Duty LXD-0924
Processes personal data, in France
Loi Informatique et Libertés, GDPR-Aligned Comprehensive Regime (Data Processing, Data Files and Individual Liberties Act)since 1 line
Loi n. 78-17 du 6 janvier 1978 relative a l'informatique, aux fichiers et aux libertes, as amended (JORFTEXT000000886460) · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in France, and follow Loi 78-17 Article 6's cross-reference to GDPR Article 9 for any special-category data.
CNIL Enforcement, GDPR Article 83 and Code Pénal Articles 226-16 to 226-22-2since 1 line
Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2 · Read the law's page
- Compensate any person in France who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
GDPR Articles 12-21 and Loi 78-17 Article 49, Data Subject Rights in Francesince 2 lines
Regulation (EU) 2016/679, Arts. 12-21; Loi n. 78-17 du 6 janvier 1978, Art. 49 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in France within one month of receipt.
- You need not give a person in France access to personal data you keep in a form that manifestly excludes any risk to their privacy, for no longer than necessary, solely to produce statistics or for scientific or historical research, under Loi n. 78-17 Article 49.
GDPR Articles 33-34, Breach Notificationsince 2 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify the CNIL without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in France, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
GDPR Chapter V, Cross-Border Transfer Restrictionssince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in France outside the EEA.
CNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)since 2 lines
CNIL Deliberation n. 2019-001 du 10 janvier 2019 portant reglement type relatif a la mise en oeuvre de dispositifs de controle d'acces biometrique · Read the law's page
- Run a data protection impact assessment and document why a less intrusive alternative was rejected before deploying a biometric access-control system for employees or building access in France.
- Do not rely on employee consent alone as the legal basis for a workplace biometric system; use a legal-obligation or legitimate-interest basis, or pair consent with a genuinely equivalent non-biometric alternative.