GDPR and CNIL: protecting data for real

The GDPR is nearly ten years old, but many organisations still settle for surface-level compliance: a copied privacy policy, an incomplete register, tiresome cookie banners. Protecting personal data for real calls for a different starting point: not fear of a penalty, but respect for the people whose data you process. It begins with knowing what you collect, why, where it is stored and with whom it is shared. The regulation's principles remain a simple compass: legitimate purpose, minimisation, limited retention, proportionate security, and the ability to respond to people's rights. The CNIL, for its part, publishes a body of very concrete recommendations that are valuable well beyond France and help settle real cases. This guide brings together the analyses on personal data, privacy and the regulator's role, to help leaders and individuals alike tell the essential from the noise. The goal is not to pile up legal documents, but to anchor a few lasting habits: collect less, secure what matters, document what you do, and treat a data breach as an incident to be managed, not a secret to be buried.