Your URSSAF Declaration Contains Every Employee's Name, Salary, and Contract Type. Your Cloud Provider Stores a Copy.
Your DSN contains your employees' names, social security numbers, salaries, sick day counts, and contract types. You file it monthly through cloud payroll software. Every filing creates a copy on your vendor's server. Under GDPR — the EU data protection regulation that makes you responsible for your employees' data — you are the data controller. That means the copy is your liability: where it lives, how long it stays, and what it's used for. Most employers in France have never answered those questions.
Most don't know they need to.
What's actually in a DSN filing
The DSN — Déclaration Sociale Nominative, the mandatory monthly declaration every employer submits to URSSAF (France's social security collection agency) for each employee — is the most data-dense document your company files. Once a month, for every person on payroll.
Each filing contains: the employee's full legal name, their NIR (numéro d'inscription au répertoire — France's permanent social security number, a 15-digit identifier that, unlike a password, can never be reset), their date of birth, gross salary, net salary, every deduction line (mutuelle health insurance, prévoyance disability insurance, tickets restaurant, retirement contributions), sick leave days that month, RTT balance (the extra rest days earned beyond the 35-hour week), overtime hours, bonus amounts, contract start date and type, convention collective (the industry-specific labour agreement governing working conditions in your sector), and bank account details for salary payment.
All of that, for every employee, every month. On your vendor's server.
That DSN was filed on time. Compliant with URSSAF. And simultaneously: your employees' social security numbers are on a commercial server you've never audited. Both statements are true at once.
The path the data takes
Two facts belong together. First: the government portal net-entreprises.fr — the system that receives all DSN filings — has a free, documented machine-to-machine connection that processes 28 million declarations per month. Second: your cloud payroll software processes your DSN data on their own servers before forwarding it on to net-entreprises.fr.
Both the free direct path and the vendor-mediated path reach the same destination: URSSAF receives the filing. Only one of them leaves a copy on a commercial server indefinitely. The DSN filing is a transmission event. The data retention is a separate decision — made by your vendor, in their terms of service, for their business purposes.
Call it residency risk: the gap between where you think your employees' data lives (in your accounting system) and where it actually lives (on your payroll software vendor's servers, under their terms, for their purposes). Liberté uses the direct path: your system to net-entreprises.fr via machine-to-machine connection, one hop, no commercial intermediary.
The GDPR exposure most employers have never mapped
Under GDPR, you are the data controller for your employees' payroll data. Your payroll software vendor is the data processor. Here's what that means when something goes wrong.
If your vendor's servers experience a breach, the obligation to notify CNIL — France's data protection regulator — within 72 hours falls on you, not on them. Your employees receive breach notifications from you. Employment relationships are damaged. Administrative fines start at €10,000 for SMEs, and CNIL issued 42 formal sanctions in 2024, up 60% from 2022 — SME payroll data handling is a documented audit focus area.
An audit request starts the same way every time: CNIL asks for your Article 30 register — the mandatory document every business must maintain listing every system that processes personal data. They then ask for your data processing agreement (the contract with your payroll vendor defining exactly what they're allowed to do with your employees' data), the data categories transferred, and the retention period for DSN records including NIR fields. Most small businesses in France cannot produce those documents on demand.
When your payroll vendor is acquired, their terms of service may change. Your employees' DSN data transfers to the acquiring company's infrastructure. You're notified by email. Cegid acquired Shine's 400,000 customers in late 2025 — and their customers' employee data went with the transaction. That's the moment GDPR compliance either holds or doesn't.
Real businesses, real exposure
A 15-person tech startup in Paris files DSN monthly through Payfit, a French payroll platform. That's 15 employees × 12 months = 180 complete payroll records on Payfit's servers per year, accumulating every year since they signed up. The startup has never audited Payfit's data retention policy for DSN records — specifically for NIR and salary data. When CNIL asks "where is your employees' DSN data stored, for how long, and under what terms?" — the honest answer is "I don't know, somewhere on Payfit." That answer does not close a GDPR audit.
One restaurant in Nantes on Sage: 8 employees, monthly DSN filing since 2021, no review of the data processing agreement since signup. Five years of every employee's salary history, sick leave patterns, contract changes — on Sage's servers. Same exposure, different platform.
What your vendor actually knows about your business
Reverse-engineer what three years of DSN data tells your payroll software vendor about your company. They know: every employee you've ever had, their salary trajectory year over year, their sick leave patterns, whether you hire on CDI permanent contracts or CDD fixed-term contracts, which convention collective governs your industry, your total payroll cost. That's a detailed operational profile of your business — not just your employees. It's in their database because it was in the DSN. And the DSN went through their server.
Aggregated payroll data has commercial value: benchmarking products, analytics services, market intelligence sold to investors and HR consultants. Their data processing agreement secures the right to use it in aggregated form. You provide the raw data every month, by filing your DSN through their platform. You pay for the service. They accumulate the asset.
Two actions before your next filing
First: find your payroll vendor's data processing agreement today. Search for the data retention clause covering DSN records — specifically the NIR and salary fields. Read what they're allowed to do with aggregated data, and how long they keep individual records after you close your account. If you can't find the DPA or can't understand the relevant clauses, you have a compliance gap worth closing before CNIL asks.
Second: join the Liberté waitlist at liberte.free — launching Q2 2026, France first. Liberté files your DSN via direct machine-to-machine connection to net-entreprises.fr. Your employees' data — their NIRs, their salaries, their sick leave records — goes to URSSAF and nowhere else. No commercial copy. No benchmarking asset. No audit question you can't answer.
Filing through Liberté aligns your URSSAF compliance with your GDPR obligations — both pointing the same direction.