A client space that stores contracts, identity documents, or asset statements without an appropriate security architecture exposes the provider to a double penalty: financial (CNIL) and contractual (nullity of the contract). Since a ruling by the Douai Court of Appeal in May 2026, data protection is considered such a fundamental obligation of the provider that a site non-compliant with the GDPR can lead to the outright cancellation of the contract with the client.
Encryption of contractual documents in a secure client space
Storing contracts in PDF format in a directory protected by a simple password does not constitute an acceptable security measure under the GDPR. We recommend AES-256 encryption at rest and TLS 1.3 in transit, applied to each document individually and not just to the storage volume.
The difference is technical but has significant consequences. Volume encryption protects against physical theft of the server. File encryption also protects against application compromise: even if an attacker gains access to the database, each contract remains unreadable without the client’s specific key.
For client spaces that integrate electronic signatures, the subcontracting contract with the signature provider must explicitly mention the encryption and evidence retention modalities. The absence of this contract is one of the shortcomings that the CNIL can sanction through its simplified procedure, with fines of up to 20,000 euros.
You can access the Merci Victor client space to see how this encryption and contracting chain is implemented in a concrete case.
Strong authentication and management of access to personal data
Multi-factor authentication (MFA) is no longer an option for a client space handling sensitive data. A username/password pair, even robust, does not withstand a credential stuffing attack if the credentials have leaked on another service.
We observe that many wealth management client spaces are satisfied with an SMS as a second factor. SMS remains vulnerable to SIM swapping. A TOTP factor (Google Authenticator type app or equivalent) or a FIDO2 key offers significantly superior resistance.
Segmentation of access rights
A wealth advisor, an administrative assistant, and the client themselves should not see the same documents. The granularity of permissions should go down to the folder level, not the global account. A properly implemented RBAC (Role-Based Access Control) model reduces the exposure surface in case of compromise of an internal account.
- The client accesses their contracts, statements, and identity documents, with complete traceability of each consultation
- The advisor accesses the documents necessary for managing the mandate, without seeing identity documents unless validated on a case-by-case basis
- The technical administrator manages accounts and permissions, without accessing the encrypted content of documents
This separation is not an organizational luxury. It is a direct requirement of Article 25 of the GDPR (data protection by design).
GDPR compliance and contractual validity: what the 2026 case law changes
The ruling of the Douai Court of Appeal mentioned above marks a turning point for all providers offering a digital client space. Until now, a lack of GDPR compliance exposed one to an administrative sanction. From now on, non-compliance can serve as a basis for the cancellation of the contract between the provider and its client, on the grounds that data protection constitutes a fundamental contractual obligation.
For a wealth management firm, this means that the client can request the nullity of their mandate if the client space does not meet the security requirements of the GDPR. The risk is no longer just a fine: it is the loss of the contract itself.
Processing register and subcontracting contracts
The CNIL’s simplified sanction procedure primarily targets three common shortcomings in small structures:
- The absence of a processing register documenting precisely what data is collected, stored, and accessed in the client space
- The absence of a subcontracting contract compliant with Article 28 of the GDPR with each technical provider (host, signature tool, email sending service)
- Insufficient security of access, particularly the absence of multi-factor authentication on spaces containing financial or identity data
Amounts can reach 300,000 euros in the case of poorly managed data breaches. For a small structure, this level of sanction can jeopardize the viability of the business.
Integration of AI in the client space: strengthened documentation obligations
Client spaces integrating artificial intelligence features (support chatbot, investor profile scoring, recommendation personalization) are under particular scrutiny by the CNIL in its 2026 control program. Each automated processing must be documented with its impact on personal data.
A common pitfall is deploying a chatbot powered by a language model without conducting an impact assessment (AIPD). As soon as the chatbot accesses the client’s contractual or asset data to personalize its responses, the AIPD becomes mandatory. Without it, the processing is unlawful.
Algorithmic transparency
The client must be able to know when they are interacting with an automated system and what data feeds the responses they receive. This transparency obligation adds to the standard information requirements of the GDPR. A client space that uses AI without clearly informing the user accumulates two violations: lack of transparency on the processing and lack of information on the algorithmic logic.
The compliance of a secure client space relies on three technical pillars that mutually reinforce each other: granular encryption of documents, strong authentication with access segmentation, and rigorous documentation of each processing. Since 2026, neglecting any of these pillars no longer only jeopardizes an administrative fine but also the very validity of the contracts that the space is supposed to protect.