RGPD-Express
Structure your GDPR compliance
The key articles of the GDPR
The GDPR (Regulation (EU) 2016/679) structures the RGPD-Express approach
Art. 30 - Record of processing activities
Obligation to keep a record, both on the controller side and the processor side. The exemption provided in 30.5 for organizations with fewer than 250 employees applies only to occasional processing.
Art. 28 - Processor
Contractual framing of any processor handling data on your behalf: sufficient guarantees, mandatory clauses, further sub-processing authorized by prior written consent.
Art. 32 - Security of processing
Technical and organizational measures appropriate to the risk: pseudonymization, encryption, means to ensure confidentiality and availability, procedure for regular testing and evaluation.
Art. 35 - Data protection impact assessment (DPIA)
Mandatory only when the processing is likely to result in a high risk: systematic evaluation with legal effect, sensitive data on a large scale, or systematic monitoring of a publicly accessible area.
Regulatory watch - official sources
What the text really says, translated into plain language. Each point links back to the official text.
What is GDPR, exactly?
It is the European text governing the collection and use of personal data (customers, employees, prospects...). It was adopted on 27 April 2016 and published in the Official Journal of the European Union on 4 May 2016.
Since when has it applied
The regulation entered into force twenty days after its publication, but it has only been genuinely applicable since 25 May 2018. That is the date that matters for your concrete obligations.
The record of processing activities: the baseline document
You must keep a list of what you do with personal data: for what purpose, with whom, how long you keep it, how you protect it. An exception exists for organizations with fewer than 250 employees, but only if the processing is occasional - a regular commercial activity does not benefit from it.
Do you need to appoint a Data Protection Officer (DPO)?
It is only mandatory in three specific situations: you are a public body, or your core activity consists of regularly and systematically monitoring individuals on a large scale, or of processing sensitive data on a large scale. Outside these cases, appointing a DPO remains optional.
In case of a data breach: 72 hours to notify the authority
If personal data is lost, stolen or exposed, you must notify the CNIL (or the competent authority) no later than 72 hours after becoming aware of it, unless the risk to individuals is negligible. You must also keep a written record of every incident.
If the risk is high, your customers or employees must also be notified
When a data breach creates a high risk for the individuals concerned, you must inform them directly, in clear and plain language. You may be exempted from this notification if the data was encrypted or if you have already neutralized the risk.
The penalties, in plain terms
In the event of a breach, the fine can reach up to 10 million euros (or 2% of the company's worldwide annual turnover) for the most common breaches, and up to 20 million euros (or 4% of worldwide turnover) for the most serious violations of individuals' rights - the higher amount always applies. The actual amount depends on the severity, the intentional or negligent character of the infringement and cooperation with the authority.
Who is affected by the GDPR?
The question we hear most often: "Does this really apply to me, a small business?" Short, sourced answer: yes, almost always.
The real trigger: processing a personal data item
The GDPR applies once an organization processes, even partially in an automated way, or within a structured file, information relating to an identified or identifiable person: name, email, phone number, IP address, location data...
In practice, this covers a customer file, employee payroll, CVs received, a CCTV camera, a newsletter, a CRM or audience-measurement cookies.
The rare exceptions
The GDPR does not apply in four specific cases:
- a strictly personal or household use (your private address book, for example)
- activities falling outside the scope of European Union law
- activities of Member States relating to the common foreign policy
- processing by authorities for the prevention of criminal offences (a separate regime)
It does not matter where you are based
The GDPR applies once your company has an establishment in the European Union, or once you target individuals located there: by offering them goods or services (even free ones), or by monitoring their behaviour (profiling, tracking cookies).
The CNIL gives two telling examples: a French company that exports only to Morocco remains subject to the GDPR once it processes data of individuals in the EU; a Chinese e-commerce site that delivers to France must also comply with it.
Two possible roles, two levels of obligations
Data controller: the organization that decides why and how the data is used (your company, a municipality, an association). That is generally you.
Processor: the service provider that processes this data on your instructions (hosting provider, payroll software, marketing agency...). It also has its own obligations, distinct from yours.
Private companies
from micro-businesses to large groups, from the very first customer file or payslip
Public sector
municipalities, local authorities, government bodies, healthcare institutions
Associations, tradespeople, freelancers
regulated professions, shopkeepers, startups: no exemption based on status
The questions a business owner really asks
No legal jargon: the 7 most common questions, a simple answer, and the official text behind each answer.
Click on a question to see the answer and its source.
No. Consent is only one option out of six. The GDPR (article 6) also allows processing when it is necessary for the performance of a contract, for compliance with a legal obligation, to protect vital interests, for a task carried out in the public interest, or for the legitimate interest of your company (for example managing the relationship with an existing customer), as long as the individual's rights do not override it.
It depends on who you are contacting:
- Individuals (B2C): prior consent required (a checkbox, never pre-ticked), except to offer a similar product again to an existing customer.
- Professionals (B2B): possible without prior consent if the message relates to their business activity, provided you have informed them and given them a simple way to opt out.
In all cases: an identifiable sender and an easy unsubscribe link.
Generally yes, in particular if the data no longer serves any purpose, if the person withdraws their consent, or if they object without a legitimate overriding reason on your part. You may, however, refuse if you must keep the data for a legal obligation - for example an invoice that must be kept for 10 years for accounting purposes - or to defend yourself in legal proceedings.
1 month from receipt of the request. This period can be extended by 2 months if the request is complex or if you receive a large number of them, but you must inform the person of this extension within the initial month.
Yes, but not without precautions. Three possible cases: the country benefits from an official European Commission adequacy decision recognizing an adequate level of protection; failing that, your provider must offer appropriate safeguards (standard contractual clauses in most cases); or, for one-off cases only, a specific derogation applies (explicit consent, performance of a contract...).
Yes. Most cookies (personalized advertising, social media buttons...) require your visitor's prior consent, given freely, and as easy to withdraw as to give. Accepting general terms and conditions does not count as valid consent. A few technical cookies (shopping cart, authentication, language preference) are exempt from this requirement.
The CNIL generally starts with an inspection (on-site or online) followed by a formal notice to become compliant within a given deadline. Financial penalties do exist but remain proportionate to the size of the organization: the CNIL has, for example, fined small businesses between 2,000 and 20,000 euros for breaches relating to security, cookies or the right of access - far below the maximum ceilings (up to 20 million euros or 4% of worldwide turnover for the most serious breaches).
The GDPR timeline, in plain terms
The GDPR was not born in 2018 and has not stood still since. Here, in order, is what has already happened (and still is the rule today) and what is still under discussion in Brussels - with, for each step, the official text that proves it.
Already in force today
- The GDPR has applied in full since 25 May 2018 - this is THE date that matters for your obligations.
- The French "Informatique et Libertés" (data protection) act was updated accordingly (2018).
- The new standard contractual clauses for transfers outside the EU have been in place since late 2022.
- The framework for transferring data to the United States (Data Privacy Framework) has been in force since July 2023.
Still under discussion, not yet mandatory
- A simplification of the record of processing activities (art. 30) for organizations with fewer than 750 employees, proposed by the Commission in May 2025 - not yet a text in force.
- A regulation to harmonize procedures between national supervisory authorities during cross-border investigations - political agreement reached in June 2025, formal adoption not yet confirmed.
- Do not rely on these announcements to delay your compliance: the 2018 baseline remains the rule as long as nothing has been published in the Official Journal.
The text is adopted
The European Parliament and the Council adopt Regulation (EU) 2016/679, the GDPR. source EUR-Lex ↗
Official publication
The text is published in the Official Journal of the European Union (OJ L 119, pages 1 to 88). source EUR-Lex ↗
Legal entry into force
The regulation "enters into force on the twentieth day following that of its publication" (art. 99). It exists legally, but its effective application to companies is still deferred by two years - time to get organized. source CNIL, art. 99 ↗
The GDPR applies in full
From this date, all organizations that process personal data of European residents must be genuinely compliant, not just "on paper". This is the date to remember. source CNIL, art. 99 ↗
French law is updated
Law No. 2018-493 adapts French law to the GDPR and transposes the "police-justice" directive (2016/680), building on the 1978 Data Protection Act ("loi Informatique et Libertés"). source Légifrance ↗
The 1978 act is entirely rewritten
Order No. 2018-1125 completes the alignment of the Data Protection Act ("loi Informatique et Libertés") with the GDPR and directive 2016/680. source Légifrance ↗
1st European Commission review
Two years after it became applicable, the Commission publishes its first report: the GDPR meets its objectives, but improvements are needed (harmonization between countries, cooperation between authorities). source EUR-Lex (COM 2020) ↗
The "Schrems II" ruling
The Court of Justice of the European Union invalidates the "Privacy Shield" that governed data transfers to the United States: the US safeguards on public authorities' access to data are not considered sufficient. source EUR-Lex ↗
New standard contractual clauses
New model clauses for governing data transfers outside the EU enter into force, with a 15-month transition period to replace contracts already signed. source EUR-Lex (2021/914) ↗
New EU-US framework
The Commission adopts the "EU-US Data Privacy Framework" adequacy decision, which replaces the Privacy Shield invalidated in 2020 and once again secures transfers to US companies. source EUR-Lex (2023/1795) ↗
2nd European Commission review
A sharp rise in penalties against large tech companies, but divergences persist between national authorities. The Commission recommends better support for SMEs. source EUR-Lex (COM 2024) ↗
Proposed simplification for SMEs
As part of its single market simplification package, the Commission proposes extending to 750 employees (instead of 250) the exemption from keeping a full record of processing activities (art. 30), limited to "high-risk" processing. This is a proposal, not yet a text in force. source European Commission ↗
Agreement on common procedural rules
The Council and the European Parliament reach a political agreement on additional procedural rules to harmonize how national supervisory authorities cooperate during cross-border investigations. Formal adoption and publication in the Official Journal remain to be confirmed. source European Commission ↗
Timeline compiled from official sources (EUR-Lex, CNIL, Légifrance, European Commission) consulted on 18 July 2026. The last two steps are proposals or political agreements still in progress. This is an educational summary and does not constitute legal advice.
GDPR penalties, in plain terms
The scary figure - "20 million euros" - is everywhere, but it does not explain how it actually works. Here, backed by official sources, is who imposes penalties, how, and for what real amounts.
or up to 2% of the company's total worldwide annual turnover (whichever amount is higher applies).
Tier applicable to "common" breaches: record of processing activities, data security, processor obligations, missing impact assessment...
or up to 4% of worldwide annual turnover (same rule, whichever amount is higher applies).
Tier applicable to the most serious breaches: absence of a legal basis, violation of individuals' rights, unlawful transfers outside the EU...
Who decides? The CNIL's restricted committee
It is not the "general" CNIL that imposes penalties, but a separate, independent body: the restricted committee ("formation restreinte"), made up of 5 members and a chair different from the CNIL's own chair. It alone investigates cases and issues sanctions. The most significant decisions are made public.
What makes the actual amount vary
Article 83 of the GDPR requires the CNIL to take several criteria into account before setting a fine, notably:
- the severity, nature and duration of the breach
- whether it was intentional or merely negligent
- measures already taken to reduce the damage
- cooperation with the CNIL and prior breaches
- the categories of data involved
Before the fine: a graduated response (article 58 of the GDPR)
- Warning
- Reprimand
- Formal notice
- Compliance order
- Administrative fine (art. 83)
| Date | Organization | Amount | Grounds |
|---|---|---|---|
| 21/01/2019 | Google LLC | 50 M € | Lack of transparency, no valid consent for personalized advertising |
| 07/12/2020 | Amazon Europe Core | 35 M € | Cookies placed without prior consent |
| 31/12/2021 | Google LLC / Google Ireland | 150 M € | Refusing cookies made more complicated than accepting them |
| 31/12/2021 | Facebook Ireland (Meta) | 60 M € | Same grounds: refusing cookies made too difficult |
| 17/10/2022 | Clearview AI | 20 M € | Facial recognition without a legal basis, refusal to cooperate |
| 10/11/2022 | Discord Inc. | 800 000 € | Excessive data retention, insufficient security and information |
| 15/06/2023 | Criteo | 40 M € | Breaches relating to cookie consent and individuals' rights |
What about a smaller organization? Proportionate amounts
The CNIL also sanctions small and medium-sized organizations, but with amounts far below those imposed on international groups. From the December 2025 decisions alone, examples include: 5 000 € for a hotel management company (non-compliant video surveillance), 7 000 € and 5 000 € for two newspaper publishing companies (invalid cookies), 10 000 € for an airport freight company (unlawful video surveillance), or 20 000 € for a university (purposes not respected). At the other end of the scale, a services-sector company was fined 3.5 M € the same month for a combination of serious breaches (security, transparency, cookies). The amount follows the severity and size, not the other way around.
Your supervisory authority, by country
In Europe, each country has its own authorities. Here, for the 30 countries of the European Economic Area, is the data protection authority (your GDPR contact) and the national cybersecurity authority. Each name links to the official website.
Sources: official authority websites and the EDPB members list (edpb.europa.eu), consulted on 18 July 2026. Data protection authorities confirmed: 30/30. Cybersecurity authorities confirmed: 28/30. The "to be confirmed" notes indicate an official source not yet stabilized as of this date.
Your own Microsoft 365: the free score
SYAGA Audit reads the security configuration of your Microsoft 365 and gives you a free score, point by point. It is read-only: within the limits of the rights Microsoft allows to grant for pure reading, and even where a right would allow acting, we only read. This score does not replace an audit by an independent professional.