Address files and direct mail: what the GDPR says

Regulatory fact sheet, updated on 2 November 2026. General information, not legal advice: legislation changes, so check it at the source.

In brief

• The client sending the mailing is the controller: it is up to them to have a legal basis, to inform recipients and to handle objections.
• The printer or mailing house that receives the file to print and send the letters acts in principle as a processor: it only processes the addresses on the client's instructions.
• A written contract complying with article 28 of the GDPR (in French RGPD) must govern this processing.
• For prospecting by post, the CNIL (the French data protection authority) accepts legitimate interest as a legal basis, provided that individuals have been informed and can object simply and free of charge.

1. Who is responsible for what?

• Controller (GDPR, article 4(7)): the organisation that determines the purposes and means of the processing, here the client who decides to send the mailing and supplies (or rents) the file.
• Processor (GDPR, article 4(8)): the organisation that processes the data on behalf of the controller, here the printer or mailing house that personalises, inserts into envelopes and posts the letters.
• If the printer reuses the file for its own purposes (prospecting, resale), it steps outside its role as processor and becomes the controller for that new use (GDPR, article 28(10)).

Source: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4

The CNIL gives a very similar example: a business that sends commercial prospecting letters using other businesses' customer files is their processor, insofar as it processes the data needed for the mailing on their behalf and on their instructions; it remains the controller for managing its own staff and its own customers (CNIL, Guide du sous-traitant, the processor's guide, September 2017 edition, box “Exemple de qualification de sous-traitant et de responsable de traitement”). Source: https://www.cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf

2. Legal basis for direct mail (client side)

• GDPR, article 6(1)(f): legitimate interest. The CNIL states that advertising by post is possible if, when the address was collected, the individual was informed of its use for prospecting purposes and was able to object to it simply and free of charge (for example, a tick box). Source: https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-postal
• Each letter must identify the sending organisation and allow the recipient to easily refuse further solicitations (same source).
• Right to object (GDPR, article 21(2) and (3)): for prospecting, it is absolute, with no reason to be given. The CNIL recommends keeping a suppression list and retaining objections for at least 3 years. Source: https://www.cnil.fr/fr/comment-utiliser-une-liste-repoussoir-pour-respecter-lopposition-la-prospection
• Rented or purchased files: passing data to partners for postal prospecting may be based on the legitimate interest of the transferring party, if individuals were informed and were able to refuse the transfer, at the time of collection and at any time. Source: https://www.cnil.fr/fr/la-prospection-b-to-c-quelles-regles-pour-transmettre-des-donnees-des-partenaires
• Retention period (CNIL reference framework for commercial management): for a prospect, 3 years from collection or from the last contact initiated by them. Source: https://www.cnil.fr/fr/questions-reponses-sur-les-referentiels-relatifs-la-gestion-des-activites-commerciales-et-des

Note: these rules apply to paper mail. Prospecting by email or SMS is subject to different rules (prior consent for private individuals, Code des postes et des communications électroniques, the French Postal and Electronic Communications Code, article L. 34-5).

3. Informing recipients

• Data collected directly from the individual: GDPR, article 13.
• Data obtained otherwise (rented or purchased file, partner): GDPR, article 14; the information must be given at the latest at the time of the first communication with the individual where the data are used to contact them (article 14(3)(b)).
• The CNIL publishes a model notice: https://www.cnil.fr/fr/exemple-dinformation-de-prospects-prospection-commerciale-par-voie-postale

Essential content: identity of the controller, purpose, legal basis (and the legitimate interest pursued), recipients, retention period, rights (access, rectification, objection), the right to lodge a complaint with the CNIL and, for article 14, the source of the data.

4. The processor contract (article 28 of the GDPR)

GDPR, article 28(3): processing by a processor is governed by a contract (in writing, including in electronic form — paragraph 9) that sets out the subject matter, duration, nature and purpose of the processing, the type of data, the categories of data subjects and the obligations and rights of the controller. It stipulates in particular that the processor:

• a) processes the data only on documented instructions from the controller;
• b) ensures the confidentiality of persons authorised to process the data;
• c) takes the security measures required by article 32;
• d) only engages another processor (finisher, mailing house…) with the written authorisation of the controller, imposing the same obligations on it (paragraphs 2 and 4);
• e) assists the controller in responding to requests to exercise data subjects' rights;
• f) assists the controller in meeting its obligations regarding security, breach notification and impact assessment;
• g) deletes or returns the data at the end of the service, at the controller's choice;
• h) makes available the information necessary to demonstrate compliance with these obligations and allows audits.

The processor immediately informs the controller if, in its opinion, an instruction infringes the GDPR (article 28(3), last subparagraph).

Templates: the CNIL refers to the standard contractual clauses adopted by the European Commission on 4 June 2021 (Commission Implementing Decision (EU) 2021/915); its processor's guide (2017) also provides sample clauses. Sources: https://www.cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf and https://www.cnil.fr/fr/securite-gerer-la-sous-traitance The CNIL page “Travailler avec un sous-traitant” (working with a processor, https://www.cnil.fr/fr/sous-traitant), consulted on 1 November 2026, still offers the guide in its September 2017 edition; it states that the contract may be based in whole or in part on standard contractual clauses and refers to the CNIL page “Clauses contractuelles types entre responsable de traitement et sous-traitant” (standard contractual clauses between controller and processor): https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant

5. The printer's / mailing house's own obligations

• Keep a record of the categories of processing carried out on behalf of its clients (GDPR, article 30(2)).
• Ensure the security of the file: encrypted transfer, restricted access, deletion at the end of the service (article 32; CNIL guide “Gérer la sous-traitance”, managing processors).
• Notify the client of any personal data breach without undue delay after becoming aware of it (article 33(2)).
• Neither keep nor reuse the file after the service, unless instructed otherwise or legally required.

6. Penalties

Administrative fines of up to 20 million euros or 4% of total worldwide annual turnover, depending on the infringement (GDPR, article 83); the processor may be penalised for its own infringements.

For the printer: checklist

1. Article 28 contract or addendum signed before receiving the file.
2. File received by a secure means, stored in a restricted-access area.
3. Use limited to the order (no reuse, no copies).
4. Sub-processors (mailing house, finisher) authorised in writing by the client.
5. Deletion (or return) of the file at the end, with a record kept.
6. Record of processing activities as a processor kept up to date.

Main sources

• GDPR (Regulation (EU) 2016/679), chapter IV, articles 24 to 43: https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4
• CNIL, commercial prospecting by post: https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-postal
• CNIL, passing data to partners: https://www.cnil.fr/fr/la-prospection-b-to-c-quelles-regles-pour-transmettre-des-donnees-des-partenaires
• CNIL, suppression list: https://www.cnil.fr/fr/comment-utiliser-une-liste-repoussoir-pour-respecter-lopposition-la-prospection
• CNIL, processor's guide: https://www.cnil.fr/sites/default/files/atoms/files/rgpd-guide_sous-traitant-cnil.pdf
• CNIL, security: managing processors: https://www.cnil.fr/fr/securite-gerer-la-sous-traitance
• CNIL, working with a processor: https://www.cnil.fr/fr/sous-traitant

General information, not legal advice. Written on 1 November 2026.

Text version : Markdown