The 2026 regulatory changes
The GDPR regulatory landscape continues to evolve in 2026. In January 2026, the CNIL published new guidelines on data transfers to third countries in the context of subcontracting, strengthening pre-audit requirements and ongoing monitoring of providers established outside the EU.
The European Commission also finalised two new adequacy decisions — for Morocco and Tunisia — making transfers to these countries easier without requiring additional SCCs. These decisions open new opportunities for French companies wishing to outsource to North African hubs.
Transfers outside the EU: the 2026 practical guide
- Countries with adequacy decisions (free transfer): Morocco, Tunisia, Israel, Japan, UK, Canada
- Countries requiring SCCs: Senegal, Madagascar, Philippines, India
- High-risk countries requiring a DPIA: China, Russia, certain Gulf countries
- Obligation for a Transfer Impact Assessment (TIA) for any transfer outside adequacy decisions
Your obligations towards your BPO subprocessor
As data controller, you must: verify the provider's technical and organisational measures (TOMs) before signing, plan annual on-site or documentary audits, include international transfer clauses in the DPA, and maintain an up-to-date processing activities register that includes all subprocessors.
The CNIL can now impose fines of up to 4% of global turnover for serious breaches, including unlawful transfers carried out by your subprocessors. The data controller's liability is engaged even if the breach is attributable to the provider.
New AI Act requirements for BPO
The European AI Act, progressively applying since 2025, imposes additional obligations on BPO providers using AI systems for automated personal data processing. Automatic categorisation tools, credit scoring, or AI-assisted recruitment are classified as high-risk and require prior conformity assessment.
GDPR compliance is not a box to tick: it is a continuous practice that commits your provider as much as your organisation. — CNIL Guide 2026