France

Article 3.II of loi n° 78-17 du 6 janvier 1978 (loi Informatique et Libertes): the French national rules apply as soon as the data subject resides in France, including where the controller is not established in France. This matters most for cookies and similar tracking technologies, which sit under Article 82 of the same law (the ePrivacy regime) and are outside the GDPR one-stop-shop. That is how the CNIL fined foreign-headquartered platforms directly rather than routing the case through an Irish or Luxembourg lead authority, and the Conseil d'Etat upheld that approach. A representative in the European Union is required where a company has no EU establishment (GDPR Article 27); it does not have to be in France.

Sector-by-sector rating for France, checked 18 August 2026. HEALTH - data must stay in the country at the European border. Decret n° 2026-209 of 24 March 2026 writes into the public health code that storage of personal health data is carried out exclusively on the territory of a Member State. The HDS certification standard already said the same (requirement EXI 28: storage exclusively within the European Economic Area). Remote access from outside is possible only on an adequacy decision or Article 46 safeguards, and the host must list every non-European law that could force it to hand data over. ONLINE GAMBLING - mirror Article 31 of loi n° 2010-476 of 12 May 2010 requires licensed operators to archive gambling and betting data in real time on physical hardware located in metropolitan France. The rest of the platform may live abroad; the archive vault may not. ELECTRONIC INVOICING - data must stay in the country at the European border, from 1 September 2026. To be registered as a plateforme agreee (formerly plateforme de dematerialisation partenaire) an operator must undertake to run its information system from the territory of an EU Member State and to make transfer of hosted data outside the EU impossible. GOVERNMENT AND PUBLIC SECTOR - closed Decret n° 2026-272 of 14 April 2026, applying article 31 of the loi SREN, requires State administrations, listed State operators and six named public interest groupings to place particularly sensitive data only on cloud services meeting an ANSSI security standard covering data location and protection against access by the public authorities of a third State. TAX AND ACCOUNTING RECORDS - data can leave once conditions are met but with a real geographic limit. Article L102 C of the Livre des procedures fiscales allows electronic invoice storage in another EU Member State, or in a country bound to France by a mutual assistance convention or granting immediate online access to the tax authority - and nowhere else. The storage location must be declared with the annual return. BANKING, PAYMENTS, INSURANCE, SECURITIES - no French localisation rule found, checked 18 August 2026, confidence medium-high. DORA is the operative regime for financial entities and imposes disclosure of processing location, audit rights and exit plans but no localisation. French banking secrecy (article L511-33 of the Code monetaire et financier) expressly permits disclosure to a third party under a contract entrusting important operational functions, so unlike Germany it is not a cloud blocker. TELECOMS - no localisation rule found. The French rules are about retention, not location. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE - no general civil localisation rule found, checked 18 August 2026, confidence medium. Defence and classified material sit under separate national security rules outside the scope of this record.

France applies the European mechanisms unchanged: adequacy decisions, the 2021 standard contractual clauses, binding corporate rules, certification, codes of conduct and the narrow Article 49 derogations. A transfer impact assessment is expected after the Schrems II judgment. Two French-specific points sit on top. First, an unlawful transfer outside the European Union is a criminal offence in France under article 226-22-1 of the Code penal, punishable by five years' imprisonment and a fine of EUR 300,000 (about USD 330,000) - not merely an administrative fine. Second, health, gambling, e-invoicing and sensitive-state-data rules are geographic bans; no transfer mechanism cures them, because the objection is to the location itself and not to the level of protection. The EU-US Data Privacy Framework remains valid on 18 August 2026 but is under appeal at the Court of Justice and the European Data Protection Board formally asked the Commission on 31 July 2026 to re-examine it; do not build a single-mechanism architecture on it.

CNIL 2025 figures, from its own published review: 259 corrective decisions, of which 83 sanctions (16 by the ordinary procedure, 67 by the simplified procedure), 143 mises en demeure, 31 reminders and 2 warnings; total fines EUR 486,839,500. Twenty-one of the sanctions concerned cookies and trackers, including one fine of EUR 325 million and one of EUR 150 million. Sixteen concerned employee video surveillance and fourteen concerned poor security. Twenty-seven fines carried injunctions backed by daily penalty payments. That pattern - cookies, workplace surveillance, weak passwords - is the single best predictor of where a French inspection will go. Rating: aggressive. The regulator does not wait for complaints; it runs annual thematic inspection priorities and uses the simplified procedure to produce volume. Other operational authorities: ANSSI (cyber, and it owns the SecNumCloud qualification), the Agence du numerique en sante (health data hosting certification), the ANJ (online gambling), the DGFiP (electronic invoicing platform registration), ACPR and AMF (finance), ARCEP (telecoms) and the SISSE at the finance ministry (the blocking statute single desk).

FLOORS. Accounting books, ledgers and supporting documents: 10 years from the close of the financial year (Code de commerce, article L123-22). Tax books, registers and documents: 6 years from the last entry (Livre des procedures fiscales, article L102 B), extended to 10 in fraud cases. Commercial contracts and business correspondence: 5 years. Employment contracts and payroll: 5 years; social contribution records 3 years; time-recording records 1 year. Property transaction deeds: 30 years. Telecoms: civil identity data 5 years from the end of the contract; subscription and payment information 1 year; technical connection data 1 year (Code des postes et des communications electroniques, article L34-1). On top of that a Prime Minister's decree of 15 October 2025 ordered general retention of traffic and location data for one year on national security grounds - it expires on 21 October 2026 unless renewed, and it has been renewed every year since 2021. CEILING. GDPR storage limitation. The CNIL enforces it: several 2025 sanctions concerned keeping customer or prospect records indefinitely. Where invoices are stored electronically outside France, article L102 C of the Livre des procedures fiscales also constrains WHERE they may sit, not just how long. CONFLICT RULE. A statutory minimum retention period is a legal obligation under GDPR Article 6(1)(c) and beats a deletion request; the practical answer is to move the record into a restricted archive rather than keep it in the live system.

Clock 1 - GDPR Article 33: 72 hours to the CNIL, plus notification to affected individuals without undue delay where the risk to them is high. Clock 2 - the paquet telecom regime: providers of electronic communications services to the public, declared with ARCEP, must notify the CNIL within 24 hours of establishing the breach, with a supplementary notification within a further 72 hours if the investigation is incomplete. This is a separate register and a separate form, and it applies in addition to the 72-hour rule, not instead of it. Clock 3 - health: articles D1111-16-2 to D1111-16-4 of the Code de la sante publique, made by decret n° 2016-1214 of 12 September 2016, require health establishments, medico-social establishments and laboratories to report serious information system security incidents without delay to the regional health agency, which routes them to the CERT Sante. Clock 4 - DORA, for financial entities: initial notification within 4 hours of classifying an incident as major and within 24 hours of becoming aware of it, then an intermediate and a final report. A fifth clock will appear when the NIS2 transposition law passes: a 24-hour early warning to ANSSI. The most common operational failure is a telecoms or health organisation running only the 72-hour GDPR process and missing the shorter sector clock entirely.

TRAP 1 - criminal liability. Articles 226-16 to 226-24 of the Code penal make most serious data protection failures punishable by 5 years' imprisonment and EUR 300,000 (about USD 330,000), including unlawful transfer outside the EU (226-22-1). Obstructing the CNIL is separately punishable by 1 year and EUR 15,000 (about USD 16,000). This is a real difference from most of Europe, where the risk is administrative only. TRAP 2 - age 15. Article 45 of loi n° 78-17 sets the digital consent age at 15. Below that, a parent must consent jointly with the child. Products built to 13 (United States) or 16 (Germany) are wrong in France. TRAP 3 - a law that looks binding and is not. Loi n° 2023-566 of 7 July 2023 created a social media "majorite numerique" at 15 and duties on platforms. It has never entered into force: no application decree was ever published, and the government told Parliament in May 2025 that the law "n'a pas pu prosperer en raison de frottements avec le droit de l'Union europeenne". The European Commission wrote on 14 August 2023 that the text was adopted without the notification procedure required by Directive 2015/1535, which makes it inapplicable, and that it conflicted with the Digital Services Act and the country-of-origin principle. A naive text search reports this as French law in force. It is not enforceable. A replacement bill was definitively adopted on 21 July 2026 - see what's coming. TRAP 4 - the blocking statute. Loi n° 68-678 of 26 July 1968 makes it an offence to communicate economic, commercial, industrial, financial or technical documents to a foreign authority outside the official mutual assistance channels. Decret n° 2022-207 of 18 February 2022 created a single desk at the finance ministry, the SISSE, which must be consulted. American discovery requests and foreign regulatory demands are the usual trigger. TRAP 5 - cookies are outside the one-stop-shop. They fall under Article 82 of loi n° 78-17, the French implementation of the ePrivacy directive, so the CNIL acts directly against foreign companies without going through a lead authority. Cookies were the largest single category of French fines in 2025, including one of EUR 325 million. BONUS - unlike Germany, French banking secrecy is not a cloud blocker: article L511-33 of the Code monetaire et financier expressly allows disclosure to a supplier under a contract entrusting important operational functions.

CONFIRMED DATES. 1 September 2026 - electronic invoicing becomes compulsory. Businesses must use a plateforme agreee to send and receive. Registration conditions require the platform operator to run its information system from an EU Member State and to prevent any transfer of hosted data outside the EU. Around 27 September 2026 - paragraphs 2 and 3 of article 1 of decret n° 2026-209 take effect, six months after the rest. 21 October 2026 - decret n° 2025-980 expires. It has been renewed annually since 2021 and renewal is likely, but it is a decision, not an automatic rollover. 12 January 2027 - Data Act: all cloud switching charges and data egress fees must be zero. STILL A BILL, DO NOT PLAN AS BINDING. The projet de loi relatif a la resilience des infrastructures critiques et au renforcement de la cybersecurite, which transposes NIS2, DORA and the critical entities directive, was adopted by the Senate on 12 March 2025 and reported by the National Assembly special committee on 10 September 2025. ANSSI's own guidance states that NIS2 will enter into force in France only once the law, decrees and orders have all been promulgated. As of 18 August 2026 we found no evidence of promulgation. A new law protecting minors on social media was definitively adopted by the National Assembly on 21 July 2026 following a joint committee; its content and commencement decrees were not verifiable on an official source at the date of this record. DORMANT SWITCHES - things the government can flip with no consultation. (1) The annual connection-data retention injunction: one Prime Minister's decree turns general retention on or off. (2) The ANSSI SecNumCloud reference standard: it is approved by Prime Minister's order, so the requirements for sensitive state cloud can be tightened without primary legislation. (3) The scope decree under article 31 of the loi SREN: the list of State operators and public interest groupings caught by the SecNumCloud obligation is set by decree and can be extended. (4) The health hosting decree's transfer conditions bite on contracts, so a change in the European adequacy picture - the EU-US Data Privacy Framework is under appeal at the Court of Justice - immediately changes what a French hospital's supplier may do.