#GDPR Lawyer in France: Compliance, CNIL Inspections and Defence

A GDPR lawyer brings your company into compliance with the General Data Protection Regulation (GDPR, RGPD in French) and defends you in the event of an inspection by the CNIL (French data protection authority) or a personal data breach. Hashtag Avocats, a Paris law firm dedicated to digital law, acts from the initial audit through to crisis management, for start-ups and established groups alike.

🌐 Service	📋 Description
🔒 Data Protection	Securing personal data to ensure confidentiality and security.
📝 GDPR Audit	Carrying out an audit to assess compliance and draw up a tailored action plan.
📑 Internal Processes	Setting up records of processing, making contracts legally sound and securing data access rights.
⚖️ Legal Drafting	Drafting privacy policies, cookie management and security clauses.
🚨 Breach Management	Assistance in the event of a personal data breach and notification to the authorities.
📚 Training and Awareness	Training teams to ensure day-to-day compliance with GDPR obligations.
🔄 Ongoing Updates	Monitoring legislative changes to keep compliance up to date.

GDPR lawyer in Paris, from advice to litigation

Our IP-IT practice, headed by Maître Arnaud Touati, a lawyer (avocat) admitted to the Paris and Luxembourg Bars, handles personal data protection from end to end. The same firm advises you on compliance, assists you during a CNIL inspection and defends you if a penalty is imposed, up to the Conseil d’État (France’s highest administrative court). We receive clients in the 8th arrondissement of Paris and act for businesses throughout France.

For related topics, see our pages on personal data lawyer (in French) (contracts and data subject rights) and personal data breach (leak or hack in progress).

What does GDPR compliance involve in France?

The GDPR (Regulation (EU) 2016/679), applicable since 25 May 2018, governs all processing of personal data. It applies to every business established in the European Union, whatever its size, and to businesses outside the EU that target European residents. In France, it operates alongside Law No. 78-17 of 6 January 1978 (French Data Protection Act, Informatique et libertés) (in French), under the supervision of the CNIL.

Compliance means working on several fronts at once:

• Lawfulness and transparency: a legal basis for each processing operation, clear information for individuals, and consent collected where required.
• Data subject rights: access, rectification, erasure, restriction, portability and objection, with internal procedures to respond within the deadlines.
• Security: technical and organisational measures proportionate to the risks.
• Documentation: record of processing activities, data protection impact assessments (DPIA, AIPD in French) for high-risk processing, compliant data processing agreements.
• Personal data breaches: notification to the CNIL within 72 hours and, depending on the case, information to the individuals concerned.
• DPO: appointment of a Data Protection Officer where the regulations require it.

The most serious infringements expose you to administrative fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83 GDPR (in French)). Beyond the penalty, compliance is a condition of access to many business-to-business markets and reassures investors and clients.

What our firm does in practice for your compliance

GDPR audit and action plan

We map your processing operations, identify gaps and prioritise actions according to the real risk. The audit leads to an operational compliance plan, adapted to your sector and your resources, rather than a theoretical report.

Documentation and internal processes

We draw up the record of processing activities, draft your privacy policies and cookie management, and make your data processing agreements legally sound (Article 28 GDPR): hosting providers, marketing tools, SaaS providers. We put in place procedures for exercising data subject rights and impact assessments where your processing requires them. This work often ties in with our practice in IT contracts.

Personal data breaches and CNIL inspections

In the event of a leak or hack, we handle the emergency with you: qualifying the breach, notifying the personal data breach to the CNIL within 72 hours, communicating with the individuals concerned, and coordinating with the technical teams. These situations overlap with our cybersecurity practice. In the event of a CNIL inspection or penalty procedure, we represent you at every stage.

Transfers outside the EU and direct marketing

Two topics account for a significant share of inspections. Transfers of data outside the European Union require specific safeguards (standard contractual clauses, assessment of the destination country), which is common as soon as a US tool enters your tech stack. Direct marketing (emailing, telephone, advertising cookies) is subject to precise consent rules, and breaches are regularly penalised. We audit these two areas first, because they combine high exposure with quick fixes.

Training your teams

Compliance happens day to day, in the actions of marketing, HR and IT teams. We train your staff in the essential habits: data minimisation, retention periods, handling requests from individuals, detecting incidents.

The documents the CNIL may ask you for

During an inspection, the CNIL almost always starts with the documents. Three of them form the backbone of a company’s compliance.

The record of processing activities

The record lists each processing operation: purpose, categories of data and of individuals, recipients, retention periods, security measures (Article 30 GDPR). The text provides an exemption for small organisations, but it does not apply where the processing is not occasional, presents a risk to individuals or concerns sensitive data. In practice, payroll and customer files are regular processing operations.

The data protection impact assessment (DPIA)

Where processing is likely to result in a high risk to the rights and freedoms of individuals, the controller carries out an impact assessment before implementing it (Article 35 GDPR). This covers in particular systematic monitoring on a large scale and large-scale processing of sensitive data.

Responding to data subject requests

A request for access, rectification or erasure calls for a response without undue delay, and at the latest within one month. This period may be extended by two months depending on the complexity and number of requests, provided the individual is informed within the first month (Article 12(3) GDPR).

CNIL inspection: your rights during the procedure

CNIL officers may access business premises between 6 a.m. and 9 p.m. The person in charge of the premises is informed of their right to object to the visit; if they object, the visit may only take place with the authorisation of the liberty and custody judge (juge des libertés et de la détention) (Article 19 of Law No. 78-17 of 6 January 1978). You may be assisted by counsel, and the confidentiality of communications between lawyer and client can be asserted against the officers.

The inspection gives rise to an official report and then, where appropriate, to a formal notice or the opening of a penalty procedure. Details of our work are set out on our page support during a CNIL inspection.

CNIL fines: ordinary procedure, simplified procedure and appeals

The CNIL’s restricted committee (formation restreinte) may issue a call to order, an order to comply, where applicable subject to a periodic penalty payment, a restriction of processing or an administrative fine (Article 20 of Law No. 78-17). Since 28 May 2026, the caps under the simplified procedure have been raised for large companies.

Stage	What the law provides	Reference
On-site inspection	Access from 6 a.m. to 9 p.m.; right to object, overridden by authorisation of the liberty and custody judge; assistance of counsel; lawyer-client confidentiality can be asserted	Art. 19, Law No. 78-17
Measures of the restricted committee	Call to order, order to comply subject to a periodic penalty payment, restriction or ban of processing, administrative fine	Art. 20, Law No. 78-17
Fine: obligations of the controller and the processor	Up to €10 million or 2% of total worldwide annual turnover, whichever is higher	Art. 83(4) GDPR
Fine: principles, consent, rights and transfers	Up to €20 million or 4% of total worldwide annual turnover, whichever is higher	Art. 83(5) GDPR
Simplified procedure	The chair of the restricted committee rules alone; fine of up to €20,000 and periodic penalty payment of up to €100 per day, raised to €100,000 and €500 per day if worldwide annual turnover exceeds €50 million; decisions not published	Art. 22-1, Law No. 78-17 (version of 28 May 2026)
Appeals	Appeals against CNIL decisions lie to the Conseil d’État, at first and last instance	Art. R. 311-1, French Code of Administrative Justice

These penalties affect all types of organisation. On 8 January 2026, the CNIL fined a mobile phone operator €27 million, in particular over data retention periods, data security and information provided to individuals after a breach (decision SAN-2026-001). On 26 March 2026, under the simplified procedure, it imposed a €15,000 fine on a ticketing company, in particular over cookies. The amounts and infringements found are detailed in our article on GDPR penalties (in French).

Cookies and direct marketing: two areas penalised by the CNIL

Placing cookies that are not necessary for the service requires the user’s prior consent, except for trackers that are strictly necessary or whose sole purpose is to enable communication (Article 82 of Law No. 78-17). See our article on cookies and the GDPR.

Direct marketing by email or text message to individuals also requires their prior consent. An exception covers existing customers, for similar products or services supplied by the same company (Article L. 34-5 of the French Post and Electronic Communications Code (Code des postes et des communications électroniques)). See our article on direct marketing and the GDPR (in French).

Why hire a lawyer for GDPR compliance?

A legal reading, not just paperwork

GDPR compliance is not just a matter of document templates. Each processing operation requires a legal characterisation: the appropriate legal basis, a justifiable retention period, the exact role of each party (controller, joint controller, processor). A characterisation error weakens the whole documentation chain. The lawyer provides this analysis and adapts it to the specific features of your sector.

A prioritised risk assessment

Not all non-compliance carries the same weight. We assess the real risks in the light of the CNIL’s guidance and penalties, then focus your resources on the most exposed gaps. This prioritisation avoids theoretical projects that tie up teams without reducing the risk.

Professional secrecy and defence

Communications with your lawyer are covered by professional secrecy, a decisive advantage when an incident occurs or an inspection is announced. In the event of a penalty procedure, a formal notice or litigation with a data subject, we represent you before the CNIL and the courts.

Who needs a GDPR lawyer in France?

Any organisation that processes personal data may need legal support, with higher stakes for:

• Start-ups and technology companies, whose product often relies on the use of data: compliance is a condition for fundraising and for contracts with key accounts.
• E-commerce businesses, which continuously process customer accounts, payments and marketing data (see our page e-commerce lawyer).
• Regulated sectors (health, finance, insurance), subject to sector-specific requirements on top of the GDPR.
• Organisations processing sensitive data: health, biometrics, criminal convictions, with stricter processing conditions.
• Businesses outside the EU that offer goods or services to European residents or monitor their behaviour.

GDPR compliance as a strategic asset

The protection of personal data is a fundamental right, as the CNIL regularly points out. For a business, compliance goes beyond simply avoiding penalties: it is a condition of access to calls for tender, reassures investors during due diligence and forms part of CSR (corporate social responsibility) policies. Robust data governance becomes a selling point, particularly in business-to-business relationships where clients audit their service providers.

Obligations vary according to the sensitivity of the data, the volume of processing and its impact on your business. Compliance should therefore be managed as an ongoing programme, not a one-off project: regulatory monitoring, documentation updates, regular reviews of processors and retention periods.

How an engagement works and how our fees are set

An engagement begins with an initial discussion to understand your processing, your contracts and your priorities. We then define the scope and the deliverables: mapping, record, policies, clauses, impact assessments, training. Fees are agreed with you in a written fee agreement, except in an emergency (Article 10 of Law No. 71-1130 of 31 December 1971).

Depending on your needs, we work on a fixed fee per deliverable, on a time-spent basis or under a legal subscription (retainer). Our ways of working are set out on our fees page.

Outsourced DPO: entrusting the role to a lawyer

Article 37 GDPR requires a Data Protection Officer to be appointed in three cases: processing carried out by a public authority or body, regular and systematic monitoring of individuals on a large scale, or large-scale processing of sensitive data or data relating to criminal convictions. Outside these cases, appointing one is still recommended to manage compliance over time.

The same article provides that the DPO may fulfil their tasks on the basis of a service contract. Outsourcing the role to a lawyer falls within this framework. It brings a legal reading of processing operations, the independence required by the Regulation and the rigour of professional secrecy in handling your files. The role is organised so as to prevent any conflict of interest, in accordance with the requirements of the GDPR and the rules of the legal profession.

Our firm offers this outsourced DPO role alongside its compliance work: regular reviews, documentation kept up to date, a monitored record and an identified contact for the CNIL.

FAQ: GDPR lawyer

What is the difference between a GDPR lawyer and a DPO?

The DPO (Data Protection Officer) manages compliance internally, on an ongoing basis. The GDPR lawyer provides legal analysis, drafts binding documents, makes contracts legally sound and represents you before the CNIL or in litigation. The two roles complement each other; a lawyer can also support or train your DPO.

How long does GDPR compliance take?

It depends on the volume and sensitivity of the processing. A start-up with a simple scope can lay a solid foundation in a few weeks. A multi-business organisation with many processors faces a project of several months, prioritised by risk. Every situation is different.

What should you do in the event of a personal data breach?

Document the incident immediately, contain it technically and assess the risk to individuals. If there is a risk, notify the CNIL within 72 hours. If the risk is high, also inform the individuals concerned. Legal support from the very first hours avoids errors of characterisation and communication.

Does the CNIL really fine SMEs?

Yes. The CNIL regularly publishes penalties against organisations of all sizes, in particular through its simplified procedure. Recurring infringements concern direct marketing, cookies, video surveillance and data security. The level of the penalty takes into account the size of the organisation and its cooperation.

Can you refuse CNIL officers access to your premises?

Yes, in principle. The person in charge of the premises is informed of their right to object; the visit may then only take place with the authorisation of the liberty and custody judge (juge des libertés et de la détention). However, in an emergency, where the facts are serious or there is a risk of documents being destroyed, the judge may authorise in advance a visit without informing the person in charge, who then cannot object (Article 19 of Law No. 78-17). You may be assisted by counsel during the inspection.

What is the maximum fine under the simplified procedure?

€20,000, with a periodic penalty payment capped at €100 per day of delay. Since 28 May 2026, these caps have risen to €100,000 and €500 per day for organisations whose worldwide annual turnover exceeds €50 million (Article 22-1 of Law No. 78-17). These decisions are not made public.

How can you challenge a CNIL penalty?

By an appeal to the Conseil d’État, which has jurisdiction at first and last instance over CNIL decisions (Article R. 311-1 of the French Code of Administrative Justice (code de justice administrative)). The lawyer analyses the procedure followed, the characterisation of the infringements and the proportionality of the penalty. Every situation is different.

How quickly must you respond to an access request from a customer or employee?

Without undue delay and at the latest within one month of receipt. This period may be extended by two months depending on the complexity and number of requests; the individual must be informed within the first month (Article 12(3) GDPR).

Does an SME have to keep a record of processing activities?

In practice, yes, in most cases. The GDPR provides an exemption for small organisations, but it does not apply if the processing presents a risk, is not occasional or concerns sensitive data (Article 30(5)). Payroll and customer files are regular processing operations.

Official sources

• Regulation (EU) 2016/679 (GDPR), Article 83, administrative fines: full text on cnil.fr (in French)
• Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties: Légifrance (in French)
• Law No. 2018-493 of 20 June 2018 on the protection of personal data: Légifrance (in French)
• Article 19 of Law No. 78-17 of 6 January 1978 (CNIL inspections): Légifrance (in French)
• Article 20 of Law No. 78-17 (measures and penalties): Légifrance (in French)
• Article 22-1 of Law No. 78-17 (simplified procedure): Légifrance (in French)
• Article 82 of Law No. 78-17 (cookies and trackers): Légifrance (in French)
• Article L. 34-5 of the French Post and Electronic Communications Code (direct marketing): Légifrance (in French)
• Article R. 311-1 of the French Code of Administrative Justice (jurisdiction of the Conseil d’État): Légifrance (in French)
• GDPR, Articles 12 (data subject rights), 30 (record) and 35 (impact assessment): cnil.fr (in French)
• CNIL, decision SAN-2026-001 of 8 January 2026: Légifrance (in French)
• CNIL, list of penalties imposed: cnil.fr (in French)

Law as it stands on 1 October 2026. Page written under the responsibility of Maître Arnaud Touati. This content provides general information and does not constitute legal advice. Every situation is different: contact our team for an audit of your GDPR compliance.