FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
5.2 Government Notifications and Approvals No General Prior Approval for GDPR Transfers France does not impose a general government notifi - cation or approval requirement for transfers of person - al data outside France or the EEA beyond the GDPR mechanisms (adequacy, Article 46 safeguards, or Article 49 derogations). In practice, organisations are expected to self-assess document compliance, and the CNIL may review transfer arrangements in audits or investigations. Sector-Specific or Secrecy-Driven Constraints Certain categories of information (eg, defence secrets, classified information, certain regulated critical infra - structure data, professional secrecy such as legal priv - ilege or banking secrecy) may be subject to separate restrictions with regard to disclosure abroad, which operate independently from GDPR transfer rules. These restrictions are case-specific and typically arise from national security law, public law, criminal law or professional regulations rather than from data protec - tion statutes as such. Non-Personal Data: EU Data Act Context The EU Data Act (Article 32) sets safeguards against third-country government access to or transfer of non-personal data held in the EU by providers of data processing services. Providers must take adequate technical, organisational and legal (including contrac - tual) measures to prevent such access/transfer where it conflicts with EU or member state law. Third-country decisions requiring access/transfer are enforceable only if based on a relevant international agreement (eg, a mutual legal assistance treaty or MLAT); other - wise, and where compliance would risk such a con - flict, access/transfer may occur only under specified procedural conditions, with data minimisation and (generally) customer notification. 5.3 Data Localisation Requirements No General Localisation Rule French law does not impose a broad requirement to store personal data in France. Under the GDPR, locali - sation may be relevant as a risk mitigation measure (eg, to limit international transfers) but is not man - dated as such.
• Controller/processor set-up – the main parties (auditor and auditee) are usually independent controllers during diligence. However, the due dili - gence process typically involves data processors, such as electronic data room providers. A data processing agreement compliant with Article 28 of the GDPR must be concluded with such entities. • Change of control/transparency – when the buyer becomes the new controller, they must pro - vide updated privacy information; where data is obtained indirectly, Article 14 information must be given “as soon as reasonably possible” and at the latest, within one month (subject to limited excep - tions). • Post-closing integration – reassess purpose compatibility, retention, security, contracts, and cross-border transfer safeguards before merging datasets. France adheres to Chapter V of the GDPR regarding international transfers of personal data. Transfers of personal data outside the EEA are prohibited unless the destination country ensures an adequate level of protection. • Adequacy decisions: Transfers to countries with an EU adequacy decision (eg, Japan, UK and USA under the Privacy Framework) are unrestricted. • Appropriate safeguards: For other countries, organisations must use tools like the European Commission’s standard contractual clauses (SCCs) or binding corporate rules (BCRs). 5. International Considerations 5.1 Restrictions on International Data Transfers • Transfer impact assessments (TIAs): Organisa - tions must conduct a TIA to verify if the laws of the recipient country (especially regarding govern - ment surveillance) impinge on the effectiveness of the safeguards (ie, this does not concern transfers based on adequacy decisions). In January 2025, the CNIL published a comprehensive guide on TIAs, outlining a five-step methodology for this assessment.
126 CHAMBERS.COM
Powered by FlippingBook