Encryption Law by Country
Where strong encryption is a right, restricted, or compelled. National law and policy, mirrored per country.
Source: Global Partners Digital, World Map of Encryption, updated 2026-07-02. Full data at www.gp-digital.org/world-map-of-encryption
Encryption Law by Country (196)
General right to encryption
Article 30(I) of Law No. 2004-575 of 21 June 2004 on confidence in the digital economy provides that the use of means of cryptography are free. A copy of the law (in French) can be found here .
Mandatory minimum or maximum encryption strength
No known legislation or policies.
Licensing/registration requirements
Article 31 of Law No. 2004-575 of 21 June 2004 on confidence in the digital economy provide that a person wishing to supply cryptography services must make a declaration to the Prime Minister. These provisions also give the government the power to issue a decree setting out exceptions to this general requirement, as well as the process by which declarations are to be made. Providing cryptography services aimed at ensuring confidentiality without having satisfied the reporting obligation provided for in Article 31 is a criminal offence, punishable by two years’ imprisonment and a fine of 30,000 EUR. A copy of the law (in French) can be found here . A copy of the decree (in French) can be found here .
Import/export controls
Article 30(III) of Law No. 2004-575 of 21 June 2004 on confidence in the digital economy provides that a person wishing to supply or import or export cryptography products and services, where the the product or service is not exclusively for the purpose of authentication or to ensure integrity. must make a declaration to the Prime Minister. Article 30(IV) provides that a person wishing to export cryptography products and services, where the the product or service is not exclusively for the purpose of authentication or to ensure integrity, must seek authorisation from the Prime Minister. These provisions also give the government the power to issue a decree setting out exceptions to these general requirements, as well as the processes by which declarations are to be made and authorisation obtained. Where a person fails to comply with the requirements under Article 30, the Prime Minister may, after having enabled the person concerned to present their observations, issue a ban on the circulation of the cryptographic products or services concerned until they comply with those requirements. Failure to comply with the requirement in Article 30 to make a declaration is a criminal offence, punishable by one year’s imprisonment and a fine of 15,000 EUR. Failure to comply with the requirement in Article 30 to obtain authorisation is a criminal offence, punishable by two years’ imprisonment and a fine of 30,000 EUR. Selling or renting cryptography products or services which have been banned under Article 34 is a criminal offence, punishable by two years’ imprisonment and a fine of 30,000 EUR. A copy of the law (in French) can be found here . A copy of the decree (in French) can be found here .
Other restrictions
No known legislation or policies.
Obligations on individuals to assist authorities
Article L.871-1 of the Internal Security Code requires, under certain circumstances, private entities or individuals who provide cryptology services which ensure confidentiality to deliver to authorised agents the means of enabling the decryption of the data which has been encrypted by their services within 72 hours. The authorised agents may also require the service providers to decrypt the data themselves within 72 hours unless they can show that this would not be possible. A copy of the Code (in French) can be found here . Under Article 230-1 of the Criminal Procedure Code, where it appears that data entered or obtained during an investigation has been processed in a manner that makes the data unreadable, or protected by an authentication mechanism (such as encryption), a public prosecutor, investigating court or judicial police officer may designate any private entity or individual so qualified to undertake the technical operations necessary to obtain access to a readable version of the data. Where encryption has been used, they may use secret decryption to do so if necessary. A copy of the Code (in French) can be found here .
Obligations on providers to assist authorities
Article L.871-1 of the Internal Security Code requires, under certain circumstances, private entities or individuals who provide cryptology services which ensure confidentiality to deliver to authorised agents the means of enabling the decryption of the data which has been encrypted by their services within 72 hours. The authorised agents may also require the service providers to decrypt the data themselves within 72 hours unless they can show that this would not be possible. A copy of the Code (in French) can be found here . Under Article 230-1 of the Criminal Procedure Code, where it appears that data entered or obtained during an investigation has been processed in a manner that makes the data unreadable, or protected by an authentication mechanism (such as encryption), a public prosecutor, investigating court or judicial police officer may designate any private entity or individual so qualified to undertake the technical operations necessary to obtain access to a readable version of the data. Where encryption has been used, they may use secret decryption to do so if necessary. A copy of the Code (in French) can be found here .
Assessment Text Area
The import, export, provision of cryptography services is subject to authorisation by the Prime Minister in France. under certain circumstances, private entities or individuals who provide cryptology service must decrypt encrypted data by their services within 72 hours, unless they can show that this would not be possible. The law also provides a public prosecutor, investigating court or judicial police officer to designate any private entity or individual to use whatever technical means necessary to decrypt encrypted data in the course of a criminal investigation.
Murphy's Law