Technology, Data & Cyber in France

Full guide · Source-checked research97% of statements checked against a source143 checked against an official source4 checked against a secondary sourceChecked 2026-10-19Not yet professionally reviewed

• From 1 September 2026 all VAT-registered businesses in scope must be able to receive electronic invoices through an approved platform (plateforme agréée), and large and intermediate-sized companies must issue e-invoices through such a platform and transmit e-reporting data.

  Domestic invoicing between businesses; invoices to private individuals are outside e-invoicing but other data transmission rules apply.Direction générale des Finances publiques · checked 2026-10-18

• From 1 September 2027 the obligation to issue electronic invoices and transmit transaction and payment data extends to small and medium-sized enterprises and micro-enterprises.

  Before that date they may join voluntarily, but customers cannot legally require it.Direction générale des Finances publiques · checked 2026-10-18

• E-invoices must be issued, transmitted and received through an approved platform (article 289 bis of the Code général des impôts), with per-invoice fines under article 1737 and, for failure to use a platform for receipt, a three-month formal notice before any fine.

  The DGFiP states it will not apply automatic penalties during the start-up phase where a real, documented difficulty is being corrected; this does not postpone the obligation.Direction générale des Finances publiques · checked 2026-10-18

• A personal data breach that poses a risk to individuals' privacy must be notified to the CNIL as soon as possible and at the latest within 72 hours, using the CNIL online notification service.

  Controllers subject to the GDPR whose breach is notified in France. An initial notification can be supplemented later; reasons must be given if the 72-hour limit is missed.Commission nationale de l'informatique et des libertés (CNIL) · checked 2026-10-18

• Where a breach poses a high risk to individuals, the affected people must also be informed; the CNIL can advise whether this is needed.

  Applies in addition to notification to the CNIL.Commission nationale de l'informatique et des libertés (CNIL) · checked 2026-10-18

• Under the ordinary sanction procedure, the CNIL can impose fines of up to EUR 10 million or 2% of annual worldwide turnover, rising to EUR 20 million or 4% for the most serious breaches, and compliance orders with penalties of up to EUR 100,000 per day of delay.

  Applies to companies; the higher of the fixed amount and the turnover percentage applies under the GDPR. The CNIL can also restrict or ban processing, suspend data flows to third countries and publish its decision.Commission nationale de l'informatique et des libertés (CNIL) · checked 2026-10-18

• Under the CNIL's simplified sanction procedure, fines are capped at EUR 20,000 and compliance-order penalties at EUR 100 per day, and the sanction cannot be made public.

  Used for less complex cases.Commission nationale de l'informatique et des libertés (CNIL) · checked 2026-10-18

• A data protection officer (DPO) must be designated by public bodies, by organisations whose core activities involve large-scale regular and systematic monitoring of individuals, and by organisations whose core activities involve large-scale processing of sensitive data or criminal-offence data; the designation is made online on the CNIL website.

  Courts acting in their judicial capacity are excluded from the public-body case. Voluntary designation is possible in other cases.Commission nationale de l'informatique et des libertés (CNIL) · checked 2026-10-18

Read the full guide: Tax, accounting and statutory reporting · Data protection, cybersecurity and digital filing