You set up your company in France from London, New York or Dubai, the Kbis (the official company identity certificate issued by the greffe, the registry office of the commercial court) is in your inbox, and business starts: a French website collecting customer emails, an online shop, a first employee in Paris whose hours you track with software. Nothing looks dangerous, yet every one of these steps processes personal data under French law, and the French data protection authority watches foreign-run companies exactly as closely as domestic ones. The CNIL (Commission nationale de l’informatique et des libertés, the independent French authority that enforces data protection rules) can walk into your Paris office, audit your files remotely, order you to change everything within weeks and fine your company up to millions of euros. In one recent case published on its own website, it fined a company 3.5 million euros for transferring user data to a social network for advertising without a valid legal basis, without properly informing people, without guaranteeing security, without any impact assessment and with unlawful cookies. This guide explains, in plain English and from abroad, what the GDPR (General Data Protection Regulation, the European Union regulation on personal data, called RGPD in French) and French law require from your French company before anything goes wrong, what happens when the CNIL starts a control or issues a fine, how criminal and employment courts can punish the same facts, and how you challenge each decision step by step. Every French acronym is explained as it appears, and every decisive rule is quoted word for word from the official text.

I. What French data law requires from your company before any dispute arises

A. How do I collect customer data lawfully on my French website and in my shop?

As soon as your French company collects names, email addresses, phone numbers, purchase histories, IP addresses or any information relating to an identified or identifiable person, it becomes a responsable de traitement (data controller, the entity that decides why and how personal data is processed). That status applies whether you live in Paris or run everything from abroad, and whether the data sits on a server in France, Ireland or the United States. Your first duty is to have a legal basis for each processing operation. Under Article 6 of the GDPR, the serious options for a business are the performance of a contract (processing an order, delivering goods), compliance with a legal obligation (invoicing records), your legitimate interest (fraud prevention, strictly necessary audience measurement) and the consent of the person (newsletters, non-essential cookies, advertising transfers). The CNIL decision fining a company 3.5 million euros for sending user data to a social network for advertising purposes is a textbook warning: the authority found there was no valid legal basis for that transfer, and it punished the company on that ground first, before examining anything else. If you share customer data with an advertising partner, a social network or any third party outside your company, identify the exact legal basis in writing before the first transfer, because after the control starts it is too late.

Your second duty is information. Every person whose data you collect must be told who you are, why you process the data, who receives it, how long you keep it and which rights they hold: access, rectification, erasure, objection and portability. In the same 3.5 million euro case, the CNIL sanctioned a separate breach of the duty to inform under Articles 12 and 13 of the GDPR, which shows that a missing or vague privacy notice is not a formality but an independent ground for a fine. Publish a complete notice on your French website, in French, and give the same information on paper or by email in your shop. Keep proof of the date on which each version went online, because the CNIL checks what visitors actually saw, not what you intended to show.

Your third duty is security, and it is the one foreign founders underestimate most. The CNIL punished a breach of the security obligation under Article 32 of the GDPR in that same case, and French criminal law adds its own layer. Article 226-18 of the French Criminal Code provides that “Le fait de collecter des données à caractère personnel par un moyen frauduleux, déloyal ou illicite est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” Scraping email addresses from websites, buying prospect files of dubious origin, or continuing to use a database after an objection are the typical patterns that turn a commercial shortcut into a criminal offence. Use strong access controls, encrypt backups, limit administrator accounts, log access to customer files and delete data when the retention period expires. If you disclose customer data to someone who has no right to receive it, and that disclosure harms the reputation of the person concerned or intrudes on their private life, Article 226-22 of the Criminal Code provides that “Le fait, par toute personne qui a recueilli, à l’occasion de leur enregistrement, de leur classement, de leur transmission ou d’une autre forme de traitement, des données à caractère personnel dont la divulgation aurait pour effet de porter atteinte à la considération de l’intéressé ou à l’intimité de sa vie privée, de porter, sans autorisation de l’intéressé, ces données à la connaissance d’un tiers qui n’a pas qualité pour les recevoir est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” A single forwarded spreadsheet can therefore cost a prison sentence in theory, which is why access rights inside your team must be documented from day one.

Your fourth duty concerns cookies and trackers. On a French website, depositing or reading a non-essential cookie requires the prior consent of the visitor, and advertising and audience-measurement cookies shared with third parties need a clear accept-or-refuse choice with no pre-ticked boxes. The CNIL listed the breach of the cookie rules under Article 82 of the French Data Protection Act among the grounds for its 3.5 million euro fine, and cookie sweeps are one of its favourite remote controls because they require no visit: the authority simply browses your site from its Paris offices. Configure your consent banner before launch, keep the consent logs, and re-check the banner after every redesign, because marketing agencies frequently reinstall trackers without telling you.

Your fifth duty is documentation. Maintain a processing register (registre des traitements) describing each activity, appoint a DPO (data protection officer, délégué à la protection des données in French) when your core activity involves large-scale monitoring or sensitive data, and run a DPIA (data protection impact assessment, analyse d’impact in French) before any risky processing such as large-scale scoring, biometric identification or systematic surveillance. In the 3.5 million euro case the CNIL punished the absence of any impact assessment under Article 35 of the GDPR as a standalone breach, so the assessment is not optional paperwork: its absence increases the fine. A foreign founder who keeps the register, the notices, the consent logs and the impact assessments in one file answers a CNIL questionnaire in days instead of weeks, and that speed changes the tone of the whole procedure.

B. Can I monitor my first French employees with cameras, GPS trackers or software?

Hiring your first employee in France changes the data rules completely, because employment law adds strict conditions on top of the GDPR. The principle comes first and it is broad. Article L1121-1 of the French Labour Code states that “Nul ne peut apporter aux droits des personnes et aux libertés individuelles et collectives de restrictions qui ne seraient pas justifiées par la nature de la tâche à accomplir ni proportionnées au but recherché.” Every camera, badge reader, keylogger, vehicle tracker or productivity score must therefore pass two tests: the restriction must be justified by the nature of the task, and it must remain proportionate to the aim. A camera that films the cash desk to prevent theft can pass; the same camera pointed permanently at one employee’s screen to measure keystrokes will struggle. Before buying any tool, write down the precise purpose, check whether a less intrusive method reaches the same result, and keep that comparison: judges ask for it, as the cases below show.

The second rule is prior information of each employee. Article L1222-4 of the Labour Code provides that “Aucune information concernant personnellement un salarié ne peut être collectée par un dispositif qui n’a pas été porté préalablement à sa connaissance.” Informing means telling the employee, before the device is switched on, that the system exists, what it records and for which purpose. A note pinned on the wall after the cameras are installed does not count, and a generic line in the employment contract rarely suffices for a new intrusive tool. Article L1222-3 of the same Code adds, for evaluation methods, that “Le salarié est expressément informé, préalablement à leur mise en oeuvre, des méthodes et techniques d’évaluation professionnelles mises en oeuvre à son égard. Les résultats obtenus sont confidentiels. Les méthodes et techniques d’évaluation des salariés doivent être pertinentes au regard de la finalité poursuivie.” Scoring software, performance dashboards fed by monitoring data and algorithmic rankings are evaluation methods, so they need that express prior information too, and their results stay confidential.

The third rule concerns the staff representatives. As soon as your company reaches eleven employees you must organise elections for the CSE (comité social et économique, the elected staff committee), but information and consultation duties on monitoring apply to the representatives wherever they exist. Article L2312-38 of the Labour Code provides that “Le comité social et économique est informé, préalablement à leur utilisation, sur les méthodes ou techniques d’aide au recrutement des candidats à un emploi ainsi que sur toute modification de celles-ci. Il est aussi informé, préalablement à leur introduction dans l’entreprise, sur les traitements automatisés de gestion du personnel et sur toute modification de ceux-ci. Le comité est informé et consulté, préalablement à la décision de mise en œuvre dans l’entreprise, sur les moyens ou les techniques permettant un contrôle de l’activité des salariés.” Recruitment software with automated sorting, HR databases and any tool that controls activity therefore need a formal step with the committee before rollout. With fewer than eleven employees and no committee, keep the individual information in writing and keep the delivery receipts: from abroad, email with acknowledgement of receipt is your proof.

The case law shows what these texts cost in practice. In a judgment of 10 November 2021 (appeal no. 20-12.263), the Social Chamber of the Court of Cassation dealt with a pharmacy that had installed video surveillance for security and then used the recordings to dismiss a cashier for serious misconduct. The Court held that the employer should have informed the employees and consulted the staff committee about using the security system to monitor them, ruling that “l’employeur aurait dû informer les salariés et consulter le comité d’entreprise sur l’utilisation de ce dispositif à cette fin et qu’à défaut, ce moyen de preuve tiré des enregistrements de la salariée était illicite”. The lesson for a foreign founder is direct: a camera installed for safety becomes unlawful evidence the moment you use it to watch work without the required prior steps, and the dismissal built on those recordings collapses. If you plan to end a trial period or dismiss for misconduct, read first how French courts judge the evidence, because a file full of screenshots can be thrown out while the employee stays protected; our companion guide on ending the trial period and dismissing lawfully explains which proof labour courts actually accept and how severance is computed when you live abroad (ending the trial period and dismissing a first hire from abroad).

Geolocation is even stricter. In a judgment of 19 December 2018 (appeal no. 17-14.631), the same Social Chamber ruled on a parcel company whose distributors carried a box recording their position every ten seconds. The Court stated that “l’utilisation d’un système de géolocalisation pour assurer le contrôle de la durée du travail, laquelle n’est licite que lorsque ce contrôle ne peut pas être fait par un autre moyen, fût -il moins efficace que la géolocalisation, n’est pas justifiée lorsque le salarié dispose d’une liberté dans l’organisation de son travail”, and it quashed the appeal decision because the lower court had ruled “sans caractériser que le système de géolocalisation mis en oeuvre par l’employeur était le seul moyen permettant d’assurer le contrôle de la durée du travail de ses salariés, la cour d’appel n’a pas donné de base légale à sa décision”. Tracking delivery drivers, sales representatives or technicians by GPS to check their hours is therefore lawful only when no other method works, even a less efficient one, and never when the employee organises their own rounds freely. Time sheets, electronic clocking without location, or customer-signed visit reports will usually defeat the GPS option, and overtime disputes make this documentation decisive: our guide on the 35-hour week and overtime proof shows exactly which time records the labour courts demand from a foreign employer (overtime, pay rates and time records for a first French hire).

II. What happens when the CNIL, the criminal courts or the labour courts get involved

A. The CNIL wants to control or fine my company: what is the procedure and how do I defend myself from abroad?

A CNIL case usually starts quietly: an online complaint from a customer or employee, a press article, a cookie sweep, or your company appearing in a themed inspection wave. The CNIL then sends a questionnaire or arrives for an on-site inspection (contrôle sur place) at your French premises, and it can also audit remotely (contrôle en ligne) by browsing your website, testing your forms and recording cookie behaviour. From abroad, organise the response immediately: appoint one person in France who receives the letters, gathers the register, the notices, the consent logs and the IT documentation, and answers within the stated deadlines. Silence or late replies never stop the procedure; they only remove your version of the facts from the file.

If the inspection reveals breaches, the CNIL chair can issue a formal notice (mise en demeure) ordering you to comply within a set period, often three months. This is the decisive moment to reduce the final bill: execute the order seriously, document every fix with dates and screenshots, and report back before expiry. When the breaches persist or are serious from the start, the file goes to the restricted committee (formation restreinte), the CNIL’s sanctioning body, which hears your observations in an adversarial procedure and can impose several measures cumulatively: an injunction to comply under a daily penalty (astreinte), a public or non-public fine, and a call to order. Fines under the GDPR can reach 20 million euros or 4 percent of worldwide annual turnover for the most serious breaches, and the 3.5 million euro fine for the advertising data transfer shows that the CNIL uses the upper range against companies, not only against tech giants. Proportionality, cooperation, the number of people affected and the duration of the breach all weigh in the amount, which is why the compliance file you built in Part I becomes your best mitigation evidence.

Challenging a CNIL sanction from abroad follows a clear path. The sanction can be appealed to the Conseil d’État (the supreme administrative court in Paris, which hears direct appeals against CNIL sanctions), within two months of notification. The appeal examines both the procedure and the substance: unlawful evidence gathering, breach of adversarial rights, wrong legal basis, disproportionate amount. A parallel request to suspend the sanction (référé-suspension) can freeze a public shaming measure or an injunction while the main case runs, but it requires urgency and a serious doubt about legality, so file it within days of notification. Because the two-month deadline runs from France and French courts notify at your French registered office (siège social), set up mail forwarding and a weekly check with your domiciliation agent: founders who learn about the sanction in month three discover that the deadline has already expired. Keep every envelope, every acknowledgement and every email header, because proof of the notification date decides admissibility.

Paris plays a practical role worth one paragraph. The CNIL sits in Paris, the Conseil d’État sits in Paris at the Palais-Royal, and most specialised data-protection lawyers plead there weekly. If your company is registered in Paris or the Île-de-France region, hearings require no travel for your local counsel, filings use the Paris procedural channels, and on-site inspections of Paris premises follow the same national rules with the capital’s shorter scheduling delays. None of this changes the law, but it shortens every round trip in a procedure where weeks matter, which is one more reason to keep a reachable contact and a complete file at the French address from the first day.

B. Can I face criminal prosecution or lose a labour case over the same data?

The same facts can trigger three parallel cases: the CNIL fine, a criminal prosecution and an employee lawsuit. French criminal law does not spare companies or their directors. Article 226-16 of the Criminal Code provides that “Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu’aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende. Est puni des mêmes peines le fait, y compris par négligence, de procéder ou de faire procéder à un traitement qui a fait l’objet de l’une des mesures prévues au 3° du IV de l’article 20 de la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés.” Negligence suffices: forgetting the register, ignoring a CNIL formal notice and continuing the processing, or launching a filing system without the required steps can each lead to prosecution, and continuing after a CNIL ban doubles the exposure. Legal entities themselves are criminally liable: Article 226-24 of the Criminal Code punishes the company itself, since “des infractions définies à la présente section encourent, outre l’amende suivant les modalités prévues par l’article 131-38” Your SAS or SARL can therefore be fined at a multiplied rate, banned from the activity during which the offence was committed, or placed under judicial supervision, while the director who ordered or tolerated the processing faces the prison term and the personal fine. Complaints usually come from an employee, a customer or the CNIL’s own report to the prosecutor, so treat every CNIL hearing as preparation for the criminal file too: nothing said to the CNIL disappears.

In the labour courts (conseil de prud’hommes, the French employment tribunal), unlawful monitoring destroys dismissals and creates damages. The pharmacy case above shows the mechanism: evidence collected without prior information of the employees and without consultation of the staff committee is unlawful, the dismissal based on it falls, and the employer pays severance and damages for dismissal without real and serious cause. There is one nuance founders must understand precisely. The Court of Cassation added, in that same judgment, that unlawful evidence is not automatically thrown out: the judge must check whether using it harmed the overall fairness of the trial, balancing the employee’s right to privacy against the employer’s right to prove its case, which can justify private-life-intrusive material only when producing it is indispensable to exercising that right and the intrusion stays strictly proportionate to the aim. In practice, dismissal files built exclusively on secret recordings almost never survive this balancing test, while an employer who warned employees, consulted the committee and used the least intrusive tool keeps usable evidence. The order of operations is therefore fixed: inform and consult first, monitor second, dismiss third. Reversing the order turns a justified dismissal into an expensive defeat, with back pay, damages and reimbursement of unemployment benefits to the French employment system.

Employees can also sue for the monitoring itself, independently of any dismissal: damages for breach of privacy, orders to disconnect the device, and complaints to the CNIL that open the administrative case described above. Works councils, unions and even individual employees can further ask the civil courts to stop an unlawful system. The three tracks reinforce each other, which means your defence must be coordinated from the start: the same register, the same prior notices and the same proportionality memo serve before the CNIL, the prosecutor and the labour judges. A founder living abroad should therefore never let the French manager improvise surveillance alone; validate each new tool centrally, in writing, before activation, and keep the validation with the file.

Conclusion

Running a French company from abroad does not lighten data protection duties; it concentrates them on your French entity while you sleep in another time zone. Before any dispute, give your company the five shields of Part I: a written legal basis for every customer processing, complete information notices, real security measures, a lawful cookie banner and a documentation file with the register and the impact assessments. For employees, apply the three-step discipline: check proportionality under Article L1121-1, inform each employee in advance, and consult the staff committee before switching any monitoring tool on. If the CNIL writes, answer fast, comply with the formal notice and keep every proof; if it fines, appeal to the Conseil d’État within two months and consider emergency suspension. And remember the criminal and labour tracks: negligence is enough for prosecution, the company itself can be banned from its activity, and a dismissal built on secret surveillance collapses in the labour courts. Data compliance is the cheapest insurance a foreign founder can buy in France, because every euro spent on notices, registers and prior information is a fine, a conviction or a lost dismissal case avoided.