Personal data.
Your data serves your business. It also engages your liability.
Employees, customers, prospects, suppliers, users: personal data flows through every function of the company. It feeds its sales tools, its human resources and, increasingly, its artificial intelligence projects. Poorly managed, it exposes the company to sanctions, litigation and a loss of trust that is hard to win back.
Bruzzo Dubucq supports companies, whether they act as controller or processor, at every stage of their compliance: documentation, contracts, handling of rights and incidents, relations with the CNIL (the French data protection authority). Our approach is operational and proportionate to each client’s business and resources: what must exist, what can wait, and what creates real exposure.
Areas of expertise.
Audit and governance
Compliance starts with knowing what you process, and who is accountable for it.
01 I Compliance audit and mapping of processing activities
02 I Qualification of roles (controller, joint controller, processor)
03 I Choice and documentation of legal bases, including the legitimate interest assessment
04 I Data protection by design in projects
Compliance documentation
The GDPR rests on the ability to demonstrate compliance. Documentation is the proof.
Our lawyers help you set up and update all of your documentation:
01 I Records of processing activities (controller and processor)
02 I Data breach register
03 I Data protection impact assessments (DPIA)
04 I Privacy notices and privacy policies
05 I Data retention and archiving policies
06 I Cookie and tracker policy
07 I Internal procedures: exercise of rights, breach management, security
08 I IT charters and rules for the use of tools
Our aim is documentation that is useful and kept up to date, not a binder forgotten in a drawer.
Data subject rights
Access, rectification, erasure, objection, restriction, portability: every request must receive a complete answer within one month.
01 I Setting up request handling procedures
02 I Analysis of complex, repetitive or manifestly unfounded requests
03 I Drafting responses and communicating data
04 I Handling requests made in a pre-litigation or litigation context
Contracts and data sharing
As soon as a third party accesses your data, the question of liability arises.
01 I Data processing agreements (Article 28 GDPR)
02 I Joint controller arrangements (Article 26 GDPR)
03 I Data sharing agreements between controllers
04 I Data protection clauses in your IT and commercial contracts
05 I Audit of processors’ compliance
International data transfers
A tool hosted outside the European Union, a foreign provider, a subsidiary abroad: transfers are often more numerous than you think.
01 I Identification and mapping of transfers
02 I Framing transfers: adequacy decisions, standard contractual clauses, binding corporate rules (BCR)
03 I Transfer impact assessments (TIA)
Data breaches
A leak that is poorly qualified or notified late makes matters worse.
01 I Qualification of the incident and risk assessment
02 I Notification to the CNIL
03 I Informing the data subjects
04 I Keeping the breach register
05 I Managing the aftermath, including litigation
Employee data
Recruitment, monitoring tools, video surveillance, work email: the employment relationship generates sensitive processing.
Working with the Employment law department, our lawyers secure this processing and assist you with access requests made by employees, particularly when they arise in the context of a dispute.
Prospecting and marketing
Cookies, email prospecting, customer files, loyalty programmes: commercial relationships are now built on data.
Our lawyers frame your commercial practices and the documentation of your online sales channels, together with the Distribution | Networks department.
Personal data and artificial intelligence
Training or using an AI tool on personal data requires a legal basis, information for the individuals concerned and, often, an impact assessment.
Our lawyers secure this processing from the design stage of the project. For the other legal issues raised by AI, see our Artificial intelligence page.
CNIL and litigation
01 I Preparation and assistance during inspections
02 I Responses to complaints and formal notices
03 I Defence in sanction proceedings
04 I Litigation relating to the use of data, including damages claims
Outsourced DPO
All of these assignments can also be entrusted to the firm on an ongoing basis. Appointing a data protection officer is sometimes an obligation, often a necessity, and recruiting one in-house is not always possible.
The firm acts as outsourced DPO for companies and organisations that wish to entrust this role to an independent, available contact well versed in legal issues:
01 I Appointment with the CNIL
02 I Day-to-day advice and compliance monitoring
03 I Point of contact for data subjects and the CNIL
04 I Monitoring of impact assessments and data breaches
05 I Team awareness and annual report
For companies that already have an in-house DPO, our lawyers support them on the most sensitive matters.
Team training
Compliance depends first and foremost on practices. The firm trains your executives and teams in the essential reflexes.
Dedicated team
Cédric Dubucq
Mathis Campestrin
Joachim Wathelet
News.
Articles to read.
20/10/2026
Google France as anchor defendant: Paris consolidates the European adtech damages claims
15/10/2026
Reversal in water billing litigation: the fixed portion of the bill is justified by the legislation
14/10/2026
Buyout of the rights of the non-approved heir of an SAS shareholder: a limitation period running from the filing of the expert report, and a valuation as at the date of death
07/10/2026
Replacing jobs with AI: the court suspends a collective redundancy plan
01/10/2026
Does the adoption of a sale plan, whether total or partial, preclude the extension of insolvency proceedings to a third party?
News