France. Comprehensive data protection. Act
LILLaw No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (Loi Informatique et Libertés)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
France's foundational 1978 data protection law, rewritten to sit alongside the GDPR, organises the CNIL, sets national derogations and contains the national cookie rule (Art 82). It also transposes the Law Enforcement Directive.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 15 (below 15 joint consent of child and parent). Post-mortem data directives; specific regimes for health data and the NIR (social security number); Art 82 cookie rule sits inside this law; simplified sanction procedure for minor cases.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover
§3Dates
- Key dates
- Adopted
- In force
- Recast by Law 2018-493, Ordinance 2018-1125 (in force 2019-06-01) and Decree 2019-536
§4Text and authority
- Text
- Authoritative text legifrance.gouv.fr
- Authority
- Commission Nationale de l'Informatique et des Libertés (CNIL)
§5Where it applies
- Domestic law of
- France
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.