March 24, 2026 | Order Adoption | Data Governance

On 24 March 2026, the Prime Minister adopted Decree No. 2026-209 of 24 March 2026, amending certain provisions of the public health code relating to the hosting of personal health data, made for the application of Article 32 of Law No. 2024-449 of 21 May 2024 aimed at securing and regulating the digital space. The decree applies to patients, natural or legal persons responsible for the processing of personal health data, providers contributing to the provision of a personal health data hosting service, and certification bodies. It inserts Article R. 1111-9-1 into the public health code, requiring that storage of personal health data on digital media be carried out exclusively on the territory of a Member State of the European Union (EU) or party to the Agreement on the European Economic Area (EEA). Where a host or subcontractor involves a transfer, including remote access, to a non-EU or non-EEA country, this is permitted only under an adequacy decision pursuant to Article 45 of Regulation (EU) No. 2016/679, or where appropriate safeguards under Article 46 of that Regulation are in place with enforceable rights and effective legal remedies available to data subjects. The decree also amends Article R. 1111-11 to require hosting contracts to disclose applicable extra-European regulations, adequacy decisions or their absence, mitigation measures, and residual risks of transfer or unauthorised access to personal health data. Hosts must make public and keep updated a mapping of transfers, remote access, and risks of unauthorised access to personal health data. Articles R. 1111-9, R. 1111-9-1, and R. 1111-11 are extended to the Wallis and Futuna Islands. The decree enters into force the day after its publication, with the exception of points 2° and 3° of Article 1, which enter into force within a period of six months following the date of that publication.

March 27, 2026 | Order Implementation | Data Governance

On 27 March 2026, Decree No. 2026-209 amending provisions of the public health code relating to the hosting of personal health data partially enters into force. Points 2° and 3° of Article 1 are subject to a deferred application period and will apply within six months of the decree’s publication, that is by 26 September 2026. The decree implements Article 32 of Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space. It applies to patients, controllers processing personal health data, providers involved in the delivery of personal health data hosting services, and certification bodies. It introduces a new Article R. 1111-9-1 into the public health code, requiring that personal health data stored on digital media be hosted exclusively within the territory of a Member State of the European Union or a party to the Agreement on the European Economic Area. Transfers to countries outside these areas, including through remote access by a host or subcontractor, are permitted only where an adequacy decision under the General Data Protection Regulation applies or where appropriate safeguards are in place in accordance with that Regulation, together with enforceable rights and effective remedies for data subjects. The decree also amends Article R. 1111-11 to strengthen transparency requirements for hosting contracts. These must set out any applicable extra-European legal frameworks, indicate whether an adequacy decision exists, describe the safeguards implemented, and identify any remaining risks associated with data transfers or unauthorised access. In addition, hosting providers are required to publish and regularly update a mapping of transfers, remote access arrangements, and associated risks. Finally, Articles R. 1111-9, R. 1111-9-1, and R. 1111-11 are extended to the Wallis and Futuna Islands.