Blog

Making a CRM GDPR-compliant relies on three pillars: an appropriate legal basis (legitimate interest in B2B, consent in B2C), controlled retention periods, and a simple process for exercising data subject rights. Since August 2026, the AI Act has added transparency obligations for AI features integrated into CRMs.

GDPR automation involves industrializing the collection, follow-up, and consolidation of compliance information (processing registers, processor assessments, reporting) so that the DPO can focus on risk analysis. It replaces manual management in Excel, which is a source of errors and a lack of traceability.

Adequacy version 6.4, available since October 1, 2026, introduces a Security Accreditation module (part of the Adequacy Cyber option) that complies with ANSSI guidelines. It structures the process step-by-step, from defining the context to the accreditation committee's final decision. This update also enhances the Incident and Breach module with new settings and indicators, and adds three authorization groups for Control module reports.

In September 2026, three topics dominated the GDPR and AI Act landscape. The CNIL has issued guidance on B2B electronic invoicing: platforms (PDPs) are considered data processors, sensitive information must be coded, and MFA is now mandatory. The LINC has published its analysis of agentic AI, focusing on traceability, persistent memory, and data minimization. The EDPB has adopted Guidelines 04/2026, which harmonize the fine calculation process into five steps. Regarding enforcement, the Irish DPC has fined Google €403M, while the CNIL has sanctioned the Hôpital Privé de la Loire (€500,000) and EXTIA (€300,000).

After two years of delays, the transposition of the NIS 2 and CER directives into French law and the implementation of the DORA regulation are finally here. Both public and private organizations can no longer afford to wait. These regulations make cybersecurity a direct responsibility of executive leadership. They also shift the focus from a "best efforts" approach to a requirement for proven results: organizations must be able to identify risks, detect and report incidents, and rapidly restore operations. Given the volume of requirements—such as mapping, action plans, evidence, and compliance under Decree 2022-513—managing this via spreadsheets is no longer sufficient. Unified, purpose-built governance tools have become essential.

A GDPR compliance checklist helps ensure your organization meets the key requirements of the General Data Protection Regulation. It covers ten pillars: an up-to-date record of processing activities, clearly defined governance, identified legal bases for each process, compliant privacy notices, documented management of data subject rights, compliant processor contracts, an appropriate security policy, data breach management procedures, controlled retention periods, and documentation ready for a CNIL audit. It is used in five steps—inventory, assess, prioritize, remediate, and monitor—and should be reviewed at least once a year, as well as with any significant change: new processing, new tools, organizational shifts, or security incidents.

While the AI Act does not mandate a specific compliance checklist, it remains the most reliable way to demonstrate that you are meeting your obligations. The process consists of eight steps: inventory all AI systems used within the organization, classify them according to the four risk levels defined by the AI Act, identify applicable obligations based on your role in the value chain (provider, deployer, importer, or distributor), compile verifiable documentation, develop AI literacy among relevant teams, integrate the framework with the GDPR (which remains in effect), evaluate suppliers and models used—including GPAI—and schedule regular audits. Finally, ten checkpoints allow you to verify your organization's actual progress.

GDPR clauses in commercial contracts are not just a formality: Article 28 of the GDPR mandates a binding legal agreement whenever a processor handles data on behalf of a controller. This contract must specify the subject matter, duration, nature, and purpose of the processing, the type of data, the categories of data subjects, the obligation to act only on documented instructions, the duty to assist with data subject rights and breach notifications, and the required technical and organizational measures. The next step is a structural decision: use an integrated clause for simple data flows and standard data, or a dedicated Data Processing Agreement (DPA) when volumes, sensitivity, or sub-processing become complex. One point of vigilance you should never compromise on: the service provider's limitation of liability must not cover flagrant GDPR violations.

No, you don't have to accept cookies, except for technical cookies that are installed without your consent because they are essential for the site to function. Rejecting everything has no consequences in 95% of cases. The challenge is navigating the three types of banners: the "Reject All" button that complies with CNIL rules, the ghost button hidden in the top corners, and the cookie wall that forces you to pay or accept. For businesses, the question is reversed: a banner that flirts with illegality risks sanctions from the CNIL, and only a real map of trackers, linked to the register of processing activities, can prove compliance.

On paper, the GDPR limits the DPO to an advisory and oversight role. In practice, many remain stuck between being a "whistleblower" and an overworked professional single-handedly filling the gaps in governance. With the AI Act, this passive approach has reached its limit: by 2027, the DPO must become the driver of data governance for the executive board, leveraging a network of business liaisons, stronger collaboration with the CISO, and AI-driven automation of documentation to focus on risk assessment.

The accumulation of European regulations (GDPR, NIS 2, DORA, AI Act, CRA) is forcing organizations to launch multiple isolated compliance projects, risking team burnout and fragmented risk management. Rather than opening a new register for every new regulation, the GDPR and its accountability model can serve as a common hub: records of processing activities, DPIAs, and escalation paths naturally lend themselves to expansion into operational resilience, AI oversight, and digital product security. Three levers can help structure this monitoring for the long term: a cross-functional steering committee, a unified risk map, and harmonized supply chain governance.

The NIS 2 directive came into force in January 2023, but France is lagging in its transposition with the Resilience bill, which merges the cyber (NIS 2) and physical (REC) components. Meanwhile, countries like Belgium are already applying their national framework (CyFun), imposing contractual requirements on French suppliers. Given this gap, a wait-and-see approach is a strategic risk: ANSSI’s ReCyF framework allows you to anticipate the 20 expected security objectives today, while convergence with GDPR and the AI Act encourages organizations to centralize risk management rather than handling it in silos.

August 2026 was anything but quiet for regulators: the AI Act’s obligations for high-risk AI systems have come into force, the CNIL has issued guidance on training AI with health data (alongside a €2.5M fine for a SaaS provider), the EDPB has released guidelines on the "pay-or-consent" model, and the CJEU has delivered a major ruling expanding the definition of compensable non-material damage under Article 82 of the GDPR. Here is an overview of the key texts and a checklist for DPOs as they return from the summer break.

Adequacy 6.3.1, released on August 5, 2026, strengthens AI governance, DPIAs, the record of processing activities, and breach management. Highlights include: visual deadline alerts for AI assessments, new use case statuses, an automatic summary and EDPB-compliant editing for DPIAs, an event log for breaches, as well as a streamlined project workflow and better-governed media library.

Information security and personal data protection should no longer be treated in silos. ISO 27001 provides a common methodological framework to structure your ISMS, create concrete synergies with the GDPR (processing registers, DPIAs, breach notifications), and align with NIS2 and the AI Act. This article details the four-step methodology for implementing the standard, from gap analysis to internal audit, without burning out your operational teams.

Conducting an effective Data Protection Impact Assessment (DPIA) means moving beyond the administrative checkbox exercise to turn it into a genuine risk management tool. This article details when to trigger a DPIA using a quick diagnostic, how to make trade-offs for existing systems by prioritizing the most cost-effective measures (SSO, access rights, logs, backups, training), how to assess severity from the perspective of the data subjects, and how to integrate specific AI risks (explainability, bias, prompt injection) using the mirror test. Finally, it covers the DPO's role as an orchestrator and the benefits of using DPIA software to scale the process beyond the limitations of Excel.

July saw no slowdown in regulation: the CNIL ruled on email tracking (consent is mandatory unless strictly necessary for technical purposes), the AI Act entered a key phase with new transparency obligations for General Purpose AI (GPAI) models, the EDPB set strict criteria for defining anonymized data in AI training, and transfers to the US remain under legal scrutiny. This recap details the key points and concrete actions to integrate for the new season.

Excel quickly reaches its limits for managing GDPR and AI Act compliance: lack of audit trails, time-consuming manual follow-ups, and fragmented data. Conversely, dedicated DPO software automates data governance through dynamic mapping of the processing register and integrated management of DPIAs and AI Act compliance. This article details the essential features, the three selection criteria (usability, access management, and data sovereignty), and the measurable return on investment of such a tool.

GDPR compliance KPIs allow the DPO to demonstrate the effectiveness of their measures and engage with management using numbers rather than legal jargon. About fifteen indicators are sufficient, divided into four categories: maturity (registry completion, DPIA execution), risk and security (volume of breaches, notification time), operational and awareness (trained employees, response time for data subject requests), and efficiency (project validation time, vendor compliance). The dashboard must then be tailored to each stakeholder: a macro view for the Executive Committee, technical granularity for the CISO. An imperative driven by the accountability principle of Article 5.2 of the GDPR.

Compliance risk mapping involves identifying company data processing activities, evaluating each threat scenario by cross-referencing its severity and probability, and then prioritizing corrective actions based on their criticality. Inspired by risk management standards such as ISO/IEC 27005, the process relies on the record of processing activities, is materialized in a three-level GDPR risk matrix, and leads to a remediation plan aimed at achieving a tolerable residual risk. It allows you to move from reactive compliance to strategic management, justify budgets to the Executive Committee, and demonstrate your accountability to the CNIL. With the AI Act, it must now also incorporate algorithmic risks.

Synthetic data consists of artificial datasets generated by algorithms that mimic the statistical properties of real data without being derived from it. While they allow for training AI models and testing without using real data, they are not automatically exempt from GDPR. In its guidelines dated July 7, 2026, the EDPB established three cumulative criteria—individualization, correlation, and inference—that a dataset must meet in its entirety to be classified as anonymous. It also strictly regulates web scraping used to train generative models. Here is a breakdown of the rules and a compliance checklist for DPOs.

A CNIL inspection is not inevitable: the heaviest penalties affect companies unable to document their governance, not those that have made an isolated error. This guide details the four types of inspections, the triggering factors, the two major points of vigilance for inspectors (data breach notification within 72 hours, management of data retention periods), as well as the method for structuring your defense through a GDPR compliance audit and aligned AI Act governance. You will also find the 5 documents to produce in less than 30 minutes in case of an on-site inspection and the details of the GDPR penalties incurred.

June 2026 marks a regulatory turning point for DPOs and legal professionals: the Court of Auditors delivers an uncompromising assessment of the CNIL, while the law of June 30, 2025, mandates a shift to strict opt-in for B2C cold calling from August 11, 2026. On the artificial intelligence front, the AI Office is finalizing its Codes of Conduct for GPAI model providers, with direct implications for auditing your AI subcontractors. Finally, the G7 Privacy meeting in Paris and Microsoft France's admission regarding the Cloud Act reignite the debate on digital sovereignty. Here's what you need to know to manage your GDPR and AI Act compliance this month.

Recruitment is among the CNIL's top inspection priorities. From automated screening and social media sourcing to CV retention, every step involves your responsibility. Retention limited to two years in an active database then five years in an archive, mandatory human oversight for AI decisions, informing candidates: these are the practical rules to secure your recruitment processes without hindering your sourcing efforts.

GDPR compliance is no longer a one-off project but a continuous and strategic process. For the DPO, Legal Director, or CISO, the GDPR dashboard becomes the central tool for centralizing, measuring, and managing this compliance daily. It helps identify bottlenecks, allocate resources where the risk is critical, and translate technical indicators into business value for the Executive Committee. This article details the essential KPIs (operational monitoring and risk management), the reporting method for the Executive Committee, and the upcoming convergence between GDPR and the AI Act.