What Is GDPR + Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés?
France was an early adopter of a national data-protection statute: the Loi Informatique et Libertés of 6 January 1978, which created the CNIL. Since 2018 that law operates as the national supplement to the EU GDPR: the GDPR provides the core rules and the French law fills the gaps left by GDPR opening clauses, including the age of digital consent and selected national rules. The CNIL publishes current enforcement actions and sanction decisions; amounts and case status should be checked in the latest official record. For data brokers, a key French rule is the free right to object to direct marketing: when a person objects to processing for that purpose, the controller must stop that marketing processing, subject to the applicable legal framework. From 11 August 2026, the former Bloctel opposition system ended and covered consumer telephone prospecting generally requires prior consent, with exceptions including calls related to an ongoing contract and journal, periodical, or magazine offers; current CNIL, DGCCRF, and Légifrance materials control the details.
At a glance
- Full name
- GDPR + Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
- Short code
- Loi Informatique et Libertés
- Jurisdiction
- France
- Enacted
- 1978
- Last major update
- Realigned with the EU GDPR in 2018-2019; consumer telephone-prospecting consent regime effective 11 August 2026
- Regulator
- Commission Nationale de l'Informatique et des Libertés (CNIL)
- Private right of action
- Yes
- Statutory citation
- Loi n° 78-17 du 6 janvier 1978 + Règlement (UE) 2016/679
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
Chart by OfflistMe · offlist.me
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés (highlighted) |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: Loi Informatique et Libertés statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who Loi Informatique et Libertés covers
Protected data
Data subject rights
Right of access (Article 15): obtain a copy of your data
Right to rectification (Article 16)
Right to erasure / right to be forgotten (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object: absolute and free for direct marketing/prospecting (Article 21)
Right to give post-mortem directives on your personal data (French-specific)
Right to lodge a complaint with the CNIL (Article 77)
Notable features
France combines a longstanding national privacy statute with the EU GDPR. Distinctive features include the free direct-marketing objection, the post-11 August 2026 prior-consent framework for covered telephone prospecting, the age of digital consent set at 15, and statutory post-mortem data directives. CNIL guidance also makes clear that publicly accessible online data is not automatically free to reuse for marketing; transparency, lawful basis, and objection rights still matter.
Enforcement & penalties
Regulator: Commission Nationale de l'Informatique et des Libertés (CNIL)
Penalties: GDPR two-tier fines: up to €10M or 2% of global turnover (lower tier) and up to €20M or 4% of global turnover (higher tier), whichever is greater. The CNIL also publishes administrative sanctions and corrective measures; do not treat a historical total or individual case amount as a current annual total without checking the latest CNIL record.
Private right of action: Under GDPR Article 82, individuals can claim compensation for material or non-material damage before the French civil courts. Collective ('class') actions are available under French law (action de groupe) for data-protection breaches, brought by approved consumer associations.
Relevance to data brokers
Data brokers ('courtiers de données') may be controllers under GDPR and must identify a lawful basis. A person can object to direct marketing, and the controller must stop that purpose-specific processing when the objection applies. French residents can use the current telephone-prospecting consent rules, GDPR access/erasure/objection routes, and CNIL complaints; downstream disclosure and notification duties depend on the processing and the applicable GDPR provisions.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Who enforces data privacy in France?+
The CNIL (Commission Nationale de l'Informatique et des Libertés), which enforces both the EU GDPR and France's 1978 Loi Informatique et Libertés. Check the CNIL's current sanctions and corrective-measures pages for published enforcement figures and case status.
How do I stop telemarketing calls in France?+
Bloctel ended on 11 August 2026. Covered consumer telephone prospecting generally requires prior consent, subject to exceptions such as certain ongoing-contract calls and journal, periodical, or magazine offers; current official guidance also distinguishes non-commercial and professional calls. Check DGCCRF or CNIL instructions for the applicable exception and complaint route.
Can data brokers legally sell my data in France?+
Only with a valid lawful basis under GDPR and any applicable national rules. You have a free right to object to direct marketing, and the controller must stop that purpose-specific processing when the objection applies. Other uses, disclosures, and downstream obligations require a separate assessment.
How long does a French company have to answer a data request?+
Usually one month from receipt, extendable by up to two further months for complex requests when the controller gives the required notice. If the controller does not handle the request appropriately, you can use the current CNIL complaint route; do not treat a three-month complaint-handling statement as a universal deadline for every case.
Official sources & citations
- Loi Informatique et Libertés (Légifrance)
- CNIL: file a complaint
- CNIL: sanctions and corrective measures 2025
- CNIL: reuse of publicly accessible data for marketing
- CNIL: current commercial telephone-prospecting rules
- DGCCRF: telephone solicitation consent rules from 11 August 2026
- Légifrance: Consumer Code telephone-prospecting chapter
- Légifrance: Decree 2026-662 on telephone consent
Other international privacy regimes
Loi Informatique et Libertés sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: