Law note · France

GDPR Chapter V, Cross-Border Transfer Restrictions

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. A CNIL guidance page confirmed by direct fetch lists exactly this toolkit, plus administrative arrangements for public-authority exchanges requiring CNIL authorization, and names no France-specific localization mandate beyond it.

What it asks of an app

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in France outside the EEA.

When LexLint raises it

Declared activities: crawls_web, trains_models

Primary source: GDPR Arts. 44-49, 83(5)
CNIL, "Transferer des donnees hors de l'UE" (direct fetch)

← Back to the example  ·  Lint your app →