Data Protection & GDPR Compliance lawyers
DELCADE, a practice dedicated to GDPR compliance, the handling of CNIL investigations and the protection of your personal data
The protection of personal data has become an unavoidable regulatory priority for every business, whatever its size or sector. The General Data Protection Regulation (GDPR) imposes concrete obligations on data governance, the security of processing operations and transparency towards data subjects. Failure to meet them exposes organisations to significant fines from the CNIL (the French data protection authority), as well as to growing reputational and contractual risks.
Our IT and Data lawyers advise companies, start-ups and large groups on bringing their data processing into compliance, handling data subject requests, managing CNIL audits, investigations and disputes, and preventing and responding to crises arising from data breaches. We act in both advisory and litigation contexts, with a practical, operational approach geared to your priorities.
GDPR Compliance
GDPR is not a mere administrative formality: it calls for precise mapping of processing operations, rigorous documentation and a suitably adapted internal organisation. Our lawyers conduct full compliance audits and build with you a lasting compliance programme, proportionate to your activity, the categories of data processed and your exposure to risk.
Our work covers in particular:
- Auditing and mapping data processing operations (record of processing activities)
- Drafting privacy policies, legal notices and information notices
- Implementing consent collection mechanisms
- Conducting data protection impact assessments (DPIAs), in particular where sensitive or health data is involved
- Framing data transfers outside the European Union (standard contractual clauses, BCR)
- Reviewing processing agreements to incorporate GDPR clauses (Article 28)
Exercising the GDPR Rights of Data Subjects
Access requests, particularly when they arise in a pre-litigation or employment context, require careful analysis to identify which data can be disclosed, protect the rights of third parties and secure the company’s response.
Our work covers in particular:
- The right of access
- The right to erasure (right to be forgotten)
- Other rights (rectification, restriction, portability, objection)
External Data Protection Officer (DPO)
Appointing a Data Protection Officer (DPO) is mandatory for many organisations and advisable for any whose activity relies on regular data processing. Our lawyers take on the role of outsourced DPO: a flexible, expert and immediately operational solution, without the constraints of an internal hire.
As your external DPO, we handle:
- Maintaining and updating the record of processing activities
- Advising business teams and management on projects involving data
- Acting as the interface with the CNIL and its counterparts abroad
- Training and raising awareness among staff
- Monitoring regulatory developments and translating them into operational terms
CNIL Audits and Investigations
A CNIL audit, whether conducted on documents, on site or online, can take place at any time, on the authority’s own initiative or following a complaint. Our lawyers assist you from the moment a CNIL request, audit or investigation is received, and represent you at every stage of the procedure, through to a formal notice or a sanction decision.
We act in connection with:
- CNIL audits (preparation, assistance during the procedure, responses to questionnaires)
- Formal notices and sanction proceedings
- Complaints and claims filed by data subjects
- Litigation before the Conseil d’état in the event of an appeal against a CNIL decision
Data Breaches and Crisis Management
A personal data breach or leak, particularly following a cyberattack, forces the company to act fast: notification to the CNIL within 72 hours, potentially mandatory communication to the data subjects, identification of the causes and implementation of corrective measures. Our lawyers operate within the crisis unit to structure the legal response, limit exposure and secure communications.
In the event of a breach, our work covers:
- Legally qualifying the incident and assessing the risk
- Drafting and filing the notification to the CNIL
- Drafting a criminal complaint, intended in particular for cyber insurers
- Communicating with the data subjects
- Coordinating with technical teams (IT and information security departments)
- Managing any subsequent litigation
Cookies and Online Advertising
Managing cookies and trackers is one of the areas most closely scrutinised by the CNIL. The authority’s guidelines and recommendations set precise requirements on collecting consent, informing users and configuring audience-measurement and ad-targeting tools.
Our lawyers advise website publishers, advertising networks and advertisers on:
- Auditing and bringing cookie banners and consent management platforms (CMPs) into compliance
- Drafting cookie policies and data charters
- Setting the legal framework for targeted advertising and retargeting campaigns
- Ensuring the compliance of audience-measurement tools (analytics, advertising pixels)
- Handling CNIL audits and formal notices relating to cookies