GDPR Compliance Reference & Code Audit Checklist

FRANCE / CNIL-Focused Edition

This skill provides foundational GDPR knowledge, actionable CNIL compliance requirements, and a concrete code-audit checklist for auditing data-protection compliance in French companies. Reference this alongside the gdpr-specialist agent when reviewing code or building data-processing features.

Jurisdiction: France (EU member state); primary authority = CNIL (Commission Nationale de l'Informatique et des Libertés). Supplementary French law: Loi n°2018-493 (Code de la Protection des Données Personnelles); French Penal Code (Art. 226-16 to 226-24).

Legal Disclaimer: This is informational guidance, not legal advice. For jurisdiction-specific requirements or contested interpretations, consult a DPO, legal counsel, or CNIL (Phone: +33 1 53 73 22 22; Web: https://www.cnil.fr/).

---

1. Applicability

GDPR applies to:

• Any organization (any size, any industry) established in France/EU OR targeting EU residents
• Processing of both computerized AND paper data
• Any personal data (Art. 4(1)): any information relating to an identified or identifiable natural person

French Supplementary Law:

• Loi Informatique et Libertés (Art. 82 onwards): cookie/tracker consent rules (stricter than GDPR baseline)
• French Penal Code (Art. 226-16 to 226-24): criminal penalties for unauthorized processing, failure to inform, misuse of personal data

---

2. Six Core GDPR Principles (Art. 5) + Accountability (Art. 5(2))

Principle	Requirement	Code Implication	Citation
Lawfulness (Art. 5(1)(a))	One of 6 legal bases required (Art. 6)	Document which basis applies to each processing; enforce authorization checks in code	gdpr-info.eu/art-5-gdpr
Fairness (Art. 5(1)(a))	Processing not deceptive/discriminatory	Audit ML models for bias; transparent data use	gdpr-info.eu/art-5-gdpr
Transparency (Art. 5(1)(a))	Inform data subjects of collection, purpose, rights	Implement privacy notices, consent dialogs, data-subject-rights endpoints	gdpr-info.eu/art-5-gdpr
Purpose Limitation (Art. 5(1)(b))	Data used only for stated purpose; repurposing needs fresh legal basis	Enforce audit logging; segregate use-case logic; don't share data across purposes without reconsent	gdpr-info.eu/art-5-gdpr
Data Minimization (Art. 5(1)(c))	Collect only strictly necessary data	Remove unused fields; set default to minimal; challenge every PII field added	gdpr-info.eu/art-5-gdpr
Accuracy (Art. 5(1)(d))	Keep data accurate & up-to-date	Provide rectification endpoint (PATCH /api/subject/data/{field}); flag stale data for user review	gdpr-info.eu/art-5-gdpr
Storage Limitation (Art. 5(1)(e))	Define retention periods upfront; delete when objective met	Implement TTL/retention schema in database; automated deletion jobs; cleanup migrations	gdpr-info.eu/art-5-gdpr
Integrity & Confidentiality (Art. 5(1)(f))	Proportional technical + organizational security measures	Encryption (TLS, at-rest), access control, logging, incident response, staff training	gdpr-info.eu/art-5-gdpr
Accountability (Art. 5(2))	Demonstrate compliance with all principles above	Maintain Register of Processing Activities (RoPA); conduct DPIAs; document legal bases; keep audit trails (code-enforceable via logging, retention schema comments, consent records)	gdpr-info.eu/art-5-gdpr

---

3. Six Legal Bases (Art. 6) — Pick One Per Processing

gdpr-info.eu/art-6-gdpr — Full legal bases reference.

Legal Basis	When to Use	Code Example	Consent Needed?	Notes
Consent (Art. 6(1)(a))	User explicitly opts in for a purpose	Marketing emails, non-essential cookies, secondary data use	YES — must be freely given, informed, unambiguous	Must be explicit affirmative action; inaction/scrolling is NOT consent
Contract (Art. 6(1)(b))	Processing necessary to perform a contract	User email for order fulfillment, payment processing, account management	NO (if truly necessary for contract performance)	Must be objectively necessary, not just convenient
Legal Obligation (Art. 6(1)(c))	Law requires processing	Tax records (7 years), payroll (per employment law), anti-money-laundering checks	NO	Document the legal requirement (Art. reference, law name)
Vital Interest (Art. 6(1)(d))	Protect someone's life or physical safety	Emergency contact during health crisis, lifeguard rescue coordination	NO (but rare in commercial context)	Narrowest basis; only when life/safety at immediate risk
Public Task (Art. 6(1)(e))	Government/public authority processing	Census, public health records	NO (if you are a public body)	Not applicable to private commercial entities
Legitimate Interest (Art. 6(1)(f))	Balancing test: your interest vs. subject's rights (only if contract/consent/obligation don't apply)	Fraud detection, direct marketing (with objection right), internal analytics, server security logs	Objection right required; may need consent in some cases (see EDPB 1/2024)	Most legally contested basis. Mandatory: document balancing test (LIA) showing (1) legitimate interest, (2) necessity, (3) balancing = your interest does not override data subject's rights/freedoms. EDPB Guidelines 1/2024

---

4. Sensitive Categories — Enhanced Protection (Art. 9)

gdpr-info.eu/art-9-gdpr

General Rule: Processing forbidden unless one of the exceptions applies.

Category	Examples	Exceptions	Code Safeguards
Racial/ethnic origin	Nationality, ancestry records	Explicit consent; legal claim; vital interest	✓ Tag as sensitive; encrypt at rest; log access
Political beliefs	Party affiliation, voting record, political donation	Explicit consent; member organizations	✓ Tag as sensitive; no automatic processing
Religious/philosophical beliefs	Religion, atheism, philosophy conviction	Explicit consent; member organizations	✓ Tag as sensitive; restricted access
Union membership	Employee union status, dues	Explicit consent; employment purposes (limited)	✓ Tag as sensitive; no share without consent
Sexual orientation	Sexual preference, LGBTQ+ status	Explicit consent; vital interest	✓ Tag as sensitive; never infer from behavior
Genetic data	DNA profiles, ancestry test results	Explicit consent; medical/research (special rules)	✓ Encrypt; access logs; separate storage
Biometric data (for ID)	Fingerprints, iris scans, face recognition	Explicit consent; law enforcement; medical; art. 9(2)(h) exceptions	✓ Encrypt; strict access control; purge after use
Health data	Medical records, prescriptions, diagnoses, vaccines, mental health	Explicit consent; medical provider; occupational health; legal obligation; vital interest	✓ Encrypt at rest; access logs; separate schema; purge after retention

Code implications:

• Tag sensitive-category columns in schema (comment: -- SENSITIVE: Art. 9 data, requires explicit consent)
• Encrypt all Art. 9 data at rest (pgcrypto, field-level, or transparent DB encryption)
• Restrict access via role-based control; log all reads
• Never share with 3rd parties without fresh explicit consent
• Document consent record (when consented, what for, can be revoked)
• Implement immediate deletion on withdrawal or consent expiry

---

5. Consent — The Gold Standard (Art. 7, Recital 32) + CNIL Cookie Rules

gdpr-info.eu/art-7-gdpr — GDPR consent rules.

Consent Requirements (MUST meet ALL)

Requirement	Details	Code Checklist
Free	No coercion; withdrawal as easy as granting; no conditional access to non-essential processing	✓ Unchecked-by-default checkbox; one-click unsubscribe link; no paywall for withdrawing consent
Informed	User knows: controller identity, purposes, data types, rights, transfer risks, withdrawal mechanism, how long kept	✓ Privacy notice at collection; clear checkbox label; link to policy visible before consent
Specific	Per purpose (e.g., separate consent for marketing vs. analytics vs. cookies)	✓ Separate checkboxes per purpose; document in consent DB
Unambiguous	Deliberate action (not silence/inaction); clear affirmative act	✓ Checked checkbox + button click; NOT pre-checked; NOT implied by scroll or continued browsing

Consent Prohibitions (MUST AVOID)

• ❌ Pre-checked boxes → Invalid consent; potential fine up to €7,500 (business)
• ❌ Silence/inaction → Scrolling past ≠ consent; continued browsing ≠ consent
• ❌ Bundled consent → "Accept all to continue" without granular choice → Invalid
• ❌ Forced consent → Conditioning service access on non-essential consent → Invalid
• ❌ Unequal ease of refusal → If refusing requires more clicks than accepting → Invalid (CNIL rule)

CNIL Cookies & Trackers (Art. 82 Loi Informatique et Libertés; CNIL Recommendation 2026-01)

Live source: CNIL Consolidated Recommendation on Cookies (2026-01) | CNIL Cookies FAQ

Core Rules:

1. Consent BEFORE any tracker read/write [CJEU Planet49 C-673/17; CNIL recommendation]

   • Consent = clear affirmative act (pre-ticked boxes prohibited; checkboxes UNCHECKED and sliders OFF by default)
   • Inaction, scrolling, or continued browsing = REFUSAL (not consent)
   • Controller must be able to PROVE valid consent at any time (consent proof obligation)

2. Refusal must be as EASY as acceptance [CNIL safe-harbor recommendation]

   • Both buttons on SAME screen; same visual prominence; same format
   • Recommended modality: "Tout accepter" button paired with "Tout refuser" button (equal visual weight)
   • Rejecting all trackers CANNOT require more clicks than accepting all
   • Violation: Accept-all = 1 click, Reject-all = 5 clicks → NON-COMPLIANT

3. Retaining user choice for ~6 MONTHS [CNIL good practice; case-by-case adaptable]

   • Store both consent AND refusal decisions for ~6 months before re-prompting
   • Document the retention rationale (avoid consent fatigue while maintaining fresh consent)
   • ⚠️ Verify current CNIL guidance: https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ (may evolve)

4. Exempt trackers (no consent required) [CNIL clarification]

   • Session/authentication cookies (necessary for the service to function)
   • Load-balancing cookies
   • Audience-measurement under CNIL-compliant conditions (anonymized, aggregated, no ID linking)
   • Document exemption reason in consent banner

5. Live enforcement (2025 trend)

   • Shein: €150M fine (cookie consent violations)
   • Google: €325M fine (cookie/tracker violations)
   • CNIL actively polices; fines increasing

Consent Withdrawal (Art. 7(3))

• User can withdraw "as easily as giving" consent (same method, typically one click)
• Withdrawal takes effect immediately (new processing stops; prior processing stays valid)
• Implement unsubscribe link, account preference toggle, cookie retraction UI

Code Example

// BAD: Pre-checked, bundled consent (GDPR + CNIL violation)
<input type="checkbox" name="marketing" checked /> Subscribe to marketing
<input type="checkbox" name="analytics" checked /> Allow analytics
<button>Agree & Continue</button>

// GOOD: Unchecked, granular, transparent, equal-ease rejection (GDPR + CNIL compliant)
<div class="consent-banner">
  <h2>Privacy & Consent</h2>
  <p>
    We use your email to send order confirmations and service updates
    (necessary for our contract). You can opt in to additional processing:
  </p>

  <div class="consent-options">
    <label>
      <input type="checkbox" name="marketing" />
      Yes, send me marketing emails
    </label>
    <label>
      <input type="checkbox" name="analytics" />
      Yes, analyze my behavior to improve service
    </label>
  </div>

  <p style="font-size: 0.9em;">
    <a href="/privacy-policy">View our privacy policy</a> |
    <a href="/data-subject-rights">Manage your preferences anytime</a>
  </p>

  <!-- EQUAL EASE: both buttons same visual weight -->
  <div style="display: flex; gap: 1em;">
    <button name="reject-all" type="button">Reject All</button>
    <button name="accept-all" type="button" style="font-weight: bold;">Accept Selected</button>
  </div>
</div>

<!-- PROOF: Store consent choice in DB with timestamp for audit -->
const consentRecord = {
  userId: user.id,
  choices: { marketing: false, analytics: true },
  timestamp: new Date(),
  ipAddress: req.ip,
  userAgent: req.get('User-Agent')
};
// Auditable: CNIL can ask "prove this user consented on [date]"

---

6. Data-Subject Rights (Art. 15-22) — Implement Endpoints

gdpr-info.eu/art-12-gdpr — Timeline & modalities.

Timeline: Respond within 1 MONTH of receipt; extendable by 2 further MONTHS for complexity or volume, BUT must inform the data subject of the extension + reasons within the initial 1 month. [Art. 12(3)]

Right	What They Get	Code Implementation	Timeline
Access (Art. 15)	Copy of their data; structured, machine-readable format (CSV/JSON/XML); logic/consequences of automated decisions	GET /api/v1/subject/data → JSON export; includes profile, activity logs, inferred categories/scores; no derived data (profiling) unless necessary	1 month (extendable +2)
Rectification (Art. 16)	Correct inaccurate/incomplete data	PATCH /api/v1/subject/data/{field} → update name, email, address; audit log the change; notify 3rd parties if shared	1 month
Erasure/"Right to be Forgotten" (Art. 17)	Delete when: no longer needed, consent withdrawn, unlawful processing, legal obligation, child's data	DELETE /api/v1/subject/data → soft-delete + archive for retention period; anonymize logs; hard-delete after retention expires	1 month
Portability (Art. 20)	Data in structured, commonly-used, machine-readable format (CSV/JSON/XML); automated processing only (not derived/inferred); direct controller-to-controller transfer where technically feasible	GET /api/v1/subject/export → include all user-declared data + activity-generated data; exclude derived profiling; support direct transfer API if recipient available	1 month
Objection (Art. 21)	Opt-out of legitimate-interest processing (solicitation, profiling, direct marketing); can withdraw consent to entire processing	POST /api/v1/subject/object → unchecked opt-in checkbox on profile; flag in DB; stop processing; notify 3rd parties	1 month
Restrict Processing (Art. 18)	Mark data "restricted" — no processing except storage/legal claims while accuracy/lawfulness disputed	POST /api/v1/subject/restrict → flag in DB; stop automated processing; resume on resolution	1 month
Complain to Authority	Right to lodge complaint with CNIL (France)	Post CNIL contact info prominently in privacy policy: https://www.cnil.fr/	N/A

Code Checklist:

• /api/subject/access endpoint authenticated, rate-limited; returns CSV/JSON export of all their data (profile + logs + inferences)
• /api/subject/rectify/{field} allows updating profile fields; logs change with timestamp + user ID
• /api/subject/delete removes PII; anonymizes activity logs; soft-delete records; purges after retention period
• /api/subject/export exports in portable format (JSON/CSV); structured, machine-readable; no paywalls
• /api/subject/object opts out of legitimate-interest processing; flags in consent DB; stops processing
• All endpoints authenticated (no info disclosure) & rate-limited (prevent abuse)
• Requests logged (who asked, when, result, whether granted/denied)
• Responses within 1 month; deny manifestly abusive requests (same user repeatedly); document reasons for delay

---

7. Transparency & Privacy Notice (Art. 14)

gdpr-info.eu/art-14-gdpr

Required at Direct Collection:

• Controller identity (company name, address, phone, email)
• DPO contact (if applicable)
• Purpose of processing (what you'll do with the data)
• Legal basis (Art. 6 choice: consent, contract, legal obligation, etc.)
• Compulsory vs. optional fields + consequences
• Recipients (internal teams, processors, 3rd parties)
• Retention period (how long you keep it)
• Data-subject rights (access, delete, portability, object)
• Right to lodge complaint with CNIL
• Existence of non-EU transfers (and safeguards)

Requirements:

• Concise, transparent, understandable language (no jargon, no legalese)
• Clearly titled ("Privacy Policy" or "Data Collection Notice")
• Easily accessible (prominent link on website)

---

8. Register of Processing Activities (ROPA) (Art. 30)

gdpr-info.eu/art-30-gdpr

Who Must Keep:

• Companies <250 employees: only if processing is non-occasional (payroll, customer management) OR risky (geolocation, video surveillance) OR involves sensitive/criminal data
• Companies ≥250 employees: always mandatory
• All processors must keep one too

Keep a ROPA.md or ropa.json in your repo documenting each processing activity:

{
  "processing_activities": [
    {
      "name": "Customer CRM",
      "legal_basis": "Contract (Art. 6(1)(b))",
      "data_categories": ["name", "email", "phone", "company"],
      "data_subject_categories": ["customers", "prospects"],
      "purposes": ["order fulfillment", "customer service"],
      "retention": "3 years after last order",
      "security_measures": "TLS in-transit; AES-256 at-rest; access logs; MFA on admin console",
      "recipients": ["internal sales team", "payment processor (Stripe — DPA signed 2025-01-15)"],
      "non_eu_transfers": "Stripe (US) — SCCs in place (v2021-03); supplementary measures: encryption; legal analysis: https://stripe.com/docs/security/legal"
    }
  ]
}

---

9. Data Protection Officer (DPO) Appointment (Art. 37)

gdpr-info.eu/art-37-gdpr

Mandatory when:

1. Regular & systematic large-scale monitoring (geolocation, video surveillance, behavioral profiling)
2. Large-scale processing of sensitive/criminal data (health, biometric, genetic, criminal records)

Options:

• Internal DPO (full-time or part-time employee)
• External DPO (consultant, law firm, DPO service)
• CNIL certification available (voluntary; adds credibility)

Notify CNIL: If you appoint a DPO, submit notification via https://www.cnil.fr/

---

10. Data Security & Technical Measures (Art. 32 + CNIL Guidance)

gdpr-info.eu/art-32-gdpr — GDPR security framework.

CNIL Security Guide (2024): Guide de la Sécurité des Données Personnelles

Password Entropy Tiers (CNIL 2024 Recommendation)

Source: CNIL 2024 Security Guide

Tier	Entropy Requirement	Examples	Additional Measures	Use Case
HIGH	≥80 bits	12 chars (upper/lower/digit/special) OR 14 chars (upper/lower/digit)	No additional required	Standard authentication (passwords)
MEDIUM	≥50 bits	8 chars (3+ character types) OR 16 digits	Access temporisation; CAPTCHA; account block after 10 failed attempts	Admin accounts; sensitive functions
LOW	≥13 bits	4-digit PIN	Lockout after 3 failed attempts; hardware-bound (SIM, certificate)	User-held hardware only (phone PIN, card PIN)

Code Example:

// Validate password entropy at registration
const validatePassword = (password) => {
  // HIGH: 12+ chars with complexity
  if (password.length >= 12 && /[A-Z]/.test(password) && /[a-z]/.test(password) && /\d/.test(password) && /[!@#$%^&*]/.test(password)) {
    return { valid: true, tier: 'HIGH' };
  }
  // MEDIUM: 8+ chars with 3 types
  if (password.length >= 8 && [/[A-Z]/.test(password), /[a-z]/.test(password), /\d/.test(password)].filter(Boolean).length >= 3) {
    return { valid: true, tier: 'MEDIUM', requires_temporisation: true };
  }
  return { valid: false };
};

// Hash with bcrypt (PBKDF2, Argon2 also acceptable)
const hashed = await bcrypt.hash(password, 12); // cost factor 12

Core Technical Measures

Control	Requirement	Code Checklist
Authentication	Unique per-user ID; no shared accounts; strong passwords per entropy tier	✓ bcrypt/Argon2 hashing; JWT expiry; MFA optional (TOTP/SMS)
Authorization	Role-based access; least-privilege principle	✓ Role checks on every endpoint; user cannot access other users' data
Access Control	IMMEDIATE removal on role change/exit; annual reviews	✓ Audit log all access; disable account on termination; script to enforce
Session Management	Auto-lock timeout; secure cookies (HttpOnly, Secure, SameSite)	✓ 15-min idle timeout; HttpOnly + Secure flags set
Logging	User activity, interventions, anomalies, security events; IMMEDIATE incident notification	✓ Log all writes; log failed auth attempts (NO passwords); anomaly alert (10+ failed logins)
Encryption in Transit	TLS 1.2+ enforced; no unencrypted HTTP	✓ HTTPS enforced; HSTS header set; no mixed content
Encryption at Rest	Sensitive data (PII, health, payment) encrypted	✓ pgcrypto for PostgreSQL; field-level encryption for medical data; encrypted backups

CNIL Logging/Journalisation (Recommendation)

CNIL Logging Recommendation

Mandatory Logging:

• Access to personal-data processing (read, create, modify, delete)
• Log entries include: user identifier, timestamp, equipment ID, action (CREATE/UPDATE/DELETE)

Retention:

• Standard operational logs: 6 MONTHS to 1 YEAR (CNIL typical)
• Internal-control audit logs: up to ~3 YEARS (case-by-case)
• ⚠️ Verify retention with CNIL (https://www.cnil.fr/fr/la-cnil-publie-une-recommandation-relative-aux-mesures-de-journalisation) — retention periods may vary by use case

Risk Mitigation:

• Long-term log retention itself creates a risk (illegitimate access to logs)
• Implement access control on logs (role-based; audit log access to logs)
• Provide anomaly-detection analysis for short-term exploitation/incident detection

---

11. Processor / Subcontractor Contracts (Art. 28)

gdpr-info.eu/art-28-gdpr

Who is a Processor?

• Cloud provider (AWS, Azure, GCP)
• Payment processor (Stripe, PayPal)
• Analytics vendor (Google Analytics, Mixpanel)
• Email service (SendGrid, Mailchimp)
• CRM (Salesforce, HubSpot)

Contract Requirements:

• Written Data Processing Agreement (DPA)
• Define: purpose, nature, duration, data categories, subject categories
• Processor obligated to: act only on instructions, ensure adequate security, advise if law violated, assist with data-subject rights