France released a revised draft bill to transpose the EU Pay Transparency Directive into national law, retaining stricter thresholds such as pay gap reporting for companies with 50+ employees (vs. the Directive's 100). The bill introduces mandatory starting pay ranges in job ads, bans on salary history questions and non-disclosure clauses, a two-month employer response time for individual pay requests, and a 5% pay gap threshold triggering corrective measures. Companies operating in France should prepare for these requirements, though the bill remains subject to further regulatory clarification.
France's mandatory e-invoicing reform requires all businesses to receive e-invoices from September 1, 2026, with large and mid-sized firms also issuing them; all companies including SMEs must issue and receive by September 1, 2027. The CNIL has issued GDPR guidance clarifying data minimization, controller/processor roles, and restrictions on sensitive data in invoice fields, requiring companies to adapt their invoicing processes and platform integrations.
France's e-invoicing and e-reporting reform took effect on September 1, 2026, requiring all affected businesses to be able to receive electronic invoices, while large and mid-sized companies (ETIs) must also issue e-invoices and submit transaction/payment data. SMEs and microenterprises must comply by September 1, 2027, but are already impacted as receivers. The framework shifts from PDP to PA (Plateforme Agréée), with the PPF as the state portal.
The French DPA imposed a €300,000 fine on EXTIA for failing to process erasure requests, highlighting enforcement of GDPR Articles 12 and 17. Companies must ensure timely and transparent handling of data subject requests to avoid similar penalties.
The CNIL's upcoming plenary session will examine draft opinions on law enforcement data systems and an article of the DDADUE bill adapting French law to EU Regulation 2025/2518, which adds procedural rules for GDPR enforcement. It will also grant unique authorizations for access to national health data, signaling ongoing regulatory activity in data protection.
France's CNIL fined Hôpital privé de la Loire €500,000 for GDPR violations after a data breach exposed data of 727,113 individuals. The enforcement highlights the need for robust access controls, MFA, and monitoring in healthcare.
The French data protection authority (CNIL) imposed a €500,000 fine on HÔPITAL PRIVÉ DE LA LOIRE for inadequate security measures leading to a data breach affecting over 700,000 individuals. The enforcement action signals increased scrutiny of healthcare data security and breach notification obligations under GDPR.
France is drafting legislation to transpose the EU Pay Transparency Directive, maintaining a 50-employee reporting threshold (stricter than the Directive's 100) and replacing the Index Egapro with a new framework. The law will phase in between late 2026 and January 2028, with fines up to 1% of payroll for non-compliance.
The CNIL published a recommendation in May 2026 on credit solvency assessment, emphasizing GDPR compliance for AI and statistical models. Lenders must ensure transparency, non-discrimination, and consumer rights when using AI for credit scoring.
France's e-invoicing mandate takes effect on September 1, 2026, requiring all businesses to receive e-invoices and large/mid-sized companies to issue them. The French Ministry of Finance has announced a penalty tolerance for companies demonstrating genuine implementation difficulties, but this is not a grace period; companies must show active preparation to qualify.
The CNIL has updated its reference methodologies MR-001 and MR-003, which govern health research data processing. The updates expand scope to include international studies, digital information modalities, and remote quality control, and introduce new annexes and compliance grids. Organizations conducting health research in France must align with the revised methodologies by 2026.
A Paris Judicial Court ruled that TotalEnergies must address climate risks from Scope 3 emissions under France's duty of vigilance law. This sets a precedent for companies to include end-use emissions in their vigilance plans, increasing legal exposure for climate-related litigation.
The CNIL published recommendations on tracking pixels in emails and held a webinar on June 4, 2026, for service providers. Companies using email marketing must ensure compliance with data protection obligations regarding tracking pixels.
France has passed a law banning social media access for children under 15, with new accounts affected from September 1, 2026, and existing accounts from January 2027. Age verification methods must be approved by France's privacy regulator. Companies operating social media platforms in France must prepare for compliance.
The CNIL published a Q&A clarifying its recommendation on tracking pixels in emails, emphasizing consent requirements under Article 82 of the French Data Protection Act and GDPR. The guidance applies to all emails, including internal communications, and the CNIL can enforce against non-French entities affecting French data subjects.
The French CNIL will review several draft deliberations on July 21, 2026, including authorizations for data processing systems (CLEM, LIVE LCTI), modifications to the SICAP poison control system, and approval of accreditation and certification frameworks for hosting personal health data. These actions signal upcoming regulatory changes under French GDPR implementation and health data protection.
France's gambling regulator ANJ ordered internet service providers to block Polymarket, classifying it as an illegal gambling site. This enforcement action signals increased scrutiny on prediction markets and may require companies to reassess compliance with French gambling laws.
The CNIL has launched a new version of its online authorization request service for health and research data processing, integrating recent legal changes and simplifying the application process. Companies handling health data in France must use the updated form and prepare for reduced processing times.
The French CNIL has imposed 23 simplified procedure sanctions since January 2026, totaling €133,750 in fines, for violations including excessive video surveillance, non-compliant cookie banners, and failure to respond to data subject rights requests. This signals increased enforcement of GDPR and French data protection law.
The French National Gaming Authority (ANJ) and CNIL jointly published a guide on applying GDPR to player data processing in the gambling sector. It covers account management, excessive gambling prevention, and anti-money laundering, specifying data retention periods and emphasizing data minimization.