Laws and data licensing
France: privacy laws and AI data licensing
Short answer
If your records include people in France, the main rules are: EU GDPR plus the French Data Protection Act; the CNIL is the regulator.
In short
- Country
- France
- Main privacy laws
- EU GDPR plus the French Data Protection Act; the CNIL is the regulator.
- Note
- The CNIL has published guidance on AI training data.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
The CNIL has published guidance on AI training data.
For suppliers#
- SourceX works with businesses based in France, and their records may include customers abroad
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Frequently asked questions
Which privacy laws apply to records about people in France?
EU GDPR plus the French Data Protection Act; the CNIL is the regulator. The CNIL has published guidance on AI training data.
Can a company based in France license its data through SourceX?
Yes. SourceX works with companies based in France, and U.S. companies are its priority. Records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in France?
Records tied to France are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.