national law, the 'Loi Résilience' remains stuck in parliamentary process, and the EU referred France to the Court of Justice of the EU in July 2026 over the delay.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in France without transposition.
SourceFrance's national data protection act (as amended since GDPR took effect), which sets French-specific margins such as the digital age of consent (15) and CNIL's powers.
Source72 hours
GDPR Article 33 applies uniformly: notify CNIL without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: CNIL
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Not yet transposed as of September 2026. The transposition vehicle, the 'Loi Résilience' (critical infrastructure resilience and cybersecurity bill), which designates ANSSI as national authority, passed the Senate in March 2025 and an amended text in the National Assembly's special committee in September 2025, but had not been promulgated as of early September 2026. On 8 July 2026 the European Commission referred France (with Spain, Ireland, and the Netherlands) to the CJEU for failure to notify complete transposition. In the interim, ANSSI operates the non-binding Référentiel Cyber France (ReCyF) and the MonEspaceNIS2 registration/eligibility platform.
SourceCommission Nationale de l'Informatique et des Libertés(CNIL)
Visit authority siteNo. As of September 2026, France's NIS2 transposition law (the 'Loi Résilience') has not been enacted. It passed the Senate in March 2025 and cleared a National Assembly committee in September 2025, but full parliamentary adoption was pushed back. The European Commission referred France to the CJEU on 8 July 2026 for the delay.
Not statutory NIS2 obligations yet, but ANSSI has published the Référentiel Cyber France (ReCyF) and opened the MonEspaceNIS2 platform so organizations can assess eligibility and prepare ahead of the law's eventual entry into force.
CNIL, France's independent data protection authority, notification is due without undue delay and within 72 hours where feasible, per GDPR Article 33.
Talk to us about scoping an engagement around your specific regulatory context.
