CNIL Commission nationale de l'informatique et des libertés.

The CNIL is the supervisory authority that turns European data-protection law into concrete consequences inside France. It predates the GDPR by decades, which is why its remit is broader than enforcement alone: it advises the government on draft legislation, accredits and audits, runs public-facing guidance, and acts as the single point of contact for both data subjects who complain and controllers who report breaches. For a French organisation, the CNIL is the practical face of compliance. It is the body that answers your questions, the body that inspects you, and the body that decides whether a problem ends in a warning or a fine.

What the CNIL actually does

Treat the CNIL as four overlapping functions rather than a single regulator. First, it produces guidance that becomes the operational baseline in France: its cookie rules, its biometrics and recruitment frameworks, and its position papers on artificial intelligence are read as what good looks like, even where the underlying GDPR text is general. Second, it runs the supervisory dialogue, handling complaints, controlling organisations through documentary review and on-site inspection, and issuing formal notices to comply. Third, it sanctions, with the power to issue binding corrective measures and administrative fines. Fourth, it equips practitioners with tools, most visibly the PIA software used to structure a data protection impact assessment.

Most controllers never see the headline-fine version of the CNIL. They see the dialogue version: a request for documents, a question about lawful basis, a formal notice setting a deadline to fix something. Bringing your records of processing, your impact assessments, and your DPO arrangements into order is what keeps an interaction in that lower register.

CNIL, GDPR, and the EU one-stop-shop

The CNIL does not write the law it enforces. The GDPR is the regulation; the CNIL is one of the national supervisory authorities that apply it. That distinction matters for cross-border processing. Under the one-stop-shop mechanism, an organisation with its main establishment in France deals primarily with the CNIL as lead authority, and the CNIL coordinates with other European authorities through the cooperation and consistency procedures rather than acting in isolation. For purely domestic processing, the CNIL acts on its own. The CNIL is also among the more active authorities in the EU, so its reasoning and its sanction decisions are studied well beyond France as an indication of where European enforcement is heading.

This is also where the roles around it click into place. The GDPR creates obligations; the DPO is the role inside the organisation that monitors compliance and serves as the contact point to the authority; the CNIL is the authority on the other end of that contact. A practitioner who can explain how those three relate is rarely the one caught out during an inspection.

What practitioners do with the CNIL

In practice, working well with the CNIL is mostly preparation rather than reaction. The concrete habits are consistent across mature French organisations.

• Map current CNIL guidance to your own processing, especially cookies, biometrics, recruitment, and any AI-driven decisions, and keep that mapping current.
• Maintain the accountability evidence the CNIL asks to see first: the record of processing activities, completed impact assessments, and the documented basis for each processing purpose.
• Use the CNIL PIA tool to structure impact assessments so the output speaks the authority's own language.
• Know your breach-notification path in advance, so a reportable incident becomes a process rather than a scramble.
• Treat a formal notice as a deadline-driven project, not a negotiation, and document every step you take to comply.

None of this is exotic. It is the same accountability discipline the GDPR demands, organised so that the one body most likely to ask for it can be answered quickly and credibly.