GDPR lawyer in Paris: compliance for an SME with no in-house DPO.

Article 30 of the GDPR requires every controller to keep a record of processing activities. Paragraph 5 lifts this obligation for an organisation employing fewer than 250 persons, but the exception falls away in three cases: the processing poses a risk to the rights of individuals, it is not occasional, or it concerns sensitive data or data relating to convictions (Regulation (EU) 2016/679, Article 30). Payroll, leave management, the customer file or invoicing run all year round: they are not occasional processing. An SME with ten employees and a customer file is therefore, in practice, required to document this processing. The record is not an administrative form to be filed. It is the basis for everything else: replying to an access request, informing employees, contracts with service providers, responding to an inspection. The proposed regulation known as the digital omnibus, still under discussion in the European Parliament in autumn 2026, does not change the applicable law until it is adopted and published. The firm draws up with the manager a record limited to the company's actual processing, written so that it can be kept up to date without an in-house legal department.

Article 37 of the GDPR makes appointment mandatory only in three situations: the processing is carried out by a public authority or body, the core activities require regular and systematic monitoring of individuals on a large scale, or they consist of large-scale processing of special categories of data, such as health or opinions, or of data relating to convictions and offences. An estate agency, a shop, a consulting firm or a building company rarely falls within these cases, because data processing is not their core activity. Outside those cases, appointment remains optional. The officer may be an employee or an outside provider under a service contract, according to paragraph 6 of the same Article. Where it appoints an officer, the company must involve them in data protection matters, give them the means to act and not give them instructions on the exercise of their tasks (Article 38). Not appointing one does not relieve the company of any other obligation. The firm first checks whether the core activity falls within one of the three cases, then organises the allocation of tasks between the manager, department heads and, if the SME so wishes, an external officer.

The company, as controller, answers for breaches before the CNIL and before the court. Article 24 of the GDPR requires it to implement appropriate measures and to be able to prove that the processing complies. In practice, the manager bears this burden: the CNIL addresses its requests to them, and they must find the information notices, contracts and replies. The Council of State has recalled that the heads of private companies and controllers are under an obligation to cooperate with the CNIL by replying diligently to its requests for information. It upheld a €10,000 fine against a shop whose manager had asked not to sign the inspection report and then replied neither to the report nor to the reminder (CE, 30 January 2024, No. 473254). This failure stands on its own: it was penalised without it being possible to assess whether the video surveillance system inspected complied. The firm helps the manager to designate internally a person responsible for receiving and routing requests, and to keep an evidence file that can be consulted quickly.

No, where the camera also makes it possible to monitor their activity. Article L. 1222-4 of the Labour Code prohibits collecting information concerning an employee personally by means of a system that has not been brought to their attention beforehand. In a company with at least fifty employees, the social and economic committee must also be informed and consulted, before the decision to implement, on the means allowing activity to be monitored. In a case decided under the Data Protection Act in the version then in force, a pharmacy had installed a system intended for the security of property and people, which "also made it possible to control and monitor the employees' activity" (Cass. soc., 10 November 2021, No. 20-12.263) (our translation). The Court of Cassation inferred that the evidence drawn from the recordings was unlawful and quashed the judgment that had upheld the dismissal for gross misconduct. Article 13 of the GDPR now requires comparable information at the time of collection. The stated purpose also matters: a camera presented as an anti-theft device does not become a staff-monitoring tool, without fresh information. The firm checks the notice given to employees, the signage, the consultation of the committee and the camera angle before any use of the footage.

Unlawful evidence is not automatically excluded, but it is admitted only on strict conditions. The court checks whether the monitoring was based on concrete grounds, whether the employer had a less intrusive means and whether the interference with private life is proportionate. The outcome may go against the employer: the Court of Cassation approved the inadmissibility of recordings where "the production of the recordings in dispute was not indispensable to the exercise of the employer's right to evidence, since the employer had another means of proof which it had not put before the court" (Cass. soc., 8 March 2023, No. 21-17.802) (our translation). It did, on the other hand, admit video where "the viewing of the recordings had been limited in time, in a context of missing stock, after initial searches had proved fruitless, and had been carried out by the company's manager alone" (Cass. soc., 14 February 2024, No. 22-23.073) (our translation). In an SME, this last criterion often matters: who watched the images, for how long and after what checks. The firm reconstructs this chronology before any disciplinary procedure based on images is started.

Continuous monitoring of an employee who works alone is the most exposed configuration. Article L. 1121-1 of the Labour Code prohibits restrictions on individuals' rights that are not justified by the nature of the task or proportionate to the aim pursued. In a restaurant, the court of appeal had found that the cook "was subject to constant surveillance by the camera installed there" (Cass. soc., 23 June 2021, No. 19-13.856) (our translation). The Court of Cassation approved the judges who held this system to be "an infringement of the employee's personal life and disproportionate to the stated aim" (Cass. soc., 23 June 2021, No. 19-13.856) (our translation), so that the recordings could not be relied on against the employee; the employer's appeal to the Court of Cassation was dismissed. The aim of securing people and property is therefore not enough where the camera continuously frames a workstation occupied by one person. For a small business, the solution is to point cameras at entrances, the till or storerooms, to limit retention of images and to reserve their viewing for specific incidents. The firm examines the layout plan and the recording settings with the provider that installed the system.

These tools produce personal data: login times, calls answered, handling times. Using them without prior information interferes with employees' privacy, but the evidence may be admitted if it is indispensable and proportionate. In a call centre, the employer "had confined itself to producing the data extracted from the call centre's computerised management software" (Cass. soc., 22 January 2025, No. 22-15.793) (our translation), limited to business communications and supplemented by a report from a judicial officer (commissaire de justice). The Court of Cassation held this production to be proportionate and dismissed the appeal of the dismissed employees. This decision favours the employer, but it turns on the narrow selection of the data produced: a mass extraction, or one extended to personal exchanges, would have called for a different assessment. An SME that deploys telephony, time-recording or task-management software must inform employees before any collection concerning them and, if it has at least fifty employees, inform or consult the social and economic committee before introducing the tool, depending on whether it serves personnel management or the monitoring of activity. The firm reviews the vendor's contract, the settings activated and the information notice before a dispute turns this data into a contested exhibit.

Article 15 of the GDPR gives everyone the right to obtain a copy of their data. An employee's work mailbox, calendar and internal conversations contain such data. The reply is due within the one-month period laid down by Article 12(3). A refusal based solely on business confidentiality is risky. The Versailles Court of Appeal ordered, in urgent proceedings, the disclosure of the emails, calendar and conversations of an employee whose probationary period had been terminated, noting that the company had refused "without company [1] establishing before the court how their disclosure would be likely to infringe the rights and freedoms of others" (CA Versailles, ch. soc. 4-2, 3 June 2026, No. 25/02036) (our translation). The same decision recalls that it is for the court "to ensure the principle of personal data minimisation" (CA Versailles, ch. soc. 4-2, 3 June 2026, No. 25/02036) (our translation), and orders the redaction of the contact details of customers and other employees. The useful course for the company is therefore to disclose while masking what concerns third parties, rather than to raise a blanket refusal. The firm organises the extraction, the redactions and the covering letter.

Failing to reply is in itself a breach. Article 31 of the GDPR requires the controller to cooperate with the supervisory authority, and the 1978 Act prohibits company heads from obstructing the CNIL's action. The Council of State applied this to a company that had replied neither to an individual asking for the erasure of their data, nor to the CNIL's reminders and formal notice, which had come back marked "notice left, not collected" (CE, 28 November 2025, No. 499566). The company argued that the messages had been classed as spam because of a faulty configuration of its generic mailbox. The court found prolonged negligence and upheld the €15,000 fine and the injunction backed by a periodic penalty payment, noting that it had not been shown that this amount exceeded the company's ability to pay. This decision goes against the SME and shows a concrete point: the email address published for the exercise of rights must actually be read, and registered letters must be collected. The firm checks these reception channels and, where a letter is already outstanding, prepares a complete reply with the documents requested.

Provided for by Article 22-1 of the Data Protection Act, it allows the chair of the restricted committee, or the member the chair designates, to rule alone on a case that presents no particular difficulty. It opens only certain measures: reminder of obligations, injunction backed by a periodic penalty payment, and fine. In the wording in force since 28 May 2026, the fine may not exceed €20,000 and the periodic penalty payment €100 per day; these ceilings rise to €100,000 and €500 where the controller's total worldwide annual turnover for the preceding financial year exceeds €50 million. The decision may not be made public. The safeguards remain real: a report drawn up by a CNIL officer is notified to the company, which may be assisted, submit written observations and ask to be heard. The chair of the restricted committee may also decline this route and refer the case to the ordinary procedure of Article 22. For an SME, the written observations are the decisive moment: they must show the corrections already made, the cooperation shown and the financial situation. The firm drafts them on the basis of the report notified.

It may, if the company cannot prove that its security measures were appropriate. Article 32 of the GDPR requires measures suited to the risk, and Article 82 opens an action for compensation. The judicial court of Nice ruled on an estate agency, set up as a limited liability company (SARL), whose manager's mailbox had been hacked: the tenant had received fraudulent emails and paid rent into a diverted account. The court held that "The controller concerned bears the burden of proving that the security measures it has implemented under Article 32 of that Regulation are appropriate" (TJ Nice, 3e ch. civ., 18 November 2025, No. 22/03193) (our translation). As the agency offered no answer on this point, it was ordered to compensate the tenant, for this fault and for a separate breach relating to the rent. This first-instance decision goes against the company and may be challenged on appeal, but it shows what matters: strengthened authentication, logging, a procedure for verifying changes of bank details, and proof of the date the incident was discovered. The firm helps to document these measures before an incident and to organise the defence afterwards.

Article L. 34-5 of the Postal and Electronic Communications Code prohibits direct marketing by email using the contact details of an individual who has not consented to it beforehand. An exception covers customers: their contact details must have been collected from them in connection with a sale or a service, the marketing must concern similar products or services supplied by the same company, and the recipient must have been offered a simple means, at no cost, of objecting both when the contact details are collected and with each message, without having refused at the outset. A purchased list of individuals does not benefit from this exception: it must be possible to establish the consent collected by the seller of the list, including for transmission to partners. For professionals approached on a subject related to their role, the CNIL accepts marketing based on legitimate interest, provided they are informed and allowed to object (CNIL guidance sheet on email marketing). The same reasoning applies to trackers placed on the website, which require prior consent subject to exceptions (Article 82 of the 1978 Act). For an SME, the risk often comes from a sending tool configured by a provider, which mixes customers and prospects in a single list. The firm checks the origin of the addresses, the wording of the consent and the unsubscribe link before a campaign.

Yes, as soon as the provider processes data on the company's behalf: hosting, online payroll software, CRM, maintenance with access to the servers. Article 28 of the GDPR requires the company to use only a processor providing sufficient guarantees, and to govern the relationship by a contract that sets out what is processed, for how long, for what purpose and concerning which individuals. The contract must in particular provide that the provider acts only on documented instructions, that its staff are bound by confidentiality, that it ensures security and that it does not engage another processor without written authorisation. The provider must also notify any breach to the controller without undue delay (Article 33(2)). Vendors' standard terms and conditions often contain these clauses, but not always what happens to the data at the end of the contract or where it is hosted. The firm reviews these contracts, negotiates the missing clauses and checks reversibility.

Yes, where the recording pursues a purpose that the law does not recognise for it. The Labour Code allows the meetings of the social and economic committee to be recorded solely for the drafting of the minutes, which is the task of the committee's secretary. An employer had recorded the meetings to check the accuracy of the minutes and to build up evidence. The employment chamber of the Court of Cassation endorsed the analysis of the appeal judges, for whom "the employer had thus collected the personal data of the staff representatives" (Cass. soc., 7 October 2026, No. 25-10.664) (our translation), and had acted "for purposes unrelated to the legal obligation on the committee's secretary to draw up the minutes of the body's deliberations" (Cass. soc., 7 October 2026, No. 25-10.664) (our translation). In the absence of a legitimate interest within the meaning of Article 6 of the GDPR, a manifestly unlawful disturbance was established and the employer's appeal to the Court of Cassation was dismissed. This decision goes against the company. It concerns organisations with at least fifty employees, but its reasoning holds for any recording of meetings or interviews: the legal basis is to be checked before pressing the button. The firm examines recording practices and the documents that govern them.