The CNIL (French data protection authority) issued its decision approving the code of conduct of 27 January 2026 sponsored by the Alliance du Commerce on 12 February 2026. The official announcement was published on 28 April 2026.
This 112-page code of conduct falls within the framework of Articles 40 and 41 of the GDPR on codes of conduct and their monitoring mechanism, and is the first national code of conduct approved by the CNIL.
Legal nature of codes of conduct under the GDPR
Codes of conduct are a compliance mechanism provided for by the GDPR, designed to specify how the principles of the Regulation apply in a given sector, to harmonise professional practices and to make it easier for controllers to demonstrate compliance.
They do not create new legal rules and do not replace the GDPR; rather, they translate its requirements into operational rules applicable to a specific sector.
They should therefore be understood as a tool for implementing and interpreting existing law, within a supervised soft law framework.
Membership regime and effects
Adherence to the code, which is reserved to members of the Alliance du Commerce, is voluntary.
It should be noted that only retail brands whose decision-making centre is located in France or which constitute a French establishment of an international group may adhere to it.
A company wishing to adhere to the code must go through the membership procedure, under the supervision of the monitoring body, and complete a membership form (pages 107 to 109 of the code of conduct).
Adherence entails a commitment to comply with the provisions of the code. That compliance forms part of the company’s internal compliance organisation and comes with acceptance of an external monitoring mechanism.
In return, adhering brands will be able to showcase their commitment by means of a compliance indicator. The code also sets out, for each GDPR principle, the expected requirements and the corresponding evidence, and the Alliance du Commerce provides them with a toolkit of template documents.
Adherence does not change the applicable legal framework: it does not exempt members from complying with the general obligations of the GDPR.
Monitoring mechanism and supervision
In accordance with Article 41 of the GDPR, implementation of the code relies on an independent monitoring body accredited by the CNIL.
The GDPR provides that this monitoring task may be entrusted to a dedicated body, separate from the supervisory authorities and without interfering with their powers. It may be carried out by an internal committee of the code owner or by one or more third-party bodies.
In the present code, Article 4.1 states that: “The designated representative of each Brand shall choose the Monitoring Body from the list drawn up and maintained by the Alliance du Commerce”.
The monitoring body so designated is responsible for:
verifying the compliance of companies applying for membership;
carrying out regular audits of adhering entities;
monitoring the proper application of the code over time.
The CNIL retains its role as supervisory authority, in particular as regards the accreditation of the monitoring body and the general oversight of the scheme.
Scope
The code applies to adhering retail brands and stores operating in the clothing and footwear sector, acting as controllers in the course of their sales and distribution activities to consumers (in store and online).
Excluded from scope:
relationships with suppliers (B2B);
processing relating to human resources management.
The code is therefore strictly limited to B2C processing linked to commercial activity.
How the code applies the GDPR to the sector
The code specifies how the fundamental principles of the GDPR, in particular the principle of lawfulness, apply in the retail sector (pages 16 to 42 of the code of conduct).
It also provides an operational framework for:
the obligation to inform data subjects (p. 43 of the code of conduct);
the exercise of rights (access, rectification, erasure, objection) (p. 52 of the code of conduct);
relationships with processors (p. 60 of the code of conduct);
transfers of data outside the European Union (p. 71 of the code of conduct);
keeping the record of processing activities (p. 88 of the code of conduct);
security obligations (p. 75 of the code of conduct);
the role of the DPO (conditions of appointment, arrangements and tasks) (p. 88 of the code of conduct).
Particular attention is paid to processing for advertising and marketing purposes, a key issue in the retail sector, especially as regards direct marketing, segmentation and consumer targeting.
The objectives pursued
A tool for building trust: the code aims to establish a framework of trust between stakeholders and to guarantee a high level of personal data protection.
Harmonised compliance: the code encourages the adoption of a common language and a consistent level of requirements across the various brands.
A response to the specific features of the sector: the retail sector stands out for its high volume of personal data processing, owing to the diversity of distribution channels, the digitalisation of customer journeys and the growth of loyalty and marketing schemes. The code is therefore a compliance instrument tailored to the specific features of the sector.
In other words, it seeks to structure and harmonise compliance practices within a sector that is particularly exposed to GDPR issues.
Summary
The Alliance du Commerce code of conduct approved by the CNIL is:
an instrument for implementing the GDPR governed by Articles 40 and 41;
a sector-specific framework applicable to clothing and footwear retailers;
the first national code of conduct approved by the CNIL, forming part of a wider European movement to structure compliance tools;
a binding commitment for adhering entities;
a scheme subject to independent monitoring accredited by the CNIL;
a tool for documenting compliance through a dedicated indicator.
It reflects the accountability principle laid down by the GDPR, helping to structure data protection practices in a highly digitalised sector.
Sources
To go further and secure your practices in light of GDPR requirements, through our expertise we assist you with compliance and with preventing personal data risks.