General Data Protection Regulation

• Inform the data subjects clearly and accessibly about the use of their data (purpose, retention period, rights, etc.).
• Justify a legal basis for each processing (consent, contract, legitimate interest, etc.).
• Respect the rights of data subjects (access, rectification, erasure, objection, etc.).
• Ensure the security of personal data: appropriate technical and organizational measures must be implemented to protect data against risks of loss, unauthorized access, or disclosure.
• Document all processing activities in a record, especially starting from 250 employees or in the case of sensitive or non-occasional processing.
• Notify data breaches to the CNIL (or other competent authority) within 72 hours, and sometimes, to the affected data subjects.
• Frame relationships with subcontractors through formalized contracts, to ensure their compliance with GDPR requirements and clarify each party's responsibilities.

The GDPR prohibits the collection and use of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as the processing of genetic data, biometric data allowing for the unique identification of a person, health information, or data related to an individual's sexual life or sexual orientation.

However, there are exceptions to this prohibition, including:

• If the data subject has given explicit consent, which must be free, specific, informed, and preferably in writing.
• If the information has been manifestly made public by the data subject.
• If this data is necessary for the protection of human life.
• If its use is justified by a public interest and authorized by the CNIL.
• If it concerns members or affiliates of an association or political, religious, philosophical, or trade union organization.