Data protection officer lawyer in Paris: appointing the officer, setting the terms of the assignment and allocating responsibility.

The obligation does not apply to every company. Article 37 of the GDPR imposes it on public authorities and bodies, except for courts acting in their judicial capacity, and on controllers and processors whose core activities consist either of regular and systematic monitoring of data subjects on a large scale, or of large-scale processing of sensitive data or data relating to criminal convictions and offences. The analysis therefore looks at the organisation's main activity, not at the incidental processing that every company carries out, such as payroll or supplier management. A platform that profiles its users, a healthcare establishment or a video surveillance provider may fall within the obligation, whereas a services SME will not necessarily do so. Outside those cases, appointment remains possible, and Articles 38 and 39 of the GDPR apply whether the appointment was mandatory or voluntary. Where the organisation considers that it is not required to appoint, the firm advises recording in writing the reasons for that assessment, so that they can be presented in the event of a CNIL inspection. That note should be reviewed whenever the activity or the processing changes significantly.

Yes. The officer may perform the tasks under a service contract (Article 37, paragraph 6, of the GDPR), and the CNIL accepts (CNIL guidance on legal-entity officers) that an external officer may be an individual, such as a lawyer, or a legal entity, such as a firm. The lawyer brings a legal reading of the processing operations and the contracts. The lawyer's consultations and correspondence with the client are covered by professional secrecy (Article 66-5 of the Law of 31 December 1971), and Article 19 of the Law of 6 January 1978 reserves that secrecy, which remains enforceable against CNIL officials during an inspection. The profession nevertheless regulates this role. The national internal rules of the legal profession (règlement intérieur national) require the lawyer to declare the activity of data protection officer to the Bar (Article 6.4) and prohibit the lawyer from representing the organisation for which the lawyer performs or has performed that role in administrative or judicial proceedings involving the controller (Article 6.3.3). A lawyer acting as officer therefore cannot become that organisation's lawyer in an inspection or in litigation concerning its processing, even after the assignment has ended. A lawyer who becomes an employee of an organisation must also settle the position with the Bar: the Paris Court of Appeal noted that an employee officer, who was still registered, had not shown diligence in obtaining removal from the roll, a complaint which did not in itself amount to gross misconduct, which was found on other grounds (CA Paris, 12 February 2026). That decision went against the officer.

The service contract is the law between the organisation and its officer (Article 1103 of the French Civil Code), and it must be performed in good faith (Article 1104 of the Civil Code). It first sets the scope of the assignment, reproducing at a minimum the tasks in Article 39 of the GDPR: informing and advising, monitoring compliance with the Regulation, advising on impact assessments, cooperating with the CNIL and acting as its contact point. It then specifies the time devoted, the internal contacts, access to processing operations and information, how the officer reports to management and the confidentiality that binds the officer. The financial clauses deserve the same attention: term of the commitment, renewal, notice period, and the fate of the sums due on early exit. In a case decided in Paris, the contract imposed a minimum period of twelve months presented as a guarantee of the officer's independence, followed by annual renewal; the client that had not terminated in the proper form was ordered, under a penalty clause, to pay the sums due until the end of the renewed year (TAE Paris, 2 October 2026). This is a first-instance decision, given on the terms of a particular contract. It shows that the contractual framework is to be negotiated before signature, not after the first disputed invoice.

Termination follows the contract, which is the law for those who made it (Article 1103 of the Civil Code). Where it is concluded for a fixed term and provides for its renewal absent notice given in the agreed form and time, it is that clause which opens a new period. This is distinct from the tacit renewal of Article 1215 of the Civil Code, which arises from continued performance after the end of the term and produces the effects of a renewal, that is, a new contract of indefinite duration (Article 1214 of the same Code). The client must therefore re-read the term of the commitment, the expiry date, the notice period and the form required, often a registered letter with acknowledgement of receipt. The economic activities court of Paris held that an email expressing the wish to review the contract and to arrange a meeting "does not constitute a termination notice in accordance with the contract" (our translation) (TAE Paris, ch. 1-10, 2 October 2026, No. 2025072738). The contract having been renewed for one year, the court characterised as a penalty clause the stipulation that made the client liable for the sums due until the end of the term, and then held: "In the absence of evidence establishing that it is manifestly excessive, the court will rule that there is no reason to reduce this penalty clause" (our translation) (TAE Paris, ch. 1-10, 2 October 2026, No. 2025072738). The judge retains the power to reduce a manifestly excessive penalty (Article 1231-5 of the Civil Code), but the evidence for it must be provided. This decision, which went against the client, is a reminder to give notice of termination in the proper form, then to appoint a new officer or to notify the CNIL of the end of the assignment.

In principle, no. Article 24 of the GDPR places on the controller the technical and organisational measures needed to ensure and demonstrate that processing complies. The CNIL points out that the officer is not responsible in the event of non-compliance with the Regulation, compliance being the responsibility of the organisation that appointed the officer or of the processor (CNIL, question on the officer's liability). It adds that in France the officer's criminal liability may be engaged, like that of any employee or official, if the officer intentionally infringes the criminal provisions or helps the controller to infringe them. The outsourced officer is also answerable for the performance of the officer's own contract: if the officer fails to perform the assignment, the client may seek to hold the officer liable in contract and claim compensation for the resulting loss (Article 1231-1 of the French Civil Code). An employee working in the field may also have his or her own errors assessed in light of the employer's activity: in a disciplinary dispute concerning facts from 2017, before the GDPR applied, the Paris Court of Appeal held that a consultant employed by a data protection consultancy was at fault for sending a group email revealing the addresses of the participants in a conference, and wrote: "The existence of this group email runs counter to the company's purpose and to the know-how that it intends to promote" (our translation) (CA Paris, pôle 6 ch. 3, 18 May 2022, No. 19/01204). This decision, which went against the employee concerned, remains a ruling on its own facts.

The answer depends on what the person actually decides. The officer may perform other tasks, but the organisation must ensure that they do not result in a conflict of interest (Article 38, paragraph 6, of the GDPR). The Court of Justice has stated that a conflict of interest may exist where those other tasks lead the officer to determine the purposes and means of data processing, which the national court assesses case by case, in light of the organisation's structure and internal rules (CJEU, 9 February 2023, X-FAB Dresden, C-453/21). An IT director who chooses the tools and sets retention periods, or a human resources director who defines the staff-management processing, would be monitoring his or her own decisions. The question also arises for the legal director where he or she decides the company's data policy. Combining roles also creates a risk of overload: the Paris Court of Appeal found psychological harassment and upheld the nullity of the dismissal of a general secretary, who was also the data protection officer, whose responsibilities had kept growing, management having adopted a tone that the court described as "excessive, counter-productive pressure generating a feeling of humiliation given his status in the company" (our translation) (CA Paris, pôle 6 ch. 3, 25 September 2024, No. 21/06520).

The controller publishes the officer's contact details and communicates them to the supervisory authority (Article 37, paragraph 7, of the GDPR). In practice, the CNIL states that appointment, replacement and notification of the end of the assignment are made exclusively through its dedicated online service, which distinguishes three forms: appointing an officer, ending or replacing an appointment, and updating contact details (CNIL: appointing a DPO). The update forms ask for the officer's appointment number and the organisation's SIREN number. Before notifying, the CNIL invites the controller to check three conditions: the officer's skills, sufficient resources to perform the tasks, and the ability to act with complete independence. The contact details must then appear in the information notices given to data subjects. The Court of Cassation has recalled that the controller must give individuals information relating in particular to the officer's contact details: in its words, "the controller of personal data must give the data subjects information relating in particular to the purposes of the monitoring system, their right of access and rectification, and the contact details of the data protection officer" (our translation) (Cass. soc., 21 May 2025, No. 22-19.925). The firm checks that the appointment, the notices and the reality of the assignment are consistent.

Yes, but not because of the performance of the officer's tasks. Article 38, paragraph 3, of the GDPR prohibits dismissing the officer or penalising the officer for performing them. The Court of Justice also accepts that a national law, in that case German law, may reserve such dismissal to cases of serious grounds, even unrelated to the tasks, provided that it does not undermine the objectives of the Regulation (CJEU, 22 June 2022, Leistritz, C-534/20). That ruling does not create a requirement of serious grounds in France: the dismissal of an employee officer for personal reasons requires a genuine and serious cause (Article L. 1232-1 of the French Labour Code), under the protection of Article 38. Recent decisions show that the court examines the alleged grounds as it would for any employee. The Paris Court of Appeal refused to treat "the circulation of an organisation chart to a subcontracting company with which the employer exchanged information" (our translation) as a disclosure of confidential data, and ordered the employer, who also relied on the employee's status as officer, to pay damages for dismissal without genuine and serious cause (CA Paris, pôle 6 ch. 10, 3 July 2025, No. 22/04183). Conversely, the Versailles Court of Appeal held that the dismissal of an employee registered as officer with the CNIL, described in the job description as the group officer's relay in France, was based on a genuine and serious cause, noting that this registration had not had the effect of "conferring on the employee the legal status of DPO within the company" (our translation) (CA Versailles, ch. soc. 4-3, 13 July 2026, No. 23/02875). This second decision went against the employee.

Not automatically. Reporting failures to management is part of the officer's assignment, as the officer reports to the highest level of management. The protective status of whistleblower, provided for in particular by Article L. 1132-3-3 of the Labour Code, requires that its legal conditions be met, and the court examines whether the contested measure rests on objective grounds unrelated to the alert. The Paris Court of Appeal thus refused to hold null the termination of the contract of an officer who relied on an alert sent to her management: the court noted that the termination did not penalise that alert, "which fell within her assignment and her freedom of expression" (our translation) (CA Paris, pôle 6 ch. 7, 12 February 2026, No. 22/01927), but two distinct facts, including an unfounded accusation made against a colleague. The finding of gross misconduct was upheld. In another case, the Versailles Court of Appeal recognised whistleblower protection for an employee registered as officer with the CNIL but described as the group officer's relay, and found that the coincidence between his critical audit and the dismissal gave rise to a presumption of discrimination, then dismissed it in light of established grounds (CA Versailles, ch. soc. 4-3, 13 July 2026, No. 23/02875). Both decisions went against the employees concerned. They show that a written alert, precise and tied to the officer's tasks, should be kept, but that it does not neutralise grounds unrelated to the role.

Article 38, paragraph 2, of the GDPR requires the organisation to support the officer by providing the necessary resources, access to data and processing operations, and the means to maintain the officer's knowledge. The CNIL adds that the officer must have sufficient time to perform the tasks. An officer who lacks resources should say so in writing, describing precisely what is missing: access refused, projects launched without consultation, time absorbed by other functions. The evidence then rests on those exchanges. In a case decided by the Versailles Court of Appeal, an officer relied on an infringement of her status and a lack of independence; the court noted the use of an external consultancy and an allocated budget, and then held that "the employee shows neither her lack of independence in the performance of her duties" (our translation) (CA Versailles, ch. soc. 4-3, 24 March 2025, No. 22/02731). The judgment was upheld, which went against the officer. On the employer's side, the obligation to take the measures necessary to protect workers' health (Article L. 4121-1 of the Labour Code) and the prohibition of repeated acts of psychological harassment (Article L. 1152-1 of the Labour Code) apply to the employee officer as to any employee. The firm helps either party to document the situation before it deteriorates.

Two risks stand out. The first is administrative. The obligations in Articles 25 to 39 of the GDPR, which include appointing the officer, involving the officer in data protection issues and the officer's independence, fall under the fines of Article 83 of the GDPR, paragraph 4, which may reach €10 million or 2% of worldwide annual turnover, whichever is higher. The CNIL also has the corrective measures and sanctions provided for in Article 20 of the Law of 6 January 1978. The second risk is civil. Any person who has suffered damage as a result of an infringement of the Regulation may obtain compensation (Article 82 of the GDPR), but the Court of Cassation requires proof of damage: in its words, "a mere infringement of the General Data Protection Regulation does not, on its own, give rise to a right to compensation" (our translation) (Cass. soc., 24 June 2026, No. 24-22.792). This partial quashing benefits the employer, which had been ordered to pay on the basis of presumed harm; the employee's claim is not definitively rejected, as the court to which the case is remitted must verify whether the employee establishes material or non-material damage. It does not relieve the company of the need to correct the failure. An officer consulted in good time, whose opinions are kept together with the action taken on them, makes it possible to demonstrate the organisation's diligence during an inspection and before the court.

The end of the appointment and the end of the employment contract are two separate operations. The first is notified in the CNIL's online service, using the form for ending or replacing an appointment. The second follows employment law and Article 38, paragraph 3, of the GDPR. Chronology matters. In the case decided by the Versailles Court of Appeal on 13 July 2026, the employee, registered as officer with the CNIL without having, according to the court, the legal status of officer within the company, complained that the employer had had that registration ended during his suspension, before the dismissal. The court noted that "the employer claims without establishing it that the employee's deregistration with the CNIL before his dismissal was the employee's own doing" (our translation) (CA Versailles, ch. soc. 4-3, 13 July 2026, No. 23/02875), and then held, together with the failure to resume payment of salary, that the dismissal was carried out in a vexatious manner and awarded €1,000, while ruling that the dismissal rested on a genuine and serious cause. The organisation must therefore organise the transition: replacement of the officer, takeover of the dedicated mailbox, handover of pending requests, and updating of the information notices. The opinions given must be archived by the organisation; if the departing officer keeps certain documents, the officer limits them to those that a specific purpose justifies, for a limited period and in compliance with the officer's duty of confidentiality (Article 38, paragraph 5, of the GDPR).