Loi Informatique et Libertés (FR)
French act accompanying the GDPR
TL;DR
French data protection law supplements the GDPR with national special rules, for example the CNIL list of processing operations for which a DPIA must be carried out (Art. 35(4) GDPR). In France, too, the framework for fines follows Art. 83 GDPR.
What is the Loi Informatique et Libertés (FR)?
Practical relevance for DACH SMEs:
- Applies where end customers are in France
- Supervision by the French data protection supervisory authority, the CNIL
- Legal remedies before the French courts
Practical example
A DACH SaaS provider with an establishment in France must additionally comply with Loi 78-17 and CNIL practice.
Frequently asked questions
How do the fines compare?
France and Germany are subject to the same framework under Art. 83 GDPR: depending on the infringement, fines of up to EUR 10 million or 2% or up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(4) and (5) GDPR).
When does it apply?
Where there is an establishment in France or where French end customers are targeted.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult a qualified lawyer.