GDPR lawyers in Lyon: compliance and data protection

Protecting and processing personal data has become an increasingly strategic issue for businesses. A website, a platform, a business application, a customer database, HR records or an artificial intelligence project — every use raises questions of compliance, liability and security.

Our GDPR lawyers help you secure your personal data processing, your contracts and your digital projects. Based in the Lyon metropolitan area, Cabinet Bouchara & Avocats advises company directors, in-house legal teams, start-ups, SMEs and groups facing compliance issues, CNIL investigations or data breaches. 

Our approach combines a command of the GDPR with expertise in digital law and intellectual property, so that every project is addressed as a whole.

Would you like to discuss your GDPR compliance with a lawyer? Contact our team. 

Our GDPR services 

The GDPR comes into play at every stage of a project’s life — designing a digital service, selecting suppliers, exploiting data or facing a CNIL investigation. In Lyon and the surrounding region, our lawyers act in both advisory and litigation matters, to structure your practices, secure a new project or respond to an urgent situation.

GDPR audit and compliance programme

We carry out compliance audits covering your organisation, your websites, your applications and your data processing activities, in the light of the GDPR (Regulation (EU) 2016/679 of 27 April 2016) and of the other applicable rules. Based on that assessment, we identify the risks and define the priority actions to be implemented.

Drafting, documentation and data governance

We assist you in drafting and updating your GDPR documentation:

• record of processing activities;
• record of personal data breaches;
• data protection impact assessments;
• privacy policies;
• information notices;
• IT charters;
• internal procedures;
• cookie documentation.

We also assist you with a prior consultation of the CNIL, a certification process or joining a code of conduct.

Digital projects and data processing

Before launching a website, an application, a platform or a new business tool, we assess the legal feasibility of the intended processing operations.

We act in particular on projects involving health data, artificial intelligence tools, profiling, connected devices or tracking systems. This analysis makes it possible to identify sensitive points early enough and to build GDPR requirements into the project from the design stage.

Contracts, processing on behalf of others and international transfers

We draft and negotiate the data processing agreements, processor clauses and joint controller arrangements entered into with your clients, suppliers, software publishers, hosting providers, agencies and partners.

We also review data transfers outside the European Economic Area and support you in putting the necessary safeguards in place, in particular standard contractual clauses and binding corporate rules (BCRs).

External DPO, training and awareness

Cabinet Bouchara acts as external data protection officer for controllers and processors. We monitor their compliance, advise their teams and support them in their dealings with the CNIL.

We also offer training courses and awareness workshops tailored to your employees’ roles and working practices. The aim is to enable them to spot risk situations and to adopt the right reflexes day to day.

Data breaches and CNIL investigations

In the event of a cyberattack, loss, disclosure of or unauthorised access to personal data, we help you analyse the incident and determine the steps to be taken with the CNIL and the individuals concerned.

Where the breach poses a risk to the rights and freedoms of individuals, it must be notified to the CNIL without undue delay and, where feasible, within 72 hours of becoming aware of it (see the CNIL rules on personal data breaches).

We also assist you during a CNIL inspection, a formal notice or enforcement proceedings, from preparing the documents requested through to the exchanges with the authority.

Personal data litigation

We represent your interests, whether as claimant or defendant, in personal data disputes, in particular where they involve:

• infringement of the rights of data subjects;
• claims brought against a controller or a processor;
• breach of a processor or joint controller agreement;
• challenges to certain decisions, recommendations or sanctions of a supervisory authority.

Depending on the nature of the case and the applicable rules of jurisdiction, some disputes may fall within the remit of the Lyon Judicial Court or, on appeal, of the Lyon Court of Appeal.

To secure your data processing and your digital projects, our team is at your disposal.

Examples of situations handled by our team in Lyon

Every business faces different issues depending on its activity, its tools and the data it processes. Here are a few examples of situations in which our lawyers can step in.

Securing a project involving health data

A healthcare company is developing a digital service for professionals and/or patients. Our lawyers help identify the risks in the project, frame access to the data and secure its relationships with its hosting providers and partners.

Bringing an e-commerce site and its customer database into compliance

A brand wants to review its website, its forms, its cookies and its outbound marketing campaigns. We check that its practices are compliant and adapt the information notices, the privacy policy and its contracts with its agencies and service providers.

Responding to a data leak

A company discovers that a file containing customer or employee data has been sent to the wrong recipient, made accessible online or extracted during a cyberattack. We help it assess the situation, preserve the relevant material and determine the steps to be taken with the CNIL and the individuals concerned.

Responding to a subject access request or a CNIL inspection

An employee, a former colleague or a customer asks to access the personal data the company holds about them. Where the request covers a large volume of emails, HR documents or internal exchanges, we help the company identify the information to be disclosed, protect the rights of third parties and prepare a complete response within the prescribed time limits.

A law firm specialising in the GDPR in Lyon

Cabinet Bouchara is based in Saint-Didier-au-Mont-d’Or, in the Lyon metropolitan area. There we welcome businesses from Lyon and the surrounding region looking for local legal support on the GDPR and data protection.

This local presence allows cases to be followed directly and responsively, while drawing on the firm’s full range of skills in digital law, intellectual property and litigation. We also support projects that extend beyond the region, in France and internationally.