Personal data protection authorities in France: 2026 guide

Personal data is now a major issue for every organisation, whether a very small business managing its customer list or a multinational processing millions of profiles. In response, French and European legislators have put in place an ecosystem of specialised protection authorities. While the CNIL (the French data protection authority) remains the central player in France, other institutions act depending on the sector and the type of processing. This guide sets out the full organisation of the personal data protection authorities in France in 2026, their respective powers and the means of action they deploy to enforce the GDPR.

The CNIL in France: the reference authority for data protection

Missions and scope of intervention

The Commission nationale de l'informatique et des libertés (CNIL) has been the reference independent administrative authority for personal data protection since the Data Protection Act (loi Informatique et Libertés) of 6 January 1978. Strengthened by the application of the GDPR since May 2018, it carries out four main missions defined in Article 8 of Law No. 78-17, as amended.

The CNIL informs and supports professionals in achieving compliance. It regularly publishes sector-specific frameworks, such as the October 2020 framework on the processing of personal data for human resources management purposes, or its June 2021 recommendations on cookies and other trackers. These publications are operational guides that businesses use to structure their compliance arrangements. Processing mapping, legal bases and the other compliance obligations are presented in our article on data protection in business.

The authority also monitors compliance with the regulations through on-site or online checks. In 2023, the CNIL carried out 385 inspections, an increase of 15% compared with 2022 according to its 2024 annual report. These inspections may be triggered by a complaint, as part of a thematic inspection plan, or at random.

Sanctioning powers and recent developments

The CNIL has had graduated sanctioning powers since the GDPR was transposed. It may issue warnings, formal notices and administrative fines of up to €20 million or 4% of worldwide annual turnover, as well as corrective measures such as a ban on processing.

The sanctions imposed in 2023 illustrate this increase in strength: 42 sanctions were adopted for a total amount of €90 million, compared with 18 sanctions and €102 million in 2022. This development points to a more systematic approach to the application of sanctions, particularly towards the large digital platforms.

Since September 2023, the CNIL has also strengthened its doctrine on data transfers outside the European Union. It now checks standard contractual clauses more strictly and requires specific impact assessments for transfers to the United States, even under the new EU-US data protection framework (Data Privacy Framework).

Internal organisation and procedures

The CNIL operates on a collegiate model, with a Board (Collège) of 18 members and a Bureau of 5 members. The chair, currently Marie-Laure Denis since February 2019, has her own powers for the adoption of certain regulatory acts and the management of international relations.

Inspection and sanction procedures follow strict rules laid down by Decree No. 2019-536 of 29 May 2019. Every inspection gives rise to an adversarial report communicated to the organisation concerned, which has a period of time to submit its observations. The restricted committee (formation restreinte), made up of 5 members distinct from those who took part in the inspection, rules on sanctions following an adversarial procedure.

Sector-specific authorities with competence over data

The ACPR: supervision of financial operators

The Autorité de contrôle prudentiel et de résolution (ACPR, the French prudential supervision and resolution authority) acts specifically in the banking and insurance sector on data protection questions. Created by Ordinance No. 2010-76 of 21 January 2010, it has cross-cutting powers that include supervising the processing of personal data in the context of the fight against money laundering and terrorist financing.

The ACPR monitors in particular the application of the customer due diligence obligations (Know Your Customer) provided for in Articles L.561-5 et seq. of the French Monetary and Financial Code. This processing, which is particularly sensitive because it concerns financial and sometimes biometric data, has received particular attention since the entry into force of the 5AMLD directive, transposed by Ordinance No. 2020-115 of 12 February 2020.

In practice, the ACPR and the CNIL coordinate their interventions. Where a financial institution is subject to an ACPR inspection of its anti-money laundering arrangements, the data protection aspects are examined jointly. This coordination avoids duplication and ensures a consistent approach.

The AMF: investor protection and market data

The Autorité des marchés financiers (AMF, the French financial markets authority) supervises data protection in the field of investment services and financial markets. Its intervention concerns mainly the transparency obligations of listed companies and the protection of retail investors. The criminal risks linked to the use of inside information and the compliance measures to be put in place are dealt with in our article on preventing insider dealing in business.

In March 2021 the AMF published specific recommendations on the collection and processing of personal data in the context of financial communications and investor relations. It insists in particular on clear information for investors where their data is collected when they take part in general meetings or in financial communication operations.

Since 2022, the AMF has paid particular attention to trading platforms and fintechs that process behavioural data on a large scale in order to personalise their offers. It checks that these practices comply with the GDPR principles of purpose limitation and proportionality, in particular for commercial profiling algorithms.

Other sector-specific authorities

The Conseil supérieur de l'audiovisuel (CSA), transformed into the Autorité de régulation de la communication audiovisuelle et numérique (ARCOM) by Law No. 2021-1382 of 25 October 2021, has powers in relation to the protection of minors on digital platforms. ARCOM checks in particular that age verification systems comply with the principles of data minimisation.

In the health sector, the Agence nationale de sécurité du médicament et des produits de santé (ANSM, the French medicines and health products agency) monitors pharmacovigilance processing, while the Agence nationale de santé publique (Santé publique France) supervises epidemiological surveillance systems. These authorities apply the CNIL framework specific to health data, updated in November 2022.

Cooperation and coordination mechanisms

Coordination at national level

The French personal data protection authorities have operated on a principle of enhanced coordination since the adoption of the GDPR. A memorandum of understanding signed in June 2019 between the CNIL, the ACPR, the AMF and ARCOM sets out the arrangements for operational cooperation.

This coordination can be seen in practice in joint inspections. Suppose that an online bank is subject to an ACPR inspection of its anti-money laundering procedures: if data protection anomalies are detected, the ACPR immediately passes the file to the CNIL under a standardised procedure. This transmission is accompanied by a sharing of the investigation material and a coordination of sanction timetables.

The authorities also share their sector-specific expertise. The CNIL relies on the technical expertise of the ACPR to assess the proportionality of biometric processing in the banking sector, while the ACPR benefits from the CNIL's expertise on international transfers in order to supervise multinational banking groups.

The European one-stop-shop mechanism

The GDPR introduced a one-stop-shop mechanism (One-Stop-Shop) which designates the lead supervisory authority for cross-border processing. For a European group whose registered office is in France, the CNIL becomes the main point of contact, even if subsidiaries process data in other Member States.

This mechanism operates under the cooperation and consistency procedure provided for in Articles 60 to 67 of the GDPR. When the CNIL investigates a case as lead authority, it is required to consult the authorities concerned in the other Member States before adopting its final decision.

The practical application of this mechanism can be seen in the major European sanctions. The €746 million sanction imposed on Amazon by the Luxembourg authority in July 2021 was the subject of prior coordination with the CNIL, Amazon Luxembourg being a subsidiary of the group but processing the data of French customers.

Relations with the judicial authorities

The administrative data protection authorities maintain structured relations with the judicial authority. Article 40 of the French Code of Criminal Procedure requires the CNIL to report to the public prosecutor (procureur de la République) the criminal offences it discovers during its inspections.

This obligation applies in particular to the offences provided for in Articles 226-16 to 226-24 of the French Criminal Code relating to the automated processing of personal data. Failure to complete prior formalities, unauthorised possession of files or unfair collection are offences punishable by fines and imprisonment.

The French National Financial Prosecutor's Office (Parquet national financier, PNF) has been developing specific expertise since 2020 on personal data offences in the economic and financial context. It coordinates in particular criminal prosecutions with CNIL administrative sanctions in order to avoid breaching the principle of non bis in idem.

Regulatory developments and outlook for 2026

Impact of the Digital Services Act

The Digital Services Act (DSA), applicable since August 2023, substantially changes the landscape of the protection authorities. In France, ARCOM was designated Digital Services Coordinator by Decree No. 2023-835 of 1 September 2023.

This designation creates a new link between data protection and the regulation of online content. ARCOM may now require very large platforms (more than 45 million active users in the EU) to adapt their moderation systems in order to comply with the GDPR, particularly for minors' data.

ARCOM-CNIL coordination is organised around three axes: algorithmic recommendation systems, the protection of minors and the transparency of targeted advertising. An operational protocol signed in January 2024 sets out the arrangements for the exchange of information and for joint inspections.

Reform of CNIL governance

Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space changed the composition and functioning of the CNIL. The number of members of the Board rises from 18 to 21, with the creation of three additional posts reserved for cybersecurity and artificial intelligence experts.

This reform responds to the challenges posed by technological change. The CNIL must in particular prepare for the application of the Artificial Intelligence Regulation (AI Act) from August 2026. It will have specific powers to monitor high-risk AI systems that process personal data.

The CNIL's budget is increasing accordingly: €29 million in 2024 compared with €23 million in 2023, with a target of €35 million in 2026. This increase finances in particular the recruitment of 50 additional staff working on AI and cybersecurity.

Strengthened European harmonisation

Since 2023 the European Data Protection Board (EDPB) has been developing common standards for the application of the GDPR which are gradually becoming binding in practice on national authorities. These standards concern in particular the methodologies for calculating fines and the criteria for assessing international transfers.

The CNIL takes an active part in this harmonisation by chairing the EDPB "Enforcement" subgroup since January 2024. This French chairmanship directly influences European orientations, in particular on the sanctions applicable to massive data breaches and on the regulation of advertising cookies.

The EDPB guidelines adopted in October 2024 on "dark patterns" (deceptive interfaces) are an example of this harmonisation. These guidelines, co-drafted by the CNIL, apply uniformly in the 27 Member States from March 2025.

Individuals' rights and remedies

Complaint procedures

Anyone may refer a matter to the personal data protection authorities through different channels depending on the nature of the complaint. The CNIL handles about 15,000 complaints a year according to its 2024 report, with an average processing time of 8 months for complex cases.

The online complaint is the preferred route since the redesign of the cnil.fr website in 2023. The digital form guides the complainant in characterising the complaint and automatically directs it to the competent authority. If the complaint concerns a financial institution, the system redirects it to the ACPR with simultaneous transmission to the CNIL. The admissibility of the complaint and the documents to be gathered are detailed in our article on filing a complaint with the CNIL.

Collective complaints are also developing since the adoption of Law No. 2022-401 of 21 March 2022 aimed at improving the protection of whistleblowers. Approved associations may now refer matters to the CNIL on behalf of several people who are victims of similar violations, on the model of class actions.

Court remedies and appeals

Decisions of the administrative authorities may be challenged before the Conseil d'État (French Supreme Administrative Court) under the ordinary procedure. Article 26 of the Data Protection Act provides for a period of two months to appeal, running from notification of the decision.

The Conseil d'État has developed specific case law on the review of CNIL sanctions. The judgment of 9 November 2022, No. 450163, states that the administrative court exercises full review over the legal characterisation of the facts and the proportionality of sanctions, but limited review over the technical assessment of security measures.

The individuals concerned may also bring a claim for compensation before the civil courts on the basis of Article 82 of the GDPR. This remedy is exercised independently of administrative sanctions and may lead to damages for non-material harm, even in the absence of material harm, according to the judgment of the Cour de cassation of 12 July 2023.

Mediation and alternative resolution

In 2022 the CNIL introduced a prior mediation procedure for certain types of dispute between organisations and the individuals concerned. This mediation applies in particular to disputes relating to the exercise of rights of access, rectification and erasure in the private sector.

The mediation procedure lasts three months at most and leads to an agreement between the parties in 70% of cases according to the 2023 statistics. It makes it possible to avoid court proceedings while guaranteeing respect for fundamental rights. Mediation agreements may provide for binding corrective measures for the organisation concerned.

Certain sector-specific authorities are also developing their own arrangements. Since 2023 the AMF has offered specialised mediation for disputes relating to personal data in investor-issuer relations, while the ACPR is trialling a conciliation procedure for banking data disputes.

Frequently asked questions

When should the CNIL be approached rather than a sector-specific authority?

Approach the CNIL directly for all personal data processing outside the banking, insurance, financial and audiovisual sectors. For those regulated sectors, apply first to the sector-specific authority (ACPR, AMF, ARCOM), which will pass the matter to the CNIL if necessary. In case of doubt, the CNIL systematically directs the complainant to the competent authority without loss of time.

Can CNIL sanctions be combined with criminal penalties?

Yes, CNIL administrative sanctions and criminal prosecutions may be combined because they penalise different legal orders. However, the amount of the criminal fine is deducted from the administrative fine under Article 26 of the Data Protection Act as amended in 2019. Custodial sentences remain exclusively a matter for the criminal court.

How does the European one-stop shop work for a French company?

If your company processes data in several Member States with its main establishment in France, the CNIL becomes your single point of contact. It investigates your case in coordination with the other European authorities concerned. This rule applies only to cross-border processing; purely local processing falls under the authority of the Member State concerned.

What is the time limit for challenging a CNIL sanction before the Conseil d'État?

The appeal must be brought within two months of notification of the decision. This time limit is strict and cannot be extended. The appeal does not have suspensive effect: the sanction applies immediately unless the Conseil d'État grants summary suspension proceedings (référé-suspension) under the urgent procedure of Article L.521-1 of the French Code of Administrative Justice.

Can the authorities exchange information about the same company?

Yes, the authorities exchange information within the framework of their legal missions under the 2019 protocol. These exchanges respect professional secrecy and concern only the information necessary for the exercise of each authority's powers. The company concerned is informed of these exchanges during adversarial inspection or sanction procedures.

How will the authorities' powers change with the AI Act in 2026?

The CNIL will have specific powers to monitor high-risk AI systems that process personal data, in coordination with the national AI authority, which has yet to be designated. This dual supervision ensures compliance with both the GDPR and the AI Act. Businesses will therefore need to anticipate joint inspections of their algorithmic systems from August 2026.

Are there specific obligations for post-Brexit transfers?

Since September 2023, the CNIL has treated the United Kingdom as a third country benefiting from an adequacy decision. Transfers remain free but must be subject to enhanced monitoring because that adequacy decision may be suspended. For sensitive or large-scale transfers, the CNIL recommends additional standard contractual clauses and a dedicated impact assessment.

The French ecosystem of personal data protection authorities in 2026 reflects the growing complexity of digital issues. While the CNIL remains the central player, the coordinated intervention of the sector-specific authorities ensures protection adapted to the specific features of each field. This organisation, reinforced by European harmonisation, offers businesses and individuals a robust and evolving protection framework. In the face of technological acceleration, particularly with artificial intelligence, these authorities are continually adapting their means of action in order to maintain the balance between innovation and the protection of fundamental rights.