Law No. 2014-038, sensitive personal data

Loi n° 2014-038, arts. 18-19 (données sensibles)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 9 January 2015.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process sensitive data, including racial origin, biometric, genetic, political opinion, religious or other belief, trade union, health, or sex-life data, unless one of the law's listed exceptions applies, such as the data subject's express consent.
Where an exception permits sensitive data to be processed, put in place the safeguards the law or the CMIL requires for that exception.
Restrict processing personal data about offenses, convictions, or safety measures to a court, a public authority managing a public service acting within its legal powers, or a legal auxiliary acting within the strict needs of a legally assigned mission.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 18 bars all processing of sensitive data because of the risk of discrimination and harm to a person's freedoms, and defines sensitive data to include racial origin, biometric data, genetic data, political opinions, religious or other convictions, trade union membership, and data concerning health or sex life.

It then lists the exceptions under which sensitive data may be processed with appropriate safeguards the law or the CMIL defines: the data subject's express consent unless the law bars lifting the prohibition that way, safeguarding the life of the data subject or a third party where the data subject cannot consent, processing by a nonprofit religious, philosophical, political, or trade union body limited to its own members or regular contacts, establishing, exercising, or defending a legal right, preventive medicine, medical diagnosis, care, or health-service management carried out by a health professional or another person bound by professional secrecy, public-interest health research the patient has not opposed, data the data subject has made public, and a public interest the law or the CMIL authorizes under article 46.

Article 19 restricts processing personal data relating to offenses, convictions, and safety measures to courts and public authorities managing a public service acting within their legal powers, and to legal auxiliaries for the strict needs of the missions the law assigns them.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
handles_health_records

Read the law

Text of Loi n° 2014-038 reproduced by the Association francophone des autorités de protection des données personnelles (AFAPDP)
not an official government-published copy

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app