France: Compliance

Le Comité européen de la protection des données a adopté un projet de nouvelles lignes directrices relatives à l'anonymisation, visant à moderniser l'avis 05/2014 du Groupe de travail Article 29. Ces lignes directrices proposent un cadre d'évaluation reposant sur trois critères cumulatifs et font l'objet d'une consultation publique jusqu'au 30 octobre 2026.

The European Data Protection Board has released draft guidelines that fundamentally reshape how organizations must evaluate data anonymization, introducing a dual-framework approach that accounts for varying entity capabilities and technological landscapes. These new standards update decade-old guidance and incorporate recent court rulings that recognize anonymization as context-dependent, potentially requiring different assessments for different data processors.

As digital tools blur the boundaries between work and personal time, jurisdictions worldwide are introducing measures to protect employees' rest periods. France, Australia, and Colombia have each adopted distinct approaches to the right to disconnect, ranging from mandatory employer policies to employee-driven protections against unreasonable out-of-hours contact.

The French Competition Authority has opened a public consultation to evaluate its two-year-old informal guidance framework that helps organizations determine whether their sustainability initiatives comply with competition law. Since its introduction in May 2024, the framework has issued five guidance letters covering diverse environmental projects, from carbon footprint platforms to retail sector sustainability commitments.

France's Office for Foreign Investment (IEF) has released its 2025 guidance on foreign direct investment screening, revealing key procedural changes and clarifications on sector-specific requirements. With the EU's Revised FDI Screening Regulation set to take effect in 2027, investors face new timelines, expanded mandatory screening sectors, and stricter compliance obligations that will fundamentally reshape cross-border transaction planning.

L’idée selon laquelle la protection des données personnelles serait une simple formalité juridique dont les prestataires informatiques pourraient faire fi dans le cadre de leurs travaux doit définitivement être abandonnée.

In September 2025, France's data protection authority (the CNIL) raided the digital cookie jar handing down hefty financial penalties to tech giant Google and fast-fashion powerhouse Shein.

Entrée en vigueur le 2 juillet 2025, la loi n° 2025-594 du 30 juin 2025 a doté la DGCCRF de prérogatives inédites, lui conférant des pouvoirs d'enquête élargis...

En août 2023, la CNIL a contrôlé le site web « shein.com », et a constaté des manquements aux obligations relatives aux traceurs.