# Address files and direct mail: what the GDPR says

## In brief

- The **client** sending the mailing is the **controller**: it is up to them to have a legal basis, to inform recipients and to handle objections.
- The **printer or mailing house** that receives the file to print and send the letters acts in principle as a **processor**: it only processes the addresses on the client's instructions.
- A **written contract complying with article 28 of the GDPR** (in French *RGPD*) must govern this processing.
- For **prospecting by post**, the CNIL (the French data protection authority) accepts **legitimate interest** as a legal basis, provided that individuals have been **informed** and can **object** simply and free of charge.

## 1. Who is responsible for what?

- **Controller** (GDPR, article 4(7)): the organisation that determines the purposes and means of the processing, here the client who decides to send the mailing and supplies (or rents) the file.
- **Processor** (GDPR, article 4(8)): the organisation that processes the data on behalf of the controller, here the printer or mailing house that personalises, inserts into envelopes and posts the letters.
- If the printer **reuses** the file for its own purposes (prospecting, resale), it steps outside its role as processor and becomes the controller for that new use (GDPR, article 28(10)).

Source: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4

The CNIL gives a very similar example: a business that sends commercial prospecting letters using other businesses' customer files is their **processor**, insofar as it processes the data needed for the mailing on their behalf and on their instructions; it remains the controller for managing its own staff and its own customers (CNIL, *Guide du sous-traitant*, the processor's guide, September 2017 edition, box “Exemple de qualification de sous-traitant et de responsable de traitement”).
Source: https://www.cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf

## 2. Legal basis for direct mail (client side)

- **GDPR, article 6(1)(f)**: legitimate interest. The CNIL states that advertising by post is possible if, **when the address was collected**, the individual was **informed** of its use for prospecting purposes and was able to **object** to it simply and free of charge (for example, a tick box).
  Source: https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-postal
- **Each letter** must identify the sending organisation and allow the recipient to easily refuse further solicitations (same source).
- **Right to object** (GDPR, **article 21(2) and (3)**): for prospecting, it is absolute, with no reason to be given. The CNIL recommends keeping a **suppression list** and retaining objections for at least 3 years.
  Source: https://www.cnil.fr/fr/comment-utiliser-une-liste-repoussoir-pour-respecter-lopposition-la-prospection
- **Rented or purchased files**: passing data to partners for postal prospecting may be based on the legitimate interest of the transferring party, if individuals were informed and were able to refuse the transfer, at the time of collection and at any time.
  Source: https://www.cnil.fr/fr/la-prospection-b-to-c-quelles-regles-pour-transmettre-des-donnees-des-partenaires
- **Retention period** (CNIL reference framework for commercial management): for a prospect, **3 years** from collection or from the last contact initiated by them.
  Source: https://www.cnil.fr/fr/questions-reponses-sur-les-referentiels-relatifs-la-gestion-des-activites-commerciales-et-des

> Note: these rules apply to **paper mail**. Prospecting by **email or SMS** is subject to different rules (prior consent for private individuals, Code des postes et des communications électroniques, the French Postal and Electronic Communications Code, article L. 34-5).

## 3. Informing recipients

- **Data collected directly** from the individual: GDPR, **article 13**.
- **Data obtained otherwise** (rented or purchased file, partner): GDPR, **article 14**; the information must be given at the latest at the time of the **first communication** with the individual where the data are used to contact them (article 14(3)(b)).
- The CNIL publishes a model notice: https://www.cnil.fr/fr/exemple-dinformation-de-prospects-prospection-commerciale-par-voie-postale

Essential content: identity of the controller, purpose, legal basis (and the legitimate interest pursued), recipients, retention period, rights (access, rectification, objection), the right to lodge a complaint with the CNIL and, for article 14, the **source** of the data.

## 4. The processor contract (article 28 of the GDPR)

**GDPR, article 28(3)**: processing by a processor is governed by a **contract** (in writing, including in electronic form — paragraph 9) that sets out the subject matter, duration, nature and purpose of the processing, the type of data, the categories of data subjects and the obligations and rights of the controller. It stipulates in particular that the processor:

- a) processes the data **only on documented instructions** from the controller;
- b) ensures the **confidentiality** of persons authorised to process the data;
- c) takes the **security** measures required by article 32;
- d) only engages **another processor** (finisher, mailing house…) with the **written authorisation** of the controller, imposing the same obligations on it (paragraphs 2 and 4);
- e) **assists** the controller in responding to requests to exercise data subjects' rights;
- f) assists the controller in meeting its obligations regarding security, breach notification and impact assessment;
- g) **deletes or returns** the data at the end of the service, at the controller's choice;
- h) makes available the information necessary to demonstrate compliance with these obligations and allows **audits**.

The processor immediately informs the controller if, in its opinion, an instruction infringes the GDPR (article 28(3), last subparagraph).

**Templates**: the CNIL refers to the **standard contractual clauses** adopted by the European Commission on 4 June 2021 (Commission Implementing Decision (EU) 2021/915); its processor's guide (2017) also provides sample clauses.
Sources: https://www.cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf and https://www.cnil.fr/fr/securite-gerer-la-sous-traitance
The CNIL page “Travailler avec un sous-traitant” (working with a processor, https://www.cnil.fr/fr/sous-traitant), consulted on 1 November 2026, still offers the guide in its **September 2017 edition**; it states that the contract may be based in whole or in part on standard contractual clauses and refers to the CNIL page “Clauses contractuelles types entre responsable de traitement et sous-traitant” (standard contractual clauses between controller and processor): https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant

## 5. The printer's / mailing house's own obligations

- Keep a **record** of the categories of processing carried out on behalf of its clients (GDPR, article 30(2)).
- Ensure the **security** of the file: encrypted transfer, restricted access, deletion at the end of the service (article 32; CNIL guide “Gérer la sous-traitance”, managing processors).
- **Notify** the client of any personal data breach without undue delay after becoming aware of it (article 33(2)).
- Neither keep nor reuse the file after the service, unless instructed otherwise or legally required.

## 6. Penalties

Administrative fines of up to 20 million euros or 4% of total worldwide annual turnover, depending on the infringement (GDPR, article 83); the processor may be penalised for its own infringements.

## For the printer: checklist

1. **Article 28** contract or addendum signed before receiving the file.
2. File received by a **secure** means, stored in a restricted-access area.
3. Use **limited to the order** (no reuse, no copies).
4. Sub-processors (mailing house, finisher) **authorised in writing** by the client.
5. **Deletion** (or return) of the file at the end, with a record kept.
6. Record of processing activities as a processor kept up to date.

## Main sources

- GDPR (Regulation (EU) 2016/679), chapter IV, articles 24 to 43: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4
- CNIL, commercial prospecting by post: https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-postal
- CNIL, passing data to partners: https://www.cnil.fr/fr/la-prospection-b-to-c-quelles-regles-pour-transmettre-des-donnees-des-partenaires
- CNIL, suppression list: https://www.cnil.fr/fr/comment-utiliser-une-liste-repoussoir-pour-respecter-lopposition-la-prospection
- CNIL, processor's guide: https://www.cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf
- CNIL, security: managing processors: https://www.cnil.fr/fr/securite-gerer-la-sous-traitance
- CNIL, working with a processor: https://www.cnil.fr/fr/sous-traitant

---

*General information, not legal advice. Written on 1 November 2026.*

## Frequently asked questions

### Is the printer responsible for the address file?

The client sending the mailing is the controller; the printer or mailing house acts in principle as a processor, on the client's instructions.

### Is a contract with the client required?

Yes, a written contract complying with article 28 of the GDPR, signed before receiving the file.

### Is consent required for a postal mailing?

No: the CNIL accepts legitimate interest if individuals were informed at the time of collection and can object simply and free of charge. Email and SMS are subject to different rules.

### What should be done with the file after the mailing?

Delete it or return it, as the client chooses, keep a record, and do not reuse it.

---

Updated on 2 November 2026. Source : https://imprimeur.paris/en/guides/reglementation-rgpd-publipostage/