The CNIL (National Commission on Informatics and Liberties) regulates the collection and processing of personal data in France. For any website that collects information about its visitors, whether through a contact form, newsletter registration, or customer account, compliance with the GDPR involves specific and verifiable obligations.
Blocking scripts and proof of cookie consent: the real checkpoint
Most guides on CNIL compliance mention the cookie banner without detailing what actually triggers a check. The issue is not limited to displaying a banner on your site.
The CNIL requires that the refusal button be as visible as the acceptance button. No pre-checked boxes, no misleading designs that push towards “accept all.” Visitors must be able to choose by purpose: audience, advertising, social networks, embedded videos.
The requirement goes further. As long as the visitor has not given their consent, non-essential third-party scripts must be effectively blocked. An unexempted analytics tool, a Google Maps embed, a chat widget, or an embedded YouTube video cannot load before explicit consent. Displaying a banner without blocking scripts amounts to doing nothing from a regulatory standpoint.
The current control practice recommends documenting proof of consent (date, choice made, version of the banner displayed) and keeping it for at least six months. In case of verification, this proof will be requested. To fully understand the steps for declaring to the CNIL, this technical dimension must be integrated from the design phase of the site.
Data processing register: what your site must record
The data processing register is the foundational document for GDPR compliance. This internal document records each operation of personal data collection performed by your website.
For a showcase site with a contact form, the register remains simple. For an e-commerce site or a platform with a client area, it quickly becomes more complex. Each processing activity must be documented with a description of:
- The specific purpose of the processing (customer loyalty, prospecting, order management, visitor statistics)
- The categories of data collected (first name, last name, email address, postal address, banking data)
- The individuals or services that have access to this data (sales team, hosting provider, payment tool)
- The retention period planned for each category of data
A often overlooked point: technical subcontractors. Your hosting provider, payment solution, and newsletter sending tool process personal data on your behalf. They must be included in the register along with the associated contractual guarantees.
Obligations of showcase sites: four compliance points targeted by the CNIL
Small showcase sites are now explicitly within the CNIL’s control scope. Four minimum obligations apply, even without e-commerce activity.
The first concerns legal notices and the privacy policy. Your site must display the identity of the data controller, the purposes of each collection, the legal basis used (consent, legitimate interest, contractual obligation), the rights of individuals, and contact details for exercising those rights.
The second pertains to the contact form. Each field must be justified by the declared purpose. Asking for a phone number on a form whose sole purpose is to respond by email raises a data minimization issue, a fundamental principle of the GDPR.
Right of access and right to erasure
Your site must allow individuals to easily exercise their rights. The right of access allows anyone to request what data you hold about them. The right to erasure allows them to request its deletion.
In practice, this means having a clearly identified email address or dedicated form in the privacy policy. The maximum response time is one month. Failure to respond or a process that is too complex constitutes a sanctionable breach.
Securing personal data on your website
Data protection is not limited to documentation. The CNIL also checks the technical measures in place to prevent leaks and unauthorized access.
The SSL certificate (HTTPS) is an absolute minimum. A site that collects personal data via a form in HTTP transmits this information in clear text over the network. This point is systematically checked during audits.
Beyond connection encryption, three technical measures deserve special attention:
- Regular updates of the CMS (WordPress, Prestashop, Joomla) and its extensions, as known vulnerabilities are quickly exploited
- Restricting access to databases containing personal information, with strong passwords and enhanced authentication for administrator accounts
- Notification of data breaches to the CNIL within 72 hours in case of a security incident affecting personal data
This notification obligation is often overlooked by small site operators. An intrusion into your hosting, unauthorized access to your customer database, or a data leak via a faulty plugin triggers this obligation, regardless of the size of your organization.
GDPR compliance for a website relies on concrete and documented actions: effective blocking of trackers before consent, up-to-date processing register, readable privacy policy, and verifiable security measures. The size of the site does not change the obligations; it only changes the complexity of the register.
