Protection of personal data

Verified 13 May 2026 - Public Service / Directorate of Legal and Administrative Information (Prime Minister)

A company, an administration, a social network or an artificial intelligence wants treat your personal data ? In some cases, you may object or consent to it and then withdraw your consent. You can also access the collected data, retrieve it, request its rectification and erasure. In case of difficulties, you can address a complaint to the Cnil: titleContent. Here is the information you need to know.

Warning  

Some different rules apply to judicial police files, judicial files and at bank account file (Ficoba).

In some situations, you may object to a personal data be the subject of a treatment. That's what we call the right to object..

The right to object is granted where the processing of data is based on one of the following grounds:

  • Performance of a task in the public interest, falling within the exercise of public authority (e.g. retention of data for the purpose of combating tax evasion)
  • Legitimate interest of the controller (e.g. video recordings of a store to prevent theft)

It may also be exercised when the treatment pursues one of the following purposes:

  • Commercial, charitable or political prospecting (for example, you may refuse to appear in a file to avoid receiving promotional offers or election campaign emails)
  • Scientific, historical or statistical research (e.g. data collection for a statistical study on the purchasing power of a population).

The conditions for exercising your right of objection are facilitated for prospecting cases.

Répondez aux questions successives et les réponses s’afficheront automatiquement

Commercial, associative or political prospecting

To exercise free of charge If you have the right to object, you must send a request to the data controller concerned. To get its coordinates, you can consult the website of the organization that collected your data.

The request can be made by email, by an online form proposed by the controller or by postal mail.

You can use a mail template:

Oppose the processing of your personal data - Prospection

Warning  

Keep a copy of your procedure so that you can make a claim if necessary.

From the moment when the controller has received your request, it can no longer use your data for prospecting purposes.

In the absence of a response, you can make a complaint to the Cnil: titleContent :

Submit a complaint online to the Cnil

FYI  

Multiple devices They are also available to protect you against abusive telephone solicitation, voice or SMS spam.

Other

You can exercise free of charge your right to object provided that you justify legitimate reasons specific to your particular situation. In your request, specify the data concerned and explain why you object to their processing.

Your request must be addressed to the data controller concerned. To get its coordinates, you can consult the website of the organization that collected your data.

The request can be made from an online form, by email or by post.

Mail templates are available on the Cnil: titleContent :

Oppose the processing of your personal data

FYI  

In case of doubt about your identity, the organization can ask you for documents to prove it. This avoids any identity theft.

Keep a copy of your procedure so that you can make a claim if necessary.

When the controller receives your request, he has 1 month to answer you.

If they need more time, they must inform you within one month of receiving your request. In total, the response time cannot exceed 3 months.

Please note

During this period, you can request that your data is no longer used. This is the right to restriction of processing.

If the request is accepted, the data controller concerned can no longer use your data. Nevertheless, he keeps them.

If your request is rejected, the controller must explain the reasons for this refusal.

In the absence of a response or if the response does not satisfy you, you can make a complaint to the Cnil: titleContent.

Submit a complaint online to the Cnil

When the treatment of your data requires your consent (for example, processing for commercial prospecting purposes, processing of sensitive data (except exceptions), processing that uses non-mandatory cookies), you must give your consent by a statement or by any other clear positive act (for example: a check box).

You can withdraw your consent at any time, by means of a simple device similar to that used to obtain its consent.

If you withdraw your consent, your data can no longer be processed: your data is deleted from the medium on which it was stored and can no longer be used.

Example :

A real estate agency publishes a post on social networks inviting interested people to fill out a registration form to receive property addresses and visiting times. By completing this form, you provide certain personal data. Before sending this document, you check a box that indicates that you agree that your data will be used to send you real estate offers.

1 year later, you delete your consent by unchecking the box of the previously completed form, because you no longer wish to receive offers from this agency. From that moment on, the real estate agency must delete your data from its database.

You can find out if your data are the subject of a treatment, and if they are, get a copy in plain language.

To access the personal data collected, you must contact the controller who holds this information. To get its coordinates, you should consult the website of the organization that collected your data.

In principle, the application is free of charge. However, the controller may ask you to pay a fee if you request an additional copy of the documents containing your personal data.

The request can be made from an online form, by email or by post.

Mail templates are available on the Cnil: titleContent :

Exercise your right of access to personal data

Warning  

Keep a copy of your request in case you wish to appeal against the decision of the controller.

The controller must respond to you as soon as possible and, at the latest, within 1 month of receipt of your request.

This period can be extended to 3 months if your request is complex or due to the number of requests.

Please note

In case of doubt about your identity, the organization may ask you for information to confirm it. For example, to avoid a identity theft.

When transmitting a copy of your data to you, the controller must also provide you with other information (e.g. purpose of processing, data retention period, right to rectification or erasure, etc.).

If you have sent your request by e-mail, the controller must respond to you by e-mail, unless you wish to obtain a response by another means (e.g. by post).

FYI  

If your request is unfounded or if you repeatedly make several requests, the controller may refuse to provide you with your data. Furthermore, you cannot obtain data about other people.

In the absence of a response or in the event of an unsatisfactory response, you can address a complaint to the Cnil: titleContent.

Submit a complaint online to the Cnil

You can request to recover the data you have provided to an entity (company, social network, etc.), for personal use or to transmit it to an organization of your choice. That's what we call the right to portability.

The right to portability concerns 2 types of data:

  • Those that the entity has retrieved with your consent or on the basis of a contract (for example, your contact details)
  • Those that were generated after an action on your part (purchase history, data recorded by a smartwatch, etc.).

Example :

You sign a contract with a music streaming provider. For several months, you listen to different titles and make playlists. Then, you decide to change supplier. In this case, you can ask at 1er Provider to transmit this data (playlists, listening history, etc.) to you in order to keep it and/or to transmit it to the provider with whom you have concluded a new contract.

Please note

The exercise of the right to portability shall not affect the rights and freedoms of other persons.

To exercise your right to portability, consult the website of the organization that collected your data. In principle, the steps to be taken are specified (for example, after you have authenticated on your customer account, you have access to a button to download your data).

In case of difficulties, contact the qualified person to help you exercise your right to portability. His coordinates are normally listed on the website of the body concerned.

FYI  

Regardless of the process used, this approach is always free of charge.

The controller must respond to you as soon as possible and, at the latest, within 1 month of receipt of your request.

If they need more time, they must inform you within one month of receiving your request. In total, the response time cannot exceed 3 months.

If your request is accepted, you can directly upload your data or obtain it on a computer file transmitted by the organization.

In the absence of a response or in the event of an unsatisfactory response, you can make a complaint to the Cnil: titleContent.

Submit a complaint online to the Cnil

If you believe that the data collected is inaccurate or incomplete (e.g. an error in the spelling of your surname or the updating of your telephone number), you can request that it be corrected or updated. That's what we call the right of rectification.

You can request the rectification of your data in a free of charge.

The request can be made from an online form proposed by the controller, by e-mail or by post. To get its coordinates, you should consult the website of the organization that potentially collected your data.

Your request must specify the data you wish to have corrected. If your data is incomplete, you must provide a document to add the missing information.

Mail templates are available on the Cnil: titleContent :

Request the rectification of your personal data

Keep a copy of your procedure so that you can make a claim if necessary.

The controller must respond to you as soon as possible and, at the latest, within 1 month of receipt of your request.

FYI  

In case of doubt about your identity, the organization may ask you for information to confirm it. For example, to avoid a identity theft.

If they need more time, they must inform you within one month of receiving your request. In total, the response time cannot exceed 3 months.

During this period, you can request that your data be no longer used by the organization. This is the right to restriction of processing.

In the absence of a response or in the event of an unsatisfactory response, you can make a complaint to the Cnil: titleContent :

Submit a complaint online to the Cnil

Once your data has been rectified, the controller informs all the organizations to which your data has already been communicated that this information has been rectified.

In certain circumstances, you may request that your personal data be erased. We're talking about the right to be forgotten.

The requests can be various: deletion of an account on a site or a platform, deletion of content showing personal data, a photo or video, etc.

Under what conditions can you request the erasure of your data?

To request the erasure of your personal data, you must be in one of the following situations:

  • Your data is no longer necessary for the purposes for which it was collected and processed
  • You withdraw your consent to the use of your data and there is no other legal basis for their processing (performance of a contract, safeguarding vital interests, etc.)
  • You object to the processing of your data and this processing does not respond to a compelling legitimate reason (for example, data processing to follow the evolution of a disease)
  • You object to your data being used for commercial, associative or political prospecting
  • Your data has been processed unlawfully. For example, treatment of your so-called “sensitive” data except where permitted
  • Your data must be deleted to comply with a legal obligation
  • Your data has been collected by a online service when you were a minor.

How to obtain the erasure of your personal data?

Your request must be addressed to the data controller concerned. To get its coordinates, you can consult the website of the organization that collected your data.

The request can be made from an online form, by email or by post.

Mail templates are available on the Cnil: titleContent :

Request the erasure of personal data

Warning  

Be as specific as possible by specifying precisely which data should be deleted. In addition, keep a copy of your procedure to be able to make a claim if necessary.

The controller must respond to you as soon as possible and, at the latest, within 1 month of receipt of your request.

If the organization needs more time, it must inform you within one month of receiving your request. In total, the response time cannot exceed 3 months.

The organization may refuse your request in certain limited cases. For example, if erasure prevents the exercise of the right to freedom of expression and information.

In other cases, your application must be accepted. In case of acceptance, the deletion of the content can be carried out in 3 ways:

  • Your personal data is completely deleted
  • The content in which your data appears is made inaccessible to the public. It can remain stored in a file for archiving purposes
  • Your personal data is anonymised so that you are no longer identifiable.

Please note

If your personal data has been made public by an organization and it must erase it, it must inform the other organizations that process your data of your request for erasure.

In the absence of a response or in the event of an unsatisfactory response, you can make a complaint to the Cnil: titleContent :

Submit a complaint online to the Cnil

The right to de-referencing allows you to ask a search engine to delete search results from your first and last names (example: an old CV).

Warning  

If the information is no longer accessible from the search engine, it remains visible on the source website.

To make a request for de-referencing, you must contact the search engine manager by mail or through a dedicated form (most search engines offer an online form). Whatever the process used, this approach is free of charge.

In your request, specify the web address (URL) of the result to be deleted and explain why you want it deleted.

Keep a copy of your procedure so that you can make a claim if necessary.

The person responsible for the search engine must reply to you as soon as possible and, at the latest, in a delay of 1 month following receipt of your request.

If they need more time, they must inform you within one month of receiving your request. In total, the response time cannot exceed 3 months.

Please note

In case of reasonable doubt about your identity, the search engine may ask you for information to confirm it.

De-referencing is not automatic: the search engine analyzes your request to see if it can, or not, respond favorably.

The search engine can refuse your request if it proves that the information concerned must be communicated to the public (for example: information concerning a person with a role in public life).

In the absence of a response or if the response does not satisfy you, you can make a complaint to the Cnil: titleContent :

Submit a complaint online to the Cnil

FAQ