CNIL guidance on reconstituting professional email addresses and data subject rights

What happened

The CNIL explains that organisations may deduce a professional email address from publicly available information, but must comply with the GDPR and specific commercial prospecting rules. Data subjects must be informed clearly about the purpose and method of reconstruction and their rights to oppose, access, rectify, erase or limit the use of the reconstructed address. The guidance outlines the obligations of controllers and processors when handling such data.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The guidance clarifies GDPR‑compliant limits on reconstructing professional emails, reinforcing transparency and data‑subject rights.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Inventory AI or automated decision systems in scope and their assessments.