Law No. 2013-450 on the Protection of Personal Data

Article 2 states the Act's purpose as governing the protection of personal data, and article 3 subjects to it any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private corporation, whether the processing is automated or not, excluding under article 4 only an individual's strictly personal or household processing and a network operator's temporary technical copies.

Article 5 makes ordinary processing subject to a prior declaration to ARTCI as the Autorité de Protection, and article 6 lets the declaration be replaced by an internal correspondent for most processing, though never before a cross-border transfer. Article 7 also requires the Authority's prior authorization before processing on a national identification number or a data set of public-interest research value.

Article 9 lists what a declaration or an application for authorization must contain, including the identity of the person responsible, the purpose, the categories of data and their origin, the retention period, the recipients, the office where access is exercised, the security measures planned, and any subcontractor or cross-border transfer, and article 11 gives the Authority one month, extendable by a further month, to decide, with silence read as a rejection open to appeal.

Article 12 lets the person responsible designate a correspondent for the protection of personal data to oversee compliance independently.

Article 14 makes processing legitimate where the person concerned gives express consent, subject to listed exceptions for a legal obligation, a public-interest task, a contract, or the person's vital interests, and articles 15 to 20 require processing to be lawful and fair, limited to specified and legitimate purposes, kept no longer than those purposes require, accurate, transparent, confidential, and carried out through a subcontractor who gives sufficient guarantees.

Article 22 prohibits direct marketing using a person's personal data without their consent. Article 27 authorizes the interconnection of files only for a legitimate purpose and bars it from causing discrimination or a reduction of rights.

Articles 39 to 41 require the processing to stay confidential, require precautions against distortion, damage or unauthorized access, and list the technical safeguards to install, including preventing unauthorized access to the installations and to the data, guarding against use for money laundering or terrorist financing, and keeping backup copies.

Article 42 requires an annual compliance report to the Authority, article 43 sets the retention period by reference to the Authority's rules for the type of processing, and article 44 requires the data to remain exploitable regardless of the support used. The Act states no separate data-breach notification duty running to the Authority or to the persons affected.