France market-entry GTM stack guide

For France, CNIL's professional electronic-prospecting guidance says legitimate interest can support outreach when the solicitation relates to the recipient's profession. The person must be informed and able to object simply and free of charge. Each solicitation must identify its sender and offer a simple refusal mechanism. A software pitch to an IT director is the guidance's example, not permission for unrelated offers to anyone with a company email address. CNIL distinguishes generic legal-person addresses from named professional contacts. These CNIL passages were observed on its publicly accessible official-domain preproduction mirror while the main site returned maintenance errors; the final main-host version was not observed.[1]

CNIL's French electronic-channel guidance distinguishes the general consumer prior-consent rule from professional information and objection. Its mirror also describes a same-company, similar-products customer exception after an actual sale or service, not mere account creation. Retain information and simple, free objection, and have counsel confirm the channel's complete exception conditions before use. The guidance explicitly includes email, SMS/MMS and automated calls. Do not treat an approved professional email segment as an approved SMS or prerecorded-call campaign without reviewing that channel and its data source separately. Our assessment is to exclude those channels from the initial launch. For an individual entrepreneur or a mixed personal/work number, record the professional purpose and context rather than assuming a corporate-domain rule settles the classification.[1]

For manual live professional calls in France, CNIL's mirror guidance likewise describes job-relevant legitimate interest, information and simple, free objection. Where numbers come from an existing database or a third party, check that the person was informed about prospecting use and can object. This is distinct from automated calls. Our assessment is to have the caller explain the business purpose, stop on refusal and return the objection to the central CRM rather than leave it in a dialer's notes.[2][5]

French consumer calling changed on 11 August 2026. As of this guide's review date, prior consent is the general rule; the relevant SaaS exception is an existing contract and a solicitation related to that contract. The former Bloctel-based regime is historical, and Service Public says Bloctel ceased on that date. Consumer consent lasts at most one year without automatic renewal and can be withdrawn. Consumer calls normally remain limited to Monday through Friday, excluding public holidays, 10:00 to 13:00 and 14:00 to 20:00, with a specifically agreed date/time exception. These are consumer controls, not a claim that every professional call requires consumer consent.[3]

LinkedIn is a separate channel, not an escape from French privacy review. Its agreement prohibits scraping profiles and unauthorized automated methods to add contacts or send messages. It also requires compliance with privacy and anti-spam law. GDPR obligations still apply to personal data your team processes. Our assessment is to use manual, relevant interactions, record objections and avoid classifying an accepted connection or an InMail feature as proof of legal marketing consent. No French LinkedIn-specific safe harbor was established by the checked sources.[4][5]

For French named-contact data, GDPR Article 6 requires a lawful processing basis. Legitimate interest requires necessity and consideration of overriding individual interests and rights; it is not marketing consent. Article 5 also requires minimisation, accuracy and storage limitation. When enrichment supplies data indirectly, Article 14 generally requires information within one month, or earlier at the first communication or disclosure, unless a specified exception applies. The notice includes the data source, purpose, basis, retention and relevant transfers. A supplier's assertion that its database is compliant does not perform your controller's obligations.[5]

GDPR Article 21 gives the person a right to object to direct marketing. After an objection, their personal data must no longer be processed for that purpose; bring the right clearly to their attention by the first communication. Article 28 requires a contract for vendors processing on the controller's behalf and controls on subprocessors. Our assessment is to record whether each vendor acts as a processor or independent controller, carry provenance into CRM, and enforce suppression before any re-enrichment or sequence import. A deleted contact that reappears in the next waterfall is an operational failure.[5]

France does not become a blanket local-hosting requirement under the checked general GDPR transfer framework. CNIL describes transfers outside the EU/EEA using adequacy decisions or appropriate safeguards such as standard contractual clauses. GDPR Chapter V also covers onward transfers. The EU exporter retains these obligations when a French contact enters a non-EEA CRM or enrichment chain. CNIL describes assessment of third-country protections and supplementary measures where relevant. Our assessment is to map recipients, support access and subprocessors, then document the applicable mechanism before activating the workflow; an EU data-center label alone is not that map.[5][6]

Apollo's Organization Search documentation supports country and city filtering, but its location parameter describes headquarters. It explicitly says results remain headquarters-based when a company has several offices. For France, that can omit a French subsidiary or buying team of a foreign-headquartered group. The documentation establishes filtering behavior, not French contact recall, title accuracy, deliverability or lawful contactability. Our assessment is to separate French headquarters accounts from French operating entities and verify the entity that owns the purchase before counting addressable accounts.[7]

Clay documents waterfalls that query multiple providers in a configurable sequence and can output the successful provider's name. That is useful provenance, not evidence of independent French accuracy or guaranteed coverage. Neither checked Apollo nor Clay documentation establishes an audited France-specific recall or fill rate. Our assessment is to compare candidate providers on the same manually reviewed French account sample. Track correct entity, current function, work email versus personal address, duplicate people, missing data and acquisition provenance separately. Keep a second provider only if the incremental usable records justify its cost and privacy review.[8][7]

Our assessment is to write the French opening, discovery questions, objection handling and meeting confirmation together, rather than translate an English sequence and stop there. Use French role labels as search hypotheses, then verify the actual function. Define whether DSI, procurement, security and the business owner participate in the deal instead of mapping every title to the home-market buying committee. Let the recipient choose French or English for the demo and retain that preference through opportunity routing. These are implementation recommendations, not claims that every French buyer requires French.

Our assessment is to hand the French-speaking closer a complete record before the first meeting. Include the outreach rationale, origin of the contact data, language preference, qualification notes, stakeholder map and the buyer's actual invoicing instructions. Name who handles the French security questionnaire, privacy questions and commercial redlines. Build an internal bilingual glossary for product claims and contract terms so an SDR promise does not change at procurement. Require the CS owner to accept the promised support language, support hours and onboarding milestones before signature. For a cross-border seller, identify the contracting entity early and keep that entity consistent in the proposal, CRM and invoice handoff.

In France, all established VAT-subject businesses must be able to receive electronic invoices from 1 September 2026. For in-scope domestic transactions between businesses established in France and subject to VAT, large businesses and intermediate-sized enterprises must issue them from that date; SMEs and micro-enterprises follow on 1 September 2027. The official guidance includes businesses benefiting from the VAT exemption franchise. Reception is therefore already a 2026 obligation, even where issuance is deferred. Do not apply this domestic e-invoicing rule to every foreign SaaS exporter merely because its customer is French; classify establishment, VAT and transaction scope separately, including any relevant e-reporting obligation.[9][10]

French official guidance requires an approved platform for the reform's invoice transmission functions; a compatible solution connects to such a platform. It separately discusses e-reporting for B2C and international transactions. Our assessment is to have finance approve a transaction map before promising an invoice format, and to establish who submits applicable reporting. The foreign-business-specific tax page was unavailable during this review, so this guide does not settle every non-established seller's e-reporting scenario. Obtain transaction-specific tax advice rather than infer a universal exemption or universal obligation.[10]

Stripe documents EUR-denominated SEPA Direct Debit, recurring payments and mandate acceptance. It supports the SEPA Core scheme for business and personal accounts, not the SEPA B2B scheme, and describes delayed payment notification. Our assessment is to offer it where your account and buyer are eligible, retain the mandate and distinguish payment initiation from confirmed collection. This payment rail does not establish compliance with France's approved-platform invoicing requirement. Keep payment status, invoice status and any tax-reporting status as separate finance handoff fields.[11][10]