Commission Nationale de l'Informatique et des Libertés
FranceFrance's independent data protection authority, created by the Act of 6 January 1978. Publishes an English-language guidance estate that includes the PIA guides and free PIA software.
- Jurisdiction (head office)
- France
- Scope covered
- France
- Type
- Data protection authority
- GRC discipline
- Data protection & privacy
- Statutory / official basis
- GDPR; Loi Informatique et Libertés (Law 78-17 of 1978, as amended)
- Status
- Current — verified 15 September 2026
- Versions & language
- cnil.fr in French, with a substantial English section (cnil.fr/en).
Why it matters
The CNIL matters to practitioners outside France for a practical reason: it publishes working tools, in English, that drop into UK GDPR work. The PIA suite — a methodology, templates and a knowledge base of controls, with a free open-source PIA software tool — is a complete DPIA method the CNIL states is consistent with the WP29 DPIA guidelines (WP248 rev.01), and the knowledge base doubles as a control catalogue for Article 32 conversations. More recently the CNIL has published an English practical guide on transfer impact assessments, its personal-data security guide, and recommendations on mobile apps and AI.
Institutionally, the CNIL is among the oldest data protection authorities in Europe: created in 1978 in response to the SAFARI centralised-database controversy — pre-dating both the EU data protection directive and the GDPR — with an 18-member college, investigation powers and a separate restricted committee for sanctions. The UK position: CNIL guidance has no legal force in the UK, and its methods are one authority’s view of GDPR obligations that UK GDPR states in nearly identical terms — which is precisely what makes the tooling reusable, with the divergences (the Data (Use and Access) Act 2025 reforms on the UK side) checked case by case.