Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement

Loi n° 24.001, Chapitre II et Chapitre VI (droits liés au traitement, prospection directe)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Get a person's prior consent before contacting them with direct marketing by phone, fax, SMS, email, instant message, or social network, and let them unsubscribe or change their preferences at any time.
Give every marketing communication, including one sent to a business or a professional contact, a notice and an unsubscribe mechanism as simple and effective as the original sign up.
On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.
Let a person object, at any time and free of charge, to processing of their data where they show a legitimate reason, and answer an access request free of charge, on the spot or remotely, without delay, handing over a copy of the data on request.
Correct, complete, update, block, or erase personal data on a substantiated request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, and notify any third party you disclosed it to of the change without delay.
You may refuse a manifestly abusive, repeated, or systematic request, but carry the burden of proving the abuse if the person disputes your refusal.
Where a request concerns data processed for State security, defense, or public safety, expect the data protection agency, not the data subject directly, to route the access or rectification request.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Anyone with a legitimate reason has the right to object, at any time and free of charge, to the processing of personal data concerning them, and the agency assesses whether a contested reason is legitimate.

A person may obtain, on request, information about the purposes of the processing, the categories of data processed, and the recipients or categories of recipients the data are communicated to, along with the information letting them understand and contest the mechanism of an automated decision that produces legal effects for them.

The person exercises the right of access free of charge, on the spot or remotely, without delay, and receives a copy of their data on request, and where the access concerns health data the controller may communicate it through the physician the person designates. A controller may refuse a manifestly abusive request, repeated or systematic, from the same person, but bears the burden of proving the request was abusive if the refusal is disputed.

On a substantiated request, a person may require a controller to rectify, complete, update, block, or erase personal data concerning them that is inaccurate, incomplete, ambiguous, outdated, or unlawfully collected, used, communicated, or retained, and where the controller had disclosed the data to a third party it must notify that party of the change without delay.

Where a processing activity concerns State security, defense, or public safety, the rights of access and rectification are exercised indirectly, without the data subject's consent, through a request the agency routes to the controller.

Direct marketing by phone, fax, SMS, email, instant message, or social network needs the recipient's prior consent, the recipient must be able to unsubscribe or change their preferences at any time, and where the marketing targets a business or a person acting professionally the controller must still give notice and an unsubscribe option in every communication, as simple and effective as signing up was.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Text of Loi n° 24.001 portant protection des données à caractère personnel
archived copy of the Autorité de Régulation des Communications Électroniques et de la Poste (ARCEP) publication

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived June 22, 2026. Publisher's page: https://www.arcep.cf/fr/images/documents/reglementation/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app