Personal Data Online: What You Reveal Without Realizing It
Addresses, dates of birth, bank account information… A great deal of sensitive information about company executives and partners is freely available online. A decree issued in August 2025 now provides better protection for this data. At the same time, the tax authorities are strengthening their digital data collection capabilities.
Sometimes it takes just a few clicks to access a surprising amount of personal information about an individual—even if they aren’t a public figure. LinkedIn profiles, as well as corporate filings, meeting minutes, and annual reports: these documents, available for free on sites like Pappers.com or Societe.ninja, can contain much more than just administrative data. As Karine Lecocq, managing partner and wealth management engineer at Lazard Frères Gestion, points out in an op-ed published in March 2026, these documents sometimes include partners’ home addresses, dates and places of birth, marital status, and even complete bank account information.
This transparency is no accident. It is the result of a legislative initiative that began more than a decade ago. In 2011, the Etalab agency, which reports to the Prime Minister, established an “open license” allowing for the free distribution of public data. Then, the law of August 6, 2015, expanded access: documents relating to companies and their executives—which were previously available only on paid sites such as Infogreffe—became accessible for free, without justification, and anonymously. Since 2025, the One-Stop Shop, managed under the supervision of the INPI, has centralized these procedures, further expanding access.
The problem is that some documents filed with the court clerk’s office contain particularly sensitive attachments. Notarized deeds of shared gift, for example, may list the first and last names and addresses of the partners’ children, as well as details of the assets transferred. Family-owned real estate investment trusts sometimes disclose the exact address of the property owned and its purchase price. All of this information can be exploited by malicious individuals, especially given the rising incidence of identity theft, bank fraud, and even targeted burglaries.
A Decree to Regain Control
In light of these risks, the decree of August 22, 2025, represents a significant step forward. It now allows partners and executives to request that their personal addresses be redacted when filing documents, and to specify that attachments must remain confidential, accessible only by the clerk’s office of the commercial court. For documents already online, it is possible to replace them with versions redacted to remove sensitive data via the One-Stop Shop at procedures.inpi.fr. The changes are then automatically reflected across all legal publication websites. The only restriction is that the address of the registered office must remain public, even if it corresponds to the executive’s home address.
Beyond business registries, anyone can request the correction or deletion of their personal data directly from the website that hosts it. The company has one month to respond. In the event of a refusal or failure to respond, an appeal may be filed with the CNIL. These rights, guaranteed by Articles 16 and 17 of the GDPR, which has been in effect since May 2018, are subject to certain limitations, however: freedom of expression, legal retention obligations, or the exercise of legal rights may justify retaining the data.
The tax authorities are also scrutinizing your digital footprint
The other side of this digital exposure involves the tax authorities, which have increasingly sophisticated data-collection tools at their disposal. An initial measure, stemming from the 2020 Finance Act and extended by decree through the end of 2026, authorizes so-called “passive” audits: officials can automatically collect content made public by taxpayers on the internet, including on platforms that require registration. Photos, text, videos, and geolocation metadata can then be used against taxpayers in the event of a tax assessment.
A second measure, provided for in the 2024 budget bill, goes even further. Specially authorized agents may conduct undercover investigations, initiate conversations on messaging apps, and access non-public content. This type of investigation remains limited to specific offenses, such as failure to report foreign accounts, failure to declare trusts, or the discovery of clandestine activities. The message is clear: in the digital age, the boundary between private life and the public sphere has never been more porous.
