Cybersecurity Policy Report, Recommendations on HR Data Retention Periods Offered in France, (Apr 3, 2026)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has published a guide to assist data controllers in identifying retention periods for their personnel management activities.

In a press release yesterday, CNIL said it brought together major networks and professional associations from the public and private sector in the development of its framework. The guidance is intended for all private and public organizations with staff that is subject to French labor law. It does not cover retention periods for documents contained in the individual files of public employees, which are set by the Order of 12 December 2012 relating to the composition of the individual files of public employees managed in electronic format.

The framework, which may be downloaded from the press release but is available only in French, covers the most frequent processes within the context of human resource management, organized by processing activities like recruitment, compensation management, security of people and property, listening and recording workplace telephone conversations, and management of labor relationships, among others.

CNIL noted that the framework constituted “soft law,” meaning that adherence was not mandatory. Some of the listed retention durations are mandatory, however, because they are provided for by regulatory or legislative texts. In addition, the framework is not exhaustive; specific mandatory provisions from sectors like the general tax code, highway code, or internal security code may also apply. CNIL emphasized that the provisions listed in the framework applied only to French law and recommended that companies established in several countries should verify whether other national laws applied.

In using the framework, CNIL said that once a retention duration had been identified, companies should systematically consult the reference text or legal basis mentioned to ensure that it corresponds to the company’s specific situation. Depending on the details outlined in the framework, several retention periods may be indicated.

News: InternationalLegislation DataPrivacy DataSecurity