Since the implementation of the GDPR in May 2018, the old preliminary declaration formalities with the CNIL have been removed for the vast majority of data processing related to a website. The compliance mechanism now relies on a logic of accountability: each organization must document its own processing activities and be able to prove its compliance at any time.
Processing Register: the centerpiece that replaces the CNIL declaration
The old system distinguished between simplified declaration and normal declaration. A site collecting email addresses via a newsletter or contact form had to obtain a receipt from the CNIL before processing this data. This regime no longer exists.
Today, the compliance of a website involves the register of processing activities. This internal document lists every operation involving personal data: purpose, categories of data collected, retention periods, security measures. It must be presented in case of an audit.
For a showcase site with a contact form, the register remains simple. For an e-commerce site storing bank details and purchase history, the entries multiply. The granularity of the register reflects the actual complexity of the processing, not the size of the company.
In practical terms, following a simplified CNIL declaration procedure means structuring this register and documenting each processing activity according to GDPR requirements, without waiting for a receipt or registration number.
Consent and cookies: the controls that the CNIL targets as a priority
The management of consent on a website has become the primary reason for complaints to the CNIL. Poorly configured cookie banners, pre-checked boxes, or the absence of a refusal mechanism as simple as the acceptance one generate regular reports.
The CNIL has adopted a simplified sanction procedure to quickly address common violations. Since January 2026, 23 sanctions have been issued in this context, the majority following user complaints. This mechanism allows for sanctions without going through the complete restricted training, which speeds up processing times.
The points checked during an audit of a website cover several concrete aspects:
- The presence of a cookie banner allowing acceptance or refusal of trackers with the same ease, without misleading design
- The effective placement of cookies before any action by the user (non-essential cookies must not load before explicit consent)
- The retention of a timestamped proof of consent, accessible upon request from the CNIL
- The existence of an accessible privacy policy, describing the processing activities, retention periods, and user rights
A site that ticks these four boxes covers the majority of risks identified by the CNIL regarding common web processing.
Responding to user rights: the most underestimated obligation
Many site managers focus their efforts on the cookie banner and privacy policy but neglect the management of rights exercise requests. The GDPR grants individuals the right to access, rectify, erase, and port their data.
A user can request at any time what data a site holds about them or demand its deletion. The data controller has one month to respond. Failure to respond or a late response constitutes a sanctionable violation.
Establishing a request processing circuit
For a small site, a dedicated form or a specific email address (like [email protected]) is sufficient. The goal is to track each request received, the date of receipt, and the response provided.
This traceability directly feeds into the processing register. In case of an audit, the CNIL verifies not only the existence of a contact channel but also the actual ability to locate and delete the data of an identified person in the site’s databases.
PIA and special cases: when basic compliance is no longer enough
The data protection impact assessment (PIA) is not required for all sites. It becomes mandatory when a processing activity poses a high risk to the rights and freedoms of individuals: systematic profiling, collection of sensitive data (health, political opinions), large-scale surveillance.
A typical e-commerce site generally does not fall within this scope. However, an online health platform offering teleconsultations, or a site collecting biometric data for authentication, must conduct a PIA before the processing goes live.
Data transfers outside the European Union
The use of analysis or hosting tools located outside the EU (such as American cloud services) imposes additional guarantees. The data controller must verify that the provider offers an adequate level of protection, through standard contractual clauses or a decision of adequacy from the European Commission.
Documenting the choice of each subcontractor in the register allows for demonstrating this verification. The CNIL has sanctioned several sites for transferring data to American servers without sufficient contractual safeguards.
GDPR compliance of a website: what matters during an audit
The current logic of the CNIL is based on the ability to demonstrate compliance, not on a prior administrative stamp. An audit focuses on tangible evidence: the up-to-date register, proof of consent, responses to rights requests, documentation of subcontractors.
- The register of processing activities, even in spreadsheet form, must be complete and updated
- Proof of user consent must be timestamped and retained for the entire duration of the processing
- Contracts with subcontractors (hosting provider, email tool, payment solution) must include GDPR clauses
The compliance of a website is no longer just a one-time declaration. It is built over time, through the rigorous maintenance of these documents and the regular updating of practices with each evolution of the site or its tools.
