Data Centres & Telecommunications in France

For a data centre in France, we assess the buildings, utilities, network connectivity and operational organisation together. This includes the interfaces between owners, operators, customers and service providers: who can access critical areas? Who is responsible for remote maintenance and changes? Who makes decisions when utilities, connections or systems fail?

The starting point is to establish the operating model. A colocation site, a cloud service and a public telecommunications network can give rise to different obligations and regulatory jurisdictions; for data centre and cloud services, NIS2 also takes account of the main establishment within the EU.[1] We therefore begin by identifying the legal entity under review, the services it provides and the allocation of responsibilities at the site.

France’s “Sécurité des activités d’importance vitale” framework brings physical security and cybersecurity together. State-designated operators of vital importance, known as “Opérateurs d’importance vitale” or OIV, must protect their critical sites and systems; data centres may be designated as “Points d’importance vitale”.[2]

For operators within scope, the framework includes risk assessments, security and protection plans, designated responsible personnel, and crisis and recovery planning. Formal designation is decisive: using a building as a data centre does not, by itself, confer OIV or PIV status.[2]

In operational terms, security planning, responsibilities and evidence must reflect the actual protection requirements. We bring these requirements together with the technical and organisational processes at the site within the agreed scope.

NIS2 follows an all-hazards approach that also covers the physical environment of network and information systems. For data centre and cloud providers within scope, the directly applicable Implementing Regulation (EU) 2024/2690 specifies requirements including the security of supporting utilities, physical access control, business continuity, recovery and supplier management.[3][4]

According to official publications as at 14 November 2026, France’s transposition of the NIS2 Directive is still in progress.[5][6] In parallel, ANSSI provides guidance through the “Référentiel Cyber France”, currently identified as a working document and a reference framework that is non-mandatory by default.[7]

The European Critical Entities Resilience Directive also requires careful interpretation: Article 8 excludes certain provisions for entities identified as critical in the digital infrastructure sector; more extensive national resilience rules remain possible where consistent with Union law.[8] The relevant combination of the European framework and applicable French requirements therefore remains decisive.

Operators within the scope of Article D98-5 of France’s Code des postes et des communications électroniques are subject to specific requirements for risk-appropriate technical and organisational measures and service continuity.[9] Security incidents with a significant impact on the operation of their networks or services must be reported to the Minister of the Interior; where such an incident has, or may have, an IT origin, the national cybersecurity authority must also be notified.[10]

Our security architecture assessment therefore also considers dependencies beyond the building. We examine which connections share physical routes or handover points, how disruptions are detected and how operators and service providers coordinate restoration. This connects technical fallback options with clear responsibilities and procedures that can be tested.

Our approach brings physical, technical and organisational perspectives together. It focuses on the site’s actual dependencies and the evidence supporting their secure operation.

• Perimeter, access and third-party personnel: We assess protected areas, access permissions, escorting, alarms and intervention as a connected process.
• Fire, power and cooling: We examine the interfaces between utilities, emergency operation, fire compartments and recovery, including potential common causes of failure.
• Operational technology and remote maintenance: We assess access, changes and transfers of responsibility between building automation, IT and external service providers.
• Crisis management and evidence: We bring escalation paths, recovery planning, exercises and documentation together to establish a shared picture of operations.

The official record of the March 2021 Strasbourg data centre fire identifies construction features contributing to fire spread in the destroyed building, the absence of automatic fire suppression in the premises described and insufficient firefighting water resources at the site.[11] Our assessment focuses on how protective measures, utilities and recovery arrangements work together in the scenario under review.

Specific customer and data requirements must be reflected in the actual scope of services. Three examples are relevant to this assessment:

• Sensitive cloud use: SecNumCloud qualifies specific cloud offerings, with corresponding requirements applying to certain sensitive government uses. This does not create a general SecNumCloud obligation for every French data centre.[12]
• Health data: Certification is required for the digital hosting of personal health data covered by Article L1111-8 on behalf of the persons or organisations specified in that article, or the patient.[13] The scope of HDS activities also includes providing and maintaining physical sites in operational condition for the relevant IT infrastructure.[14]
• Financial-sector customers: DORA requires specific contractual provisions between financial entities and ICT service providers, including service locations, security and incident assistance, as well as audit rights and exit arrangements for services supporting critical or important functions.[15]

Applicable installation and environmental requirements add a further site-specific layer. France’s ICPE regime may be relevant through backup power and other technical installations, for example, while energy reporting and waste-heat utilisation have their own conditions of applicability.[16][17]

We map these requirements to the agreed assessment scope and connect them with operational processes and existing evidence. Statutory obligations, customer agreements and technical standards remain clearly distinguished.