France

France's privacy law of 6 January 1978, the loi Informatique et Libertes, says French national rules apply whenever the person whose data it is lives in France. That holds even if your company has no office in France. This matters most for cookies and other tracking technology. Cookies sit in a separate part of that law. It is the French version of Europe's ePrivacy rules. Those rules sit outside Europe's one-stop-shop system. That system normally lets a company deal with a single lead regulator in one country. Because cookies are outside it, France's privacy regulator, the CNIL, has fined foreign-based platforms directly. It did not route the cases through the Irish or Luxembourg regulator. France's top administrative court, the Conseil d'Etat, agreed this was allowed. If you have no office anywhere in the European Union, you must appoint a representative there. That representative does not have to be in France.

How France treats each industry, checked 18 August 2026. HEALTH - data must stay in the country at the European border. Decret n° 2026-209 of 24 March 2026 writes into the public health code that personal health data is stored only on the territory of a Member State. The health hosting certification standard already said the same: storage only within the European Economic Area (requirement EXI 28). Someone outside Europe can look at the data remotely, but only in two cases. Either the country has an official European decision saying it is safe enough. Or you use one of Europe's approved safeguards, such as the standard contract. The host must also list every non-European law that could force it to hand data over. ONLINE GAMBLING - a copy must stay in the country Article 31 of loi n° 2010-476 of 12 May 2010 makes licensed operators copy gambling and betting data in real time onto physical hardware in mainland France. The rest of your platform can live abroad. The archive copy cannot. ELECTRONIC INVOICING - data must stay in the country at the European border, from 1 September 2026. To be registered as an approved platform, formerly called a plateforme de dematerialisation partenaire, an operator must promise two things. It must run its computer systems from an EU Member State. And it must make it impossible to move hosted data outside the European Union. GOVERNMENT AND PUBLIC SECTOR - data must stay in the country Decret n° 2026-272 of 14 April 2026 applies article 31 of the loi SREN. It covers State administrations, listed State bodies and six named public interest groupings. They may put particularly sensitive data only on cloud services that meet a security standard set by ANSSI, France's cyber agency. That standard covers where data is kept and protection against access by another country's public authorities. TAX AND ACCOUNTING RECORDS - data can leave only if conditions are met, but with a real geographic limit. Article L102 C of the Livre des procedures fiscales allows electronic invoices to be stored in another EU Member State. It also allows a country bound to France by a mutual assistance convention, or one that gives the tax authority immediate online access. Nowhere else is allowed. You must declare where you store them with your annual return. BANKING, PAYMENTS, INSURANCE, SECURITIES - we found no French rule forcing this data to stay in France, checked 18 August 2026, confidence medium-high. The main rules for financial firms come from DORA, Europe's digital resilience law. It makes you disclose where data is kept, allow audits and have exit plans. It does not make data stay in France. French banking secrecy sits in article L511-33 of the Code monetaire et financier. It expressly allows you to share data with an outside supplier. The contract must cover important operational work. So, unlike Germany, banking secrecy does not block cloud use. TELECOMS - we found no rule forcing this data to stay in France. The French rules are about how long you keep data, not where you keep it. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE - we found no general civil rule forcing data to stay in France, checked 18 August 2026, confidence medium. Defence and classified material fall under separate national security rules. Those are outside what this record covers.

France uses the European transfer routes unchanged. Those routes are official European decisions that a country is safe enough, the 2021 standard contract clauses, and company-wide binding rules. Certification and codes of conduct also count. So do a few narrow exceptions in European law. Since the Schrems II judgment you are also expected to write a transfer risk assessment. Two French points sit on top. First, sending data outside the European Union unlawfully is a crime in France. Article 226-22-1 of the Code penal carries up to five years in prison and a fine of 300,000 euros (about 330,000 US dollars). That is not merely an administrative fine. Second, the health, gambling, electronic invoicing and sensitive state data rules are geographic bans. No transfer paperwork fixes them. The objection is to the location itself, not to the level of protection. The EU-US Data Privacy Framework was still valid on 18 August 2026. But it is under appeal at the Court of Justice. On 31 July 2026 the European Data Protection Board formally asked the Commission to re-examine it. Do not build your whole setup on that one route.

These are the CNIL's own published figures for 2025. It made 259 corrective decisions. Of those, 83 were penalties: 16 through the ordinary route and 67 through the simplified one. It also issued 143 formal notices to comply, 31 reminders and 2 warnings. Total fines came to 486,839,500 euros (about 530 million US dollars). Twenty-one penalties concerned cookies and trackers. One was 325 million euros and one was 150 million euros. Sixteen concerned video surveillance of employees. Fourteen concerned poor security. Twenty-seven fines came with orders backed by daily payments until you fix the problem. That pattern is the best guide to where a French inspection will go: cookies, watching staff, and weak passwords. Rating: aggressive. The regulator does not wait for complaints. It sets yearly inspection themes and uses the simplified route to get through volume. Other regulators you may meet. ANSSI is the cyber agency, and it owns the SecNumCloud certification. The Agence du numerique en sante certifies health data hosts. The ANJ handles online gambling. The DGFiP is the tax authority and registers electronic invoicing platforms. The ACPR and the AMF cover finance. ARCEP covers telecoms. The SISSE at the finance ministry is the single desk for foreign document requests.

MINIMUM KEEPING TIMES. Accounting books, ledgers and supporting documents: 10 years from the close of the financial year (Code de commerce, article L123-22). Tax books, registers and documents: 6 years from the last entry (Livre des procedures fiscales, article L102 B), or 10 years in fraud cases. Commercial contracts and business correspondence: 5 years. Employment contracts and payroll: 5 years. Social contribution records: 3 years. Time-recording records: 1 year. Property transaction deeds: 30 years. Telecoms, under article L34-1 of the Code des postes et des communications electroniques: civil identity data 5 years from the end of the contract. Subscription and payment information: 1 year. Technical connection data: 1 year. On top of that, a Prime Minister's decree of 15 October 2025 ordered everyone's traffic and location data kept for one year. The ground was national security. It expires on 21 October 2026 unless renewed. It has been renewed every year since 2021. MAXIMUM. European law says you must not keep personal data longer than you need it. The CNIL enforces this. Several 2025 penalties were about keeping customer or sales prospect records forever. If you store invoices electronically outside France, article L102 C of the Livre des procedures fiscales also limits where they may sit. It is not just about how long you keep them. WHICH WINS. A minimum keeping time set by law is a legal duty. It beats a request to delete. The practical answer is to move the record into a locked-down archive instead of leaving it in your live system.

Clock 1. European privacy law: 72 hours to the CNIL. You must also tell the affected people without undue delay where the risk to them is high. Clock 2. The telecoms rules. If you provide electronic communications services to the public and are declared with ARCEP, you must tell the CNIL within 24 hours of establishing the breach. If your investigation is incomplete, you send a follow-up within a further 72 hours. This is a separate register and a separate form. It applies on top of the 72-hour rule, not instead of it. Clock 3. Health. Articles D1111-16-2 to D1111-16-4 of the Code de la sante publique, made by decret n° 2016-1214 of 12 September 2016, cover hospitals, medico-social establishments and laboratories. They must report serious computer security incidents without delay to their regional health agency. The agency passes them to CERT Sante. Clock 4. DORA, Europe's digital resilience law for financial firms. A first report within 4 hours of classifying an incident as major, and within 24 hours of becoming aware of it. Then an intermediate report and a final report. A fifth clock will appear when France passes its NIS2 law. NIS2 is Europe's cybersecurity directive. It will require a 24-hour early warning to ANSSI, the cyber agency. The most common mistake is a telecoms or health organisation running only the 72-hour European process and missing the shorter industry deadline.

TRAP 1. You can go to prison. Articles 226-16 to 226-24 of the Code penal cover most serious data protection failures. They carry 5 years in prison and a 300,000 euro fine (about 330,000 US dollars). That includes sending data outside the European Union unlawfully, under article 226-22-1. Obstructing the CNIL is a separate offence carrying 1 year and a 15,000 euro fine (about 16,000 US dollars). This is a real difference from most of Europe, where the risk is a fine only. TRAP 2. Age 15. The French privacy law of 1978 sets the digital consent age at 15. Below that age, a parent must consent together with the child. Products built for age 13 (United States) or age 16 (Germany) are wrong in France. TRAP 3. A law that looks binding and is not. Loi n° 2023-566 of 7 July 2023 set a social media age of 15 and duties on platforms. It never came into force. No application decree was ever published. In May 2025 the government told Parliament the law could not proceed because it rubbed against European Union law. The European Commission wrote on 14 August 2023 that France adopted the text without the notification procedure required by Directive 2015/1535. That makes it unenforceable. The Commission also said it conflicted with the Digital Services Act and the country-of-origin principle. A simple text search will report this as French law in force. It is not. A replacement bill was finally adopted on 21 July 2026. See what's coming. TRAP 4. The blocking statute. Loi n° 68-678 of 26 July 1968 makes it an offence to give economic, commercial, industrial, financial or technical documents to a foreign authority. You must use the official mutual assistance channels instead. Decret n° 2022-207 of 18 February 2022 created a single desk at the finance ministry, the SISSE. You must consult it. American discovery requests and foreign regulator demands are the usual trigger. TRAP 5. Cookies sit outside the one-stop-shop. They fall under article 82 of loi n° 78-17, the French version of Europe's ePrivacy rules. So the CNIL acts directly against foreign companies without going through a lead regulator. Cookies were the biggest single category of French fines in 2025, including one of 325 million euros. BONUS. Unlike Germany, French banking secrecy does not block cloud use. Article L511-33 of the Code monetaire et financier expressly allows you to share data with a supplier under a contract for important operational work.

CONFIRMED DATES. 1 September 2026 - electronic invoicing becomes compulsory. You must use an approved platform to send and receive invoices. To be approved, a platform operator must run its computer systems from an EU Member State. It must also prevent any transfer of hosted data outside the European Union. Around 27 September 2026 - paragraphs 2 and 3 of article 1 of decret n° 2026-209 take effect, six months after the rest. 21 October 2026 - decret n° 2025-980 expires. It has been renewed every year since 2021 and renewal is likely. But it is a decision someone has to take, not an automatic rollover. 12 January 2027 - the Data Act: all cloud switching charges and data export fees must be zero. STILL A BILL. DO NOT PLAN AS BINDING. France has a bill on the resilience of critical infrastructure and stronger cybersecurity. It would bring in NIS2, DORA and the critical entities directive. The Senate adopted it on 12 March 2025. A National Assembly special committee reported on it on 10 September 2025. ANSSI's own guidance says NIS2 starts in France only once the law, the decrees and the orders have all been promulgated. As of 18 August 2026 we found no evidence of promulgation. A new law protecting minors on social media was finally adopted by the National Assembly on 21 July 2026, after a joint committee. We could not verify its content or its start dates on an official source at the date of this record. THINGS THE GOVERNMENT CAN CHANGE WITH NO CONSULTATION. (1) The yearly order to keep connection data: one Prime Minister's decree turns it on or off. (2) The ANSSI SecNumCloud standard is approved by Prime Minister's order. So the rules for sensitive state cloud can be tightened without a new law. (3) The list of State bodies and public interest groupings covered by the SecNumCloud rule is set by decree and can be extended. (4) The health hosting decree sets transfer conditions inside contracts. So if Europe changes which countries it officially treats as safe, what a French hospital's supplier may do changes at once. The EU-US Data Privacy Framework is under appeal at the Court of Justice.