GDPR and data protection lawyer

Updated 26 October 2026

Key contact: Pascal-André Gérinier (Lawyer - Founder)

GDPR compliance and IT contracts go hand in hand: your personal data flows through your software, your hosting providers and your service providers. MOSAIK secures both, for growing SMEs, mid-sized companies and large groups, under the supervision of the CNIL (French data protection authority), whose fines can reach 20 million euros or 4% of worldwide turnover.

The General Data Protection Regulation (GDPR) and the French Data Protection Act strictly govern the processing of your customers', employees', prospects' and suppliers' data. MOSAIK assists companies of all sizes with their compliance and defends them in the event of an investigation or litigation. Our approach is pragmatic: useful compliance, proportionate to your actual processing operations and embedded in your business processes.

Auditing your processing operations and bringing them into compliance

The process starts with a full assessment. MOSAIK delivers:

• the mapping of your data processing operations and their purposes;
• the creation and maintenance of the record of processing activities;
• the identification of the legal basis for each processing operation;
• the definition of retention periods and deletion procedures;
• the drafting of privacy notices and the collection of consent;
• procedures for handling data subject rights: access, rectification, erasure, objection, portability.

Your contracts and your documentation

Compliance runs through contracts. The firm drafts and negotiates the documents that govern the flow of data:

• privacy and cookie policies;
• data processing agreements and processor clauses;
• joint controllership agreements;
• IT charters and the framework for employee data;
• standard contractual clauses for data transfers outside the European Union.

This last point is a particular strength of the firm: with offices in Paris, Hong Kong and Mexico City, MOSAIK has deep experience of international data transfers, an unavoidable issue for groups operating outside Europe.

IT contracts: SaaS, licenses, outsourcing

A growing SME multiplies its tools: SaaS management software, CRM, cloud hosting, IT outsourcing provider, integrator, external developer. Each of these contracts puts your data and your business on the line. MOSAIK drafts, reviews and negotiates:

• SaaS and software subscription agreements: service levels, reversibility and recovery of your data at the end of the contract, hosting location, price changes and indexation clauses, based on the Syntec index or another index;
• software licenses and development agreements: scope of rights, ownership of the code developed for you, definition of defect categories, blocking, major or minor, and maintenance levels for each defect category, response and fix times, warranties;
• outsourcing, hosting and maintenance agreements: availability, security, backups, penalties;
• the terms and conditions of your own digital services, if you are a software publisher;
• the data protection clauses of all these contracts: processing on your behalf within the meaning of the GDPR, transfers outside the European Union, audits, incident notification.

The same lawyer handles GDPR compliance and the contract that implements it: you do not have two advisers passing the question back and forth.

Governance: DPO, impact assessments, privacy by design

MOSAIK advises your data protection officer or acts as outsourced DPO where your activity justifies it. The firm carries out data protection impact assessments (DPIAs) for high-risk processing and builds data protection into your projects from the design stage: a new website, a new application, a new HR or sales tool.

Data breaches: reacting within 72 hours

A leak, a hack, a lost device, an email sent in error: a data breach requires swift action. Notification to the CNIL must be made within 72 hours, and the individuals concerned must sometimes be informed. MOSAIK assists you under time pressure: classifying the incident, notification, communications, remediation plan, and handling any ensuing litigation.

CNIL investigations and litigation

In the event of an on-site, documentary or online investigation, the firm prepares and assists your teams, responds to the CNIL's requests and defends you throughout the sanction procedure, including before the Conseil d'Etat (French supreme administrative court). MOSAIK also acts in compensation claims brought by data subjects.

Specific situations we know well

• employee data: recruitment, video surveillance, geolocation, activity monitoring, in conjunction with our employment law team;
• direct marketing, in B2B and B2C alike, and the compliance of prospect databases;
• e-commerce websites and their trackers (see our e-commerce page);
• artificial intelligence projects and how the GDPR interacts with the new European regulations;
• compliance audits carried out for a fundraising round or an acquisition, where data protection has become a mandatory checkpoint.