Cybersecurity Policy Report, Sound Recording Guidance Issued in France, (Mar 23, 2026)

By Tony Foley

The French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), has issued guidance regarding the legality of the use of sound recording devices in connection with video surveillance.

CNIL noted that, under the French Internal Security Code (CSI), the use of sound recording captured by video surveillances systems themselves, or through an automatic pairing with another device, is strictly prohibited. The guidance added, however, that independent sound devices installed in a place that is under video surveillance may be permitted in some limited circumstances. Specifically, the guidance provides that such devices may be installed in public and private establishments in places accessible to the public but not on public roads. They are not prohibited if the sound recording device is not subject to automatic coupling with the video surveillance, audio recording is occasional and only triggered manually in specified instances, and only personnel directly affected by a threat to their safety may activity the sound device.

In addition to the above conditions, processing must be examined to ensure compliance with the European Union’s General Data Protection Regulation (GDPR). The processing must be necessary and proportionate when balanced against the rights and freedoms of the people being filmed, and it may not lead to placing staff members under permanent surveillance. In addition, recordings may only be kept in the case of a proven incident, for evidentiary purposes, and the people concerned by the recording, including staff members responsible for activating the device and internal procedures must be defined in advance to allow for the exercise of rights guaranteed under the GDPR.

The guidance also outlines training requirements for staff members, as well as the need for employee representative bodies to be informed or consulted prior to the introduction of new technologies.

News: InternationalLegislation DataPrivacy GDPR