Blog & Analysis

• LABEL R&C Team
• France & EU Research Ops

GDPR and Market Research in France: what international teams need to know

For international agencies and corporate insight teams running research in France, GDPR is not a box-ticking exercise; it is an operational constraint that shapes how respondents are recruited, how data is collected, how recordings are stored, and how findings can be shared. Getting it wrong does not just create legal risk; it creates fieldwork risk, because non-compliant practices can compromise the validity of the data and the trust of the participants.

France operates under the EU General Data Protection Regulation (GDPR), enforced nationally by the CNIL (Commission Nationale de l'Informatique et des Libertés), one of the most active and well-resourced data protection authorities in Europe. This article sets out the practical implications for research teams who are not based in France but are commissioning or running studies there.

1) The legal basis for processing respondent data

Under GDPR, every processing activity requires a lawful basis. For market research in France, the most commonly applicable bases are:

• Consent (Article 6(1)(a)): the respondent has freely given, specific, informed, and unambiguous agreement to participate and to have their data processed. This is the most common basis for consumer research.
• Legitimate interests (Article 6(1)(f)): applicable where the research serves a genuine business interest and does not override the respondent's fundamental rights. More commonly used in B2B research where participants are acting in a professional capacity.
• Contract performance: rarely applicable in standard research contexts.

The choice of legal basis matters because it determines what rights the respondent has, and how the data can be used after collection. Consent-based processing gives respondents the right to withdraw at any time; legitimate interests processing requires a balancing test that must be documented.

2) Consent in practice: what it must look like

In France, the CNIL has been explicit that consent must be active, granular, and documented. Pre-ticked boxes, blanket consent covering multiple unrelated purposes, and vague language about "research purposes" do not meet the standard.

For qualitative research specifically, consent must cover:

• Participation in the session itself: what the session involves, how long it will last, what topics will be covered
• Recording: audio, video, or both; who will have access; how long recordings will be retained
• Observation: if client teams or third parties will be watching live or reviewing recordings
• Data retention and deletion: how long the respondent's personal data will be kept and when it will be deleted
• Use of verbatims or clips: if quotes or video excerpts will be used in reports or presentations, this must be specifically consented to

For quantitative studies, consent is typically captured at the start of the survey, but the consent language must be drafted carefully to cover all intended uses of the data, including any secondary analysis or cross-study benchmarking.

3) Sensitive data categories in research

GDPR Article 9 defines special categories of personal data that require explicit consent and heightened protection. In market research, these are encountered more frequently than teams sometimes realise:

• Health data: any study involving healthcare professionals, patients, or health conditions
• Racial or ethnic origin: diversity and inclusion research, multicultural consumer studies
• Religious or philosophical beliefs: lifestyle and values-based research
• Political opinions: public affairs and policy research
• Biometric data: facial recognition, eye-tracking, or any biometric measurement collected during UX or product testing

If any of these categories are present in your study, even incidentally, through open-ended responses, your data processing framework needs to be reviewed before fieldwork begins. This is not a detail that can be addressed retroactively.

4) Data transfers outside the EU

For international teams, particularly those based in the UK post-Brexit, the US, or Asia-Pacific, the transfer of personal data collected in France to servers or team members outside the EU is a compliance requirement that is frequently overlooked.

GDPR restricts the transfer of personal data to third countries unless one of the following applies:

• Adequacy decision: the European Commission has determined that the destination country provides an adequate level of data protection. As of 2026, adequacy decisions exist for a limited number of countries including Japan, the UK (subject to review), Canada (partially), and others.
• Standard Contractual Clauses (SCCs): the most common mechanism for transfers to countries without an adequacy decision, including the US. SCCs must be incorporated into data processing agreements and supplemented by a Transfer Impact Assessment (TIA) where required.
• Binding Corporate Rules: applicable within corporate groups; complex to implement but robust once in place.

In practice, this means that sharing raw data files, recordings, or transcripts containing personal data with a US-based client team requires a documented legal mechanism. "We'll just share it on Google Drive" is not sufficient.

5) Respondent rights and how to handle them

GDPR grants respondents a set of rights that must be communicated to them and honoured in practice. For research teams, the most operationally significant are:

• Right to withdraw consent: a respondent can withdraw consent at any time, without consequence. Once withdrawn, their data must be deleted, including from recordings and transcripts, unless another lawful basis applies.
• Right of access: respondents can request a copy of the personal data held about them. This is rarely invoked in research contexts, but a process for handling such requests must exist.
• Right to erasure (right to be forgotten): respondents can request deletion of their personal data. In research, this can create complications if the respondent's data is embedded in aggregate analysis, document your approach in advance.
• Right to object: respondents can object to processing based on legitimate interests. This requires a response within one month.

These rights must be communicated to respondents in clear, plain language; not buried in a 12-page legal notice. The CNIL has taken enforcement action against companies for using overly complex privacy notices that respondents cannot reasonably understand.

6) What to verify with your French research partner

When commissioning research in France through a local partner, the compliance obligation does not transfer entirely to them. As the data controller (the party that determines the purposes and means of processing), the commissioning agency or brand retains ultimate responsibility for GDPR compliance. The French partner typically acts as a data processor, bound by a Data Processing Agreement (DPA) that specifies their obligations.

Before fieldwork begins, verify the following with your French partner:

• Do they have a documented Data Processing Agreement template, and are they willing to sign yours?
• How is respondent consent captured and stored, and for how long?
• Where are recordings and personal data stored, on EU-based servers or elsewhere?
• What is their data retention and deletion policy?
• Have they registered with the CNIL as a data processor where required?
• Do they have a process for handling respondent withdrawal or erasure requests mid-fieldwork?

A partner who cannot answer these questions clearly, or who treats them as unnecessary bureaucracy, is a compliance risk; regardless of their fieldwork quality.

7) Anonymisation vs pseudonymisation: the practical difference

A common misconception in research is that replacing a respondent's name with a code ("Respondent A") constitutes anonymisation and removes GDPR obligations. It does not. This is pseudonymisation, the data can still be re-identified if the key is available, and GDPR continues to apply.

True anonymisation, where re-identification is genuinely impossible, removes data from GDPR scope. But achieving true anonymisation in qualitative research is difficult: a verbatim quote from a specific professional role, in a specific company, in a specific city can often be re-identified by someone familiar with the sector.

The practical implication: do not assume that removing names from transcripts or reports resolves your GDPR obligations. Review each output for re-identification risk before sharing, particularly with clients or third parties who have detailed sector knowledge.