Data protection in business

The protection of personal data in business is now a major legal issue that goes well beyond mere regulatory compliance. Since the GDPR (RGPD) came into force in May 2018, French companies have had to rethink entirely their relationship with the information they collect, process and store about their employees, customers and partners. This obligation comes with substantial financial penalties and increased civil liability in the event of a breach. This guide details the concrete obligations that apply to companies in 2026, the compliance mechanisms and the risks incurred.

The legal framework for data protection in business

The General Data Protection Regulation (EU) 2016/679, which became applicable on 25 May 2018, is the foundation of personal data protection in France. This European text applies directly in all Member States and is accompanied by Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended by Law No. 2018-493 of 20 June 2018.

The GDPR applies to any company that processes the personal data of European residents, regardless of its geographical location. Personal data means any information relating to an identified or identifiable natural person. In practice, this covers names, addresses, telephone numbers and email addresses, but also geolocation data, login identifiers and biometric data.

The French data protection authority (Commission nationale de l'informatique et des libertés, CNIL) has had strengthened powers of control and sanction since 2018. The authority may impose administrative fines of up to €20 million or 4% of the company's total worldwide annual turnover, whichever is higher.

The fundamental principles of the GDPR

The European regulation rests on six guiding principles that every company must respect. The principle of lawfulness requires a valid legal basis for each processing operation. The principle of purpose limitation requires data to be collected for specified, explicit and legitimate purposes. The principle of data minimisation limits collection to the information necessary for the purposes pursued.

The principle of accuracy requires data to be updated regularly and inaccurate information to be rectified. The principle of storage limitation prevents personal data from being kept indefinitely. Finally, the principle of integrity and confidentiality requires appropriate technical and organisational measures to be put in place.

The initial audit and the mapping of processing operations

A company's GDPR compliance begins with a complete audit of existing personal data processing. This step, often underestimated, determines the effectiveness of the whole protection system.

The audit must identify all the company's departments that collect, process or store personal data. Human resources handle employees' personal files, training, appraisals and health data. The sales department manages customer and prospect files. Marketing uses behavioural and preference data. Accounting holds invoicing information and bank details.

Mapping of processing operations is the central tool of this exercise. For each processing operation identified, the company must document the purpose pursued, the category of data processed, the internal and external recipients, the retention periods applied and the security measures in place.

The mandatory documentation tools

The record of processing activities, provided for by Article 30 of the GDPR, is an obligation for companies with more than 250 employees and for any organisation that regularly processes sensitive or criminal-offence data. This document lists all the personal data processing carried out by the company.

Each processing record must state the identity of the controller and its representative, the purpose of the processing, the categories of data subjects and of personal data, the recipients of the data and transfers to third countries. The envisaged retention period and a general description of the security measures complete this documentation.

Data protection impact assessments (DPIAs, in French AIPD) are required where the processing presents a high risk to the rights and freedoms of individuals. This obligation concerns in particular large-scale processing of sensitive data, systematic monitoring of publicly accessible areas, or the use of new technologies such as artificial intelligence.

Legal bases and consent

Every processing of personal data must rest on a valid legal basis provided for by Article 6 of the GDPR. The choice of legal basis determines the rights of data subjects and the company's obligations.

The data subject's consent is the best-known legal basis but not necessarily the most appropriate in a professional context. The GDPR defines consent as any freely given, specific, informed and unambiguous indication by which the person agrees to the processing of his or her data.

Performance of a contract or of pre-contractual measures justifies many processing operations in business. Payroll management, tracking of customer orders and invoicing typically fall under this legal basis. Compliance with a legal obligation permits processing required by law, such as social security or tax filings.

Legitimate interest in practice

The legitimate interest pursued by the controller offers a flexibility that companies appreciate. This legal basis permits processing necessary for the company's legitimate interests, provided that it does not infringe the interests or fundamental rights of the data subjects.

A three-step proportionality test is required. The company must first demonstrate the reality and legitimacy of the interest pursued. It must then establish the necessity of the processing to achieve that objective. Finally, it carries out a balancing of its interests against those of the data subjects.

Commercial prospecting of existing customers, video surveillance of business premises or management of unpaid invoices may fall under legitimate interest under certain conditions. By contrast, this legal basis is generally not suited to the processing of sensitive data or to international transfers to countries without an adequate level of protection.

The rights of data subjects

The GDPR considerably strengthens the rights of individuals whose data are processed by the company. These rights are exercised directly against the controller, who has a maximum of one month to respond, extendable by two months for a complex request. The procedure for lodging a complaint with the CNIL, its admissibility conditions and the documents to be gathered before filing it are dealt with separately in our dedicated article.

The right of access allows any person to obtain confirmation that his or her data are being processed and to obtain a copy of them. The company must also provide the purposes of the processing, the categories of data concerned, the recipients and the retention period. This right is exercised free of charge for a first request each year.

The right to rectification requires inaccurate data to be corrected without delay. The right to erasure, sometimes called the "right to be forgotten", allows deletion of data to be obtained in certain limited cases. Data must be erased if they are no longer necessary for the original purposes, if consent is withdrawn or if the processing is unlawful. The cases in which deletion may be requested and how to obtain it are detailed in our article on the right to be forgotten.

Rights specific to the digital economy

The right to restriction of processing temporarily suspends the use of data in certain specific cases. This mechanism applies in particular where the person contests the accuracy of the data while the company verifies their accuracy, or where the person objects to the processing while his or her request is being examined.

The right to data portability concerns only automated processing based on consent or on the performance of a contract. The person may retrieve his or her data in a structured and commonly used format in order to transmit them to another controller. This obligation sometimes transforms companies' information systems, which must provide export functionality.

The right to object allows a person to object at any time to processing based on legitimate interest or on a task carried out in the public interest. The company must then stop the processing unless it demonstrates compelling legitimate grounds that override the person's interests. In the case of direct marketing, the right to object is exercised without condition.

Data security and technical measures

Article 32 of the GDPR requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This reinforced obligation of means takes account of the state of the art and the costs of implementation.

Pseudonymisation and encryption are security measures expressly mentioned by the regulation. Pseudonymisation replaces direct identifiers with indirect identifiers, reversible only by the controller. Encryption renders data unintelligible without the appropriate decryption key.

Companies must also guarantee the confidentiality, integrity and availability of data. Strong authentication, access logging, network segmentation and regular backup contribute to this security. Sensitive data call for reinforced measures such as access on named authorisation or two-factor authentication.

Managing security incidents

The obligation to notify personal data breaches introduces an unprecedented logic of transparency. Any breach likely to result in a risk to the rights and freedoms of individuals must be notified to the CNIL within 72 hours of becoming aware of it.

The notification states the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences and the measures taken or proposed to remedy the breach. Where the breach presents a high risk to individuals' rights, the company must also inform them directly without undue delay.

Keeping a register of personal data breaches, although not mandatory for SMEs, is good practice. This document lists all incidents, their causes, their consequences and the corrective measures adopted. It demonstrates the company's diligence in the event of a CNIL inspection.

The data protection officer

The appointment of a data protection officer (DPO) becomes mandatory in three cases. Public authorities must systematically appoint a DPO, with the exception of courts acting in their judicial capacity. Companies whose core activity requires regular and systematic monitoring of individuals on a large scale must also appoint one.

Finally, organisations that process sensitive data or data relating to criminal convictions on a large scale are subject to this obligation. Banks, insurers, telecommunications operators and direct marketing companies generally fall within this scope.

The DPO may be an employee of the company or an external service provider. The DPO must have appropriate professional qualifications in data protection law and practice. Functional independence is crucial: the DPO may not receive instructions in carrying out his or her tasks and may not be dismissed or penalised for performing them.

The officer's tasks

The DPO informs and advises the controller and employees on their data protection obligations. The DPO monitors compliance with the GDPR and national provisions, including the assignment of responsibilities and staff awareness-raising. The DPO advises the company on impact assessments and monitors their performance.

The officer cooperates with the supervisory authority and acts as its contact point on all issues relating to processing. Data subjects may also contact the officer directly on any question relating to the processing of their data. This task requires the DPO's contact details to be published internally and externally.

The DPO keeps a detailed record of processing activities and takes part in the company's data governance. The DPO's hierarchical position must enable access to the data and processing necessary for the performance of the tasks and direct reporting to the highest level of management.

International data transfers

Transfers of personal data to countries outside the European Union are strictly regulated by the GDPR. Such transfers may take place only if the recipient country ensures an adequate level of protection or if appropriate safeguards are put in place.

The European Commission has recognised an adequate level of protection in fourteen countries or territories, including Andorra, Argentina, Canada (for the private sector), Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay and the United Kingdom. The United States has benefited from a partial adequacy decision under the Data Privacy Framework since July 2023, replacing the Privacy Shield invalidated by the Court of Justice of the European Union.

In the absence of an adequacy decision, transfers must rely on appropriate safeguards. The standard contractual clauses adopted by the European Commission are the main tool for securing such transfers. These standardised clauses are incorporated into the contracts between the European exporter and the data importer.

Legal security tools

Binding corporate rules (BCRs) allow intra-group transfers to third countries. These rules, approved by the European data protection authorities, define the group's data protection policy and bind all its entities. Putting them in place requires a long and complex approval process, reserved for multinational groups.

Approved codes of conduct and certification mechanisms are emerging appropriate safeguards. These sector-specific tools define protection standards suited to particular activities. They offer an interesting alternative to standard contractual clauses for organised sectors.

The transfer impact assessment (TIA) completes these formal safeguards. The exporter must verify that the law of the recipient country does not undermine the effectiveness of the contractual safeguards. This analysis relates in particular to government surveillance laws and the powers of local authorities to access the transferred data.

Subcontracting and responsibilities

The relationship between controller and processor is subject to reinforced regulation under the GDPR. Any processor that processes personal data on behalf of a controller must sign a contract that complies with the requirements of Article 28 of the regulation.

The processing contract defines the subject matter, duration, nature and purpose of the processing, and the categories of personal data and data subjects. It specifies the obligations and rights of the controller and strictly regulates the possibilities of sub-processing.

The processor may process the data only on documented instructions from the controller. It must ensure the confidentiality of the persons authorised to process the data and assist the controller in responding to data subjects' exercise of their rights. The return or destruction of the data at the end of the services is also a contractual obligation.

Joint controllership and joint processing

Where several controllers jointly determine the purposes and means of processing, they are joint controllers within the meaning of Article 26 of the GDPR. This situation concerns in particular commercial partnerships involving the sharing of customer files or collaborative tools set up between several companies.

Joint controllers must transparently define their respective responsibilities by a written arrangement. This agreement specifies who responds to data subjects' exercise of their rights, who notifies data breaches to the CNIL and who bears liability in the event of damage. One organisation must be designated as the single point of contact for data subjects.

The joint and several liability of joint controllers towards data subjects is a significant risk. Each joint controller may be held liable for the whole of the damage, and must then seek recourse against its co-contractors according to the terms of the internal arrangement.

Ongoing compliance and inspections

GDPR compliance is not a one-off project but a continuous process of improvement. Companies must adapt their practices to changes in their activities, the technologies used and the case law of the supervisory authorities.

The CNIL may carry out on-site, document-based or online inspections. These inspections give rise to the drawing up of a report which may lead to sanction proceedings. The authority favours an educational approach for the first infringements of SMEs but is stricter with large companies and repeated breaches. The authority's status, tasks and powers of sanction and injunction are presented in our guide on the definition and role of the CNIL.

The financial penalties imposed by the CNIL since 2018 reveal its enforcement priorities. Failures to secure data, the absence of a valid legal basis and non-compliance with data subjects' rights account for most of the sanctions. Fine amounts take account of the seriousness of the breach, its intentional nature and the measures taken to reduce the damage.

Good governance practices

Appointing a data protection manager at the level of general management, even without a legal obligation, facilitates the steering of compliance. This function coordinates actions between the various departments and carries the data protection culture within the company.

Regular staff training is a profitable investment. Staff in human resources, marketing and IT handle personal data daily without always appreciating the legal stakes. Awareness-raising adapted to each function significantly reduces the risk of incidents.

The annual compliance audit, entrusted to an external provider or carried out internally using a rigorous methodology, identifies gaps against regulatory requirements. This audit covers the legal, technical and organisational aspects of data protection and leads to a prioritised corrective action plan.

Frequently asked questions

Are SMEs with fewer than 250 employees exempt from the GDPR?

No, the GDPR applies to all companies that process personal data, whatever their size. Only the obligation to keep a record of processing activities does not apply to companies with fewer than 250 employees, unless they process sensitive data or data relating to criminal convictions.

Can personal data be processed without consent?

Yes, consent is only one of the six legal bases provided for by the GDPR. Performance of a contract, compliance with a legal obligation and legitimate interest allow many processing operations in business without obtaining prior consent.

How long can personal data be kept?

The retention period depends on the purpose of the processing and the applicable legal obligations. Staff management data are generally kept for 5 years after the employee leaves, and customer invoices for 10 years for accounting obligations. The company must define precise periods for each category of data.

Are employees' data subject to the GDPR?

Yes, employees' data benefit from the protection of the GDPR and of the French Data Protection Act (loi Informatique et Libertés). The existence of an employment contract does not relieve the employer from complying with the principles of lawfulness, minimisation and transparency for all HR processing.

What does a company risk in the event of a data breach?

In addition to administrative sanctions of up to €20 million or 4% of total worldwide annual turnover, the company incurs civil liability towards the individuals whose data have been compromised. Non-material damage is now recognised and compensated by the civil courts.

Can a processor be sanctioned directly by the CNIL?

Yes, since the GDPR, processors may be directly sanctioned by supervisory authorities. They are responsible for compliance with their specific obligations, in particular as regards data security and cooperation with the controller.

How can a company prove its GDPR compliance?

Compliance is demonstrated by keeping complete documentation: an up-to-date record of processing activities, impact assessments for high-risk processing, procedures for handling data subjects' rights, compliant processing contracts and evidence of staff training on data protection issues.

The constantly evolving case-law and technical framework of personal data protection in business requires permanent monitoring and continuous adaptation of practices. Companies that anticipate these developments and invest in robust governance of personal data secure their commercial development while respecting the fundamental rights of their customers and staff. Given the growing complexity of these issues, support from a qualified adviser is often indispensable in order to navigate this constantly changing regulatory landscape with confidence.