Mandatory legal documents for a business in France: the table by activity (2026)

In October 2024, the CNIL (the French data protection authority) announced (in French) that it had sanctioned “two companies with fewer than 250 employees for having no record of processing activities” (our translation). Not a data breach: a missing internal document. Founders think of the legal notice because it is visible, and forget what is not. And the list changes depending on whether you sell to consumers, publish software, invoice other businesses or hire staff. Here is the full matrix, profile by profile, with the legal text behind every cell.

Some of these rows are EU-wide: the privacy policy, the record of processing and the data processing agreement come from the GDPR, the cookie rules from the ePrivacy Directive (applied in France by article 82 of the French Data Protection Act), and the online withdrawal function from Directive (EU) 2023/2673. The other texts cited here are French: the LCEN for the legal notice, the Consumer Code and the Commercial Code for sales and payment terms, and the Labour Code for every employer document.

Which legal documents are mandatory for a business in France?

Three documents apply to almost every business with a website: a legal notice, a privacy policy and a record of processing activities. The rest depends on what you do: terms of sale, a consumer mediator and online withdrawal for consumer sales, a data processing agreement (DPA) whenever one party processes data on behalf of another, and employer documents from the first hire.

The first four profile columns describe a business with no employees. The last column applies on top of your profile from the first hire.

How to read the cells. “Mandatory”: a legal text requires it. “Mandatory in practice”: the obligation depends on a condition that almost everyone meets (collecting data, processing it on a regular basis). “Depends”: it turns on a fact explained below. “Recommended”: no text requires it, but it protects you.

For your own list, the free obligations check starts from your SIREN (company registration number, optional), your headcount and a few questions, and cites the legal text behind each line.

Which French and EU laws apply to each document?

Every cell rests on a text: the LCEN (the French Law on Confidence in the Digital Economy), the GDPR, the French Data Protection Act (« loi Informatique et Libertés »), the Consumer Code, the Commercial Code or the Labour Code.

Since the 2024 SREN law, the legal notice on a website rests on article 1-1 of the LCEN, no longer on article 6.

Which legal documents do I need for my website in France?

A brochure website that sells nothing needs a legal notice, a privacy policy as soon as it has a form or audience measurement, and a cookie banner only if it sets trackers that require consent. Each activity you add (sales, customer accounts, hiring) brings its own documents.

flowchart TD
  A["You have a business website"] --> B["Legal notice, privacy policy, record"]
  B --> C{"Non-exempt trackers?"}
  C -->|Yes| D["Cookie banner and cookie policy"]
  C -->|No| E{"Selling online to consumers?"}
  D --> E
  E -->|Yes| F["Terms of sale, mediator, online withdrawal"]
  E -->|No| G{"At least one employee?"}
  F --> G
  G -->|Yes| H["DUERP, staff register, workplace notices"]
  H --> I{"50 employees for 12 months?"}
  I -->|Yes| J["Internal rules"]

Take a plumber whose website has a quote request form. Legal notice: yes. Privacy policy: yes, the form collects data. Record of processing: yes, he keeps a customer file. Cookie banner: only if he adds a tracker that requires consent, such as an advertising pixel or a non-exempt audience measurement tool (Law no. 78-17, art. 82); the rules are in our guide to a CNIL-compliant cookie banner. Consumer mediator: yes, because he works for private individuals; the obligation in article L612-1 of the Consumer Code depends on who your customers are, not on your website.

Which documents does an e-commerce site selling to consumers need?

An online shop stacks the baseline of every website on top of the distance selling rules: complete terms of sale, a consumer mediator, an online withdrawal function and a DPA with each of its providers (platform, payments, email marketing).

The sole trader selling candles on Shopify escapes none of these rows. Her terms of sale gather the information that article L221-5 requires before the order: identity, price, delivery times, withdrawal conditions with the model form, legal guarantees, mediator. The Entreprendre Service Public fact sheet on terms of sale (in French) presents them as mandatory when selling to consumers. The detail is in our guide Terms of sale in France: mandatory or not?.

Since 19 June 2026, article L221-21 also requires a free function for withdrawing online, and her pre-contractual information (in practice, her terms of sale) must state that it exists and where to find it (L221-5, 7°). Terms of sale written before that date are incomplete; see our guide to the EU withdrawal button.

The mediator’s contact details must be given to the consumer (art. L616-1): on the website, in the terms of sale and on order forms, says Entreprendre Service Public (in French).

Which documents does a B2B SaaS or software company need?

A B2B SaaS publisher needs a legal notice, a privacy policy and a record of processing, but above all a data processing agreement (DPA) to offer its customers: it processes, on their behalf, the data they load into the tool. Its terms of sale are not required, but if they exist, it must provide them to any customer who asks.

The heart of the matter is Article 28 of the GDPR:

A company publishing scheduling software for small businesses therefore wears two hats. For its own prospects and customers, it is a controller (the record under Article 30(1)). For its customers’ employee schedules, it is a processor: a DPA with each customer, and a second record of processing activities “carried out on behalf of a controller” (GDPR, Article 30(2)). Its cloud host is a sub-processor, which it cannot engage “without prior specific or general written authorisation of the controller” (Article 28(2)): hence the list annexed to the DPA.

Which documents does a B2B freelancer or service provider need?

A freelancer who only works for businesses needs a legal notice if they have a website, GDPR information and a record of processing. Terms of sale are optional, but the payment terms must include the mandatory payment clauses, and a DPA is required as soon as they process data for a client.

A developer with a one-person company (« SASU ») who works on an online shop’s customer database is that shop’s processor: the Article 28 DPA is mandatory, whether or not the client offers one. A strategy consultant who never touches the client’s data does not need one.

Article L441-1 of the Commercial Code only requires you to provide existing terms of sale to a professional customer who asks for them. Attach them to the quote and get them accepted, or they have no effect (Civil Code, art. 1119).

Which documents are mandatory from the first employee in France?

From the first hire: the single occupational risk assessment document (« document unique d’évaluation des risques professionnels », DUERP), the staff register and the mandatory workplace notices. Internal rules only become mandatory twelve months after the business reaches fifty employees.

The DUERP. The employer records the results of the risk assessment in it, with an inventory of risks for each work unit (art. R4121-1). It is required from the first employee (official fact sheet, in French, checked on 22 July 2026). The document and its earlier versions are kept for forty years (art. R4121-4).

The staff register. Employees are entered in order of hiring, “at the time of hiring and indelibly”, and interns in a separate section (art. L1221-13). According to the official fact sheet (in French), it can be kept in digital form, after consulting the CSE.

Workplace notices. Some information must be displayed, other information can be given “by any means”, for example on the intranet, according to the Entreprendre Service Public fact sheet (in French) checked on 8 July 2026.

Internal rules.

The internal rules are submitted to the CSE for its opinion, sent to the labour inspector at the same time as they are published, and come into force at least one month after these formalities (art. L1321-4). In its version in force since 28 May 2026, this article no longer requires filing with the clerk of the employment tribunal (« conseil de prud’hommes »).

Employees are also people whose data you process: payroll and HR management belong in your record, as explained in our guide to the GDPR record of processing activities.

What is the difference between a mandatory and a recommended document?

A document is mandatory when a legal text requires it; it is recommended when no text requires it but it protects you in a dispute. Terms of sale between businesses and terms of use are the two textbook examples.

And the record of processing is not optional below 250 employees. The CNIL is explicit: it must include “non-occasional processing (for example: payroll management, management of customers/prospects and suppliers, etc.)”, according to its page on the record (in French, our translation).

What are the penalties for missing legal documents in France?

From €750 per employee for a missing staff register to one year in prison and a €75,000 fine for an unidentified website publisher, and up to 4% of worldwide turnover under the GDPR. These are ceilings, not price tags.

For a company, the LCEN criminal fine is multiplied by five (Criminal Code, 131-38). Fourth and fifth class petty offences (« contraventions ») are capped at €750 and €1,500 (Criminal Code, 131-13), multiplied by five for a company (131-41); the repeat-offence amounts for the DUERP follow the official fact sheet (in French). For the GDPR and trackers, the ceiling is whichever of the two amounts is higher. The CNIL can also use a simplified procedure, where the fine cannot exceed €20,000, or €100,000 if annual worldwide turnover exceeds €50 million (Law no. 78-17, art. 22-1): that is the route taken for the two no-record sanctions mentioned above. See our overview of CNIL fines.

What are the most common mistakes with mandatory legal documents?

The usual ones: thinking you are too small for a record of processing or a DUERP, citing an outdated article, copying a competitor’s terms of sale, publishing a cookie banner with no reject option and selling SaaS without a DPA.

To see how online shops are doing in practice, read our study on French e-commerce compliance in 2026.

What compliance checklist should I follow for my business in France?

Tick the list for your profile, then the employer list if you have staff. To check what a visitor actually sees, run the free website audit or take the website compliance quiz.

For a list tailored to you, run the obligations check; the other free tools check your legal notice and your cookies.