# Fr cnil privacy compliance
> Source: https://legalcode.md/skills/legalcode-fr-cnil-privacy-compliance | [HTML version](https://legalcode.md/skills/legalcode-fr-cnil-privacy-compliance)

Assess an organization's privacy compliance against French data protection law: the Loi Informatique et Libertés (LIL, Loi n°78-17 du 6 janvier 1978 modifiée), CNIL regulatory guidance, and GDPR as implemented in France.

Assess an organization's privacy compliance against French data protection law: the Loi Informatique et Libertés (LIL, Loi n°78-17 du 6 janvier 1978 modifiée), CNIL regulatory guidance, and GDPR as implemented in France. Covers CNIL cookie guidelines (2020/2022), France's 15-year digital age of consent, employee data and CSE consultation obligations, DPO designation and CNIL registration, mandatory DPIA (AIPD) list, data breach notification, processing register (Article 30), data subject rights, international transfers, and CNIL enforcement trends. Use when conducting a CNIL compliance assessment, preparing for a CNIL inspection (contrôle), auditing a privacy program in France, advising on French-specific GDPR derogations, reviewing cookie consent mechanisms for French audiences, assessing employee monitoring compliance under French labor law, or performing M&A privacy due diligence on a French entity. France-specific skill covering CNIL enforcement cases and administrative sanction procedure.

This skill assesses an organization's privacy compliance program against French data protection law, including GDPR as supplemented and modified by French national law. **Covers:** - Applicability of the Loi Informatique et Libertés (LIL) and GDPR in a French context - CNIL-specific requirements going beyond baseline GDPR - Cookie and tracker consent compliance (Article 82 LIL; CNIL Guidelines 2020) - France's digital age of consent (15 years — Article 7-1 LIL) - Employee data: monitoring, biometrics, geolocation, CSE consultation obligations - DPO designation and mandatory CNIL registration (Déclaration DPD) - DPIA/AIPD requirements: CNIL's mandatory processing list - Data breach notification to CNIL (72-hour rule; portal notifications.cnil.fr) - Processing register (Registre Article 30) — structure and content requirements - Data subject rights: the 8 GDPR rights plus French additions (droit au déréférencement, post-mortem directives, indirect access to sensitive government files) - International data transfers: SCCs, EU-US DPF, Transfer Impact Assessments - CNIL enforcement process: contrôles, mises en demeure, sanctions, formation restreinte - CNIL sectoral référentiels and binding Règlements-Types (biometrics, genetics, health data) - Commercial prospecting rules under French law (opt-in/opt-out rules; Bloctel registry) - AI and automated decision-making: Article 10 LIL; CNIL AI guidance series 2024-2026 **Does not:** - Provide general GDPR ...

## Jurisdictions

France



---
*Legalcode -- legalcode.md*