Guides · Business · Employment law
Employee IT Policy in France: Making It Enforceable
An IT policy (charte informatique) gets its force from the required procedure: the works council’s consultation, the distribution of the document, its effective date and its submission to the labor inspectorate.
The short answer
An IT policy is not mandatory in every company. But a document that imposes general, permanent rules on employees falls within the scope of the internal rules (règlement intérieur). To rely on it when someone breaks a rule, the employer must be able to prove that the rules were lawful, proportionate, known to employees and introduced under the applicable procedure.
That procedure includes the prior opinion of the works council (CSE, the social and economic committee) where one exists, submission of the document to the labor inspectorate, distribution to the people concerned, and an effective date at least one month after the formal notice requirements. How to handle filing with the court clerk’s office calls for caution since the legal change of May 28, 2026.
An IT policy can never authorize a deduction from wages or a financial penalty. Nor can it make an employee civilly liable for a simple mistake. Its job is to set known rules — for example, report an incident, protect your credentials or verify a transfer request — and to tell an unintentional error from deliberate behavior.
Internal rules become mandatory at 50 employees
Internal rules (règlement intérieur) become mandatory once the company has had 50 employees for 12 consecutive months. The employer then has 12 months to put them in place. The former threshold of 20 employees, still found in many older articles and decisions, no longer applies.
Once a company has had 11 employees for 12 consecutive months, a works council (CSE) must in principle be set up. Whether one exists matters for the procedure: where a CSE exists, its opinion must be obtained before the policy is introduced.
Below 50 employees, internal rules are not mandatory. The employer must still inform employees before introducing any system that collects information about them. An IT policy can serve that purpose, though it is not the only way.
| Threshold | What it triggers | Legal basis |
|---|---|---|
| 11 employees | The CSE becomes mandatory | Art. L2311-2 |
| 50 employees | Internal rules become mandatory, after 12 months at the threshold, with 12 more months to put them in place | Art. L1311-2 |
Complete and document each required step
When an IT policy sets general, permanent obligations on discipline, Article L1321-5 subjects it to the rules governing internal rules. Each formality must be completed in the right order and kept in dated form.
| Step | Mandatory? | Legal basis |
|---|---|---|
| Prior opinion of the CSE, where one exists | Yes, if a CSE exists | Art. L1321-4 |
| Effective date at least one month after the formal notice requirements | Yes | Art. L1321-4 |
| Distribution by any means to the people with access to the workplace or the hiring site | Yes | Art. R1321-1 |
| Submission to the labor inspectorate, with the CSE’s opinion | Yes | Art. L1321-4 |
| Filing with the clerk’s office of the labor court (conseil de prud’hommes) | Confirm the transitional requirement | L1321-4 as amended; R1321-2 still in force |
Since May 28, 2026, Article L1321-4 no longer mentions filing with the labor court clerk’s office, while Article R1321-2 still provides for it. Until the texts are aligned or a legal position is confirmed, continuing to file remains the prudent option. Dropping it from the procedure on the strength of the legislative change alone would be premature.
See the legal detail: building proof of enforceability
Build a dated file
Create a single file containing the version of the policy and the documents that prove each step. You must be able to recalculate the effective date from these documents.
- Version submitted to the CSE. Keep the document sent, the date it was sent, the agenda, the opinion issued and the minutes. If the company has no CSE, document why, given its headcount and situation.
- Submission to the labor inspectorate. Keep the document, the attached CSE opinion, the date sent, the recipient and the acknowledgment of receipt.
- Distribution. Record the means chosen — posting, intranet, handout or HR tool — the date it was made available, the audience and proof that the document remained accessible.
- Effective date. Set a date at least one month after the formal notice requirements. Do not substitute the date the document was signed.
- Filing with the clerk’s office. As long as Article R1321-2 still mentions it, keep proof of filing, or the written opinion from the counsel who advised against it.
- Updates. Number every version. Changing or removing a clause must follow the applicable procedure; do not overwrite the version that was in force when the facts occurred.
Check each rule before distributing it
For each obligation placed on an employee, record its purpose, the risk it addresses, the people concerned, the practical way to comply, any data collected and the consequence planned for a breach. A rule that is impossible to apply or disproportionate does not become valid because it appears in a signed policy.
The employer must prove the rule was enforceable
When a sanction rests on a rule in the IT policy, the employer must produce proof of the applicable procedure and of the document’s distribution. In the ruling of October 9, 2024, a disciplinary transfer was annulled because the employer could not show that the formal notice requirements for its internal rules had been completed.
So keep the CSE’s opinion, proof of submission to the labor inspectorate, the dated version of the document, its effective date and evidence that it was distributed. A policy sitting on a server with no proof that employees knew of it is a fragile basis for disciplining anyone.
Apply the rules consistently too. A practice tolerated for years and then punished without warning or an update to the policy weakens the decision and its proportionality.
Tell an unintentional error from deliberate behavior
An IT policy can never be used to impose a fine, a deduction from wages or a financial contribution to the cost of an incident. Article L1331-2 of the Labor Code (code du travail) prohibits financial penalties and makes any contrary clause unenforceable, even if the employee signed it.
Asking an employee to pay civil damages requires gross misconduct (faute lourde), meaning an intent to harm the employer. An accidental click, even one followed by major harm, does not establish that intent.
The employer can, however, consider a disciplinary sanction when an employee deliberately breaks a security rule that is lawful, proportionate, enforceable and known: handing over their credentials, switching off a protection or hiding an incident, for example. The type of sanction then depends on the facts, the context and the scale set by the applicable rules.
What not to do
- Providing for a financial penalty or a deduction from wages
- Presenting an unintentional error as an intent to harm
- Disciplining on the basis of a rule the company cannot prove it distributed
- Citing a court example when the published decision does not confirm the facts you claim
Inform employees and limit surveillance
A monitoring system must pursue a specific purpose, be necessary and remain proportionate. Employees and their representatives must be informed before it is put in place. The policy can carry that information, but it does not make an excessive system lawful.
- Work emails are presumed to be professional, except those the employee marks as “Personal” or “Private”
- Automatically copying every message received or sent is excessive
- A keylogger is disproportionate surveillance, except in an exceptional, precisely justified security situation
- Logs must have a defined purpose, limited access and a justified retention period; that period depends on their nature, so avoid writing a single cap into the policy without prior analysis
An IT policy does not have to be declared to the CNIL (France’s data protection authority). If personal devices are used for work, state clearly the responsibilities of the company and of the employee, the data the company may access and the procedure applied when the employee leaves.
Write eight sections that everyone can apply
| Section | What it must say in concrete terms |
|---|---|
| Purpose | Why the policy exists and which risks it aims to reduce |
| Scope | People, devices, accounts, networks and services concerned |
| Terms used | Short definitions of the words you need, without an unnecessary technical glossary |
| Permitted uses | What is allowed on work tools and on personal devices |
| Security rules | Access, passwords, two-factor authentication, updates, storage and incident reporting |
| Sensitive decisions | Mandatory verification before a transfer, a change of bank details or the sending of sensitive data |
| Monitoring | Data collected, purpose, people authorized to view it and retention period |
| Breaches and effective date | Proportionate scale of sanctions, distribution procedure, date of application and evidence kept |
A rule must describe observable behavior. “Protect company data” is an intention; “report the loss of a device to the designated person immediately” is an instruction you can apply. Reread each line with that distinction in mind.
Bring the rules into daily work
Present the policy to new employees, remind everyone of the rules when a tool changes and keep a record of these actions. Also check that the measures you ask for are actually available: an employee cannot turn on two-factor authentication the company has not set up, or follow a reporting procedure with no designated contact.
After a suspicious click or a possible data leak, move from the rule to incident handling: preserve the evidence, limit access and check the deadlines for the police report, the CNIL and the insurer.
What to ask your legal counsel and your IT provider
Which clauses in our policy create disciplinary obligations for employees?
A precise list of the clauses concerned and their legal basis, not the general answer “the whole policy.”
Can you produce the CSE’s opinion, proof of submission to the labor inspectorate, proof of distribution and the dated version that took effect?
Four dated pieces of proof, consistent with the effective date.
Does each monitoring system mentioned have a clearly defined purpose, retention period and set of authorized people?
A system-by-system table, with the justification for each retention period.
Does the policy tell an unintentional error, a repeated breach and a deliberate act apart in its scale of sanctions?
Distinct categories and proportionate responses, with no financial penalty.
What procedure do we follow when an employee reports a suspicious click, a lost device or an unusual transfer request?
A contact person, a channel, the first actions, and a procedure that does not depend on a single person.
Sources
- Légifrance — Article L1311-2 du code du travail (Labor Code)
The 50-employee threshold that triggers the internal rules requirement.
- Légifrance — Article L1321-4 du code du travail (Labor Code)
The enforceability procedure, in the version in force since May 28, 2026.
- Légifrance — Article L1321-5 du code du travail (Labor Code)
The mechanism that brings any policy under the internal rules regime.
- Légifrance — Article L1331-2 du code du travail (Labor Code)
The ban on financial penalties, a matter of public policy.
- Cass. soc., 9 octobre 2024, n° 22-20.054 (Court of Cassation, labor chamber)
A sanction annulled for lack of formal notice requirements for the internal rules.
- Cass. soc., 22 octobre 2015, n° 14-11.801 (Court of Cassation, labor chamber)
Gross misconduct requires intent to harm, not merely committing a harmful act.
- ANSSI — Guide d’élaboration d’une charte d’utilisation des moyens informatiques (Guide to drafting an IT usage policy)
The eight key points a useful policy must contain.
- CNIL — Le contrôle de l’utilisation d’internet et de la messagerie électronique (Monitoring internet and email use)
The limits on employee monitoring: personal emails, keyloggers, log retention.