French Language And CNIL Rules In New Caledonia

Two questions decide whether an offshore agency can work in New Caledonia at all, and most proposals answer both of them wrongly in the same direction. They overstate the language capability and overstate the compliance burden.

The first question is whether you can actually write French. Not translate it. Write it, at a standard a Caledonian reader would not flag. That is a threshold, and failing it makes everything downstream irrelevant.

The second is what French data-protection law actually requires of an agency delivering from outside the territory. Here the common error runs the other way. Vendors routinely describe the position as heavier than it is, partly from caution and partly because complexity justifies fees.

This article takes both seriously, because they are the two places where an agency either qualifies or does not, and neither is improved by vagueness.

Why French is a threshold and not a feature

French is the working language of commerce and administration here, understood by more than nine in ten residents. That much is uncontroversial. What is less obvious is why weak French damages search performance rather than merely reading awkwardly.

The mechanism sits in how retrieval now works. Systems selecting which sources to surface and cite are making implicit authority judgements across candidate pages. Language quality feeds those judgements. A page that a French speaker would recognise as translated is a page that a system has grounds to rank behind one written by someone who writes French natively.

In a large market that penalty gets diluted. There are thousands of competing pages, and a slightly weaker one still finds its slot. Here there is no dilution available. The pool of genuinely local French content about this territory is thin, which is precisely why generic queries pull metropolitan results, and a weak local page competes directly against a strong metropolitan one with nothing in between to cushion it.

So the honest framing is a gate rather than a differentiator. Either French-language output goes through native or demonstrably near-native editorial review before it ships, or the work should not be sold. We put it that way in our own proposals, and we would rather a prospect test the claim than accept it.

A fair test takes about ten minutes. Ask for a sample written for this territory, not a translated corporate page. Check whether Caledonian place names carry their accents and whether local vocabulary survives editing. Ask who reviewed it and what their relationship to French is. Then have someone Caledonian read it, which is the only test that actually matters.

The Kanak languages, and the answer we will not give

There is a second language question, and the tempting answer to it is a bad one.

New Caledonia has 28 Kanak languages, with approximately 76,000 speakers aged 15 and over recorded at the 2019 census, plus a further 17,000 who understand one without speaking it. Not one of them registers measurable commercial search or prompt volume in any tool available to us. That is a statement about measurement infrastructure, not about the languages or the people who speak them, and the distinction matters.

The tempting move for an agency is to propose a Kanak-language campaign with a projected traffic figure attached. We will not, because the figure would be invented. No source we can name publishes search volume for Drehu, Nengone, Paici or any of the other twenty-five, and producing a forecast in the absence of a baseline is the same error as producing one for the territory as a whole.

What we do instead is narrower and defensible. Kanak and Melanesian terminology and place names are preserved accurately inside French-language content rather than normalised toward metropolitan spellings. Those tokens are part of how a system recognises that a page belongs to this territory. Getting them right is both accurate and useful, and it does not require pretending to a demand estimate nobody has.

What French data law actually says here

The framing most vendors use is wrong in a way that is easy to check, so getting it right is a small credibility advantage.

New Caledonia is a sui generis collectivity outside the direct territorial scope of European Union law. The GDPR does not apply here as EU law. What applies is French national statute: the loi Informatique et Libertes, as rewritten by ordonnance number 2018-1125 of 12 December 2018, extended to the territory alongside French Polynesia, Wallis and Futuna and the French Southern and Antarctic Lands, and brought into force on 1 June 2019 in step with the decree amending decree number 2005-1309.

The obligations that result are equivalent to the European regime, and the CNIL in Paris is the competent supervisory authority. So an agency saying the GDPR applies in New Caledonia exactly as in France has made a legal claim any lawyer can disprove in a minute. An agency saying data protection is not really an issue in an overseas collectivity has made a worse one.

The correct version is narrower and stronger: equivalent obligations, French statutory basis, CNIL oversight. Say that and you are right, and you are also visibly someone who checked.

Delivering from Indonesia, mechanism by mechanism

Indonesia holds no European adequacy decision. So a transfer of personal data from a Caledonian client to an Indonesian processor needs a lawful transfer mechanism, and in practice that means three documents rather than one.

Standard contractual clauses come first, in their current form. The European Commission adopted updated clauses on 4 June 2021 through implementing decision 2021/914, and the transition window closed on 27 December 2022. Since that date the older clauses cannot be used at all, including where they were signed before June 2021, and a transfer resting on them is treated as lacking adequate safeguards. Clauses modified away from the official model stop being standard clauses and become ad hoc ones, which have to be submitted to the CNIL. That is a good reason not to redline them casually.

A processing agreement comes second, setting out what the processor may do, on whose instruction, with what security measures, and what happens at the end of the engagement.

A transfer impact assessment comes third. Following the Schrems II ruling of 16 July 2020, exporter and importer are jointly expected to assess whether the destination country's law permits the required level of protection, and to add supplementary measures where it does not. This is the step most often skipped, and it is the one a regulator would look for. Administrative fines under the regime reach 20 million euros or 4% of worldwide turnover.

One caveat we state rather than paper over. Because the exporting entity here is not an ordinary European-established one, we do not assume the transfer behaves exactly like a routine European-to-third-country case. The mechanism above is the right starting point, and the exporting entity's precise legal position is something we check during scoping rather than after signature. We could not find a published source addressing that specific configuration directly, and saying so is more useful than asserting a conclusion.

Where the burden is genuinely lighter

Now the part that runs against expectation, and it matters commercially because it removes an objection that stops projects.

The core artefact of AI visibility monitoring is a list of prompts and the citations returned against them. Considered on its own, that is not personal data. It is a record of what a machine said about a brand. A monitoring programme built that way does not pull the client into a heavier compliance posture than they already occupy.

What changes the analysis is joinder. Attach prompt-level results to CRM records, to user-level analytics, or to identified individuals by any other route, and personal data is being processed with everything that follows. The important point is that this is a design decision taken at setup, not something that happens by accident, which means it can be decided deliberately with the client instead of defaulting to maximum collection because collection is easy.

Two other operational points sit alongside it. Consent management follows CNIL expectations, meaning no tracking script fires before an explicit opt-in, and that has to be true in implementation rather than in a policy document. And the regulatory perimeter is still moving: the CNIL has been preparing for designation as a market surveillance authority under the European AI Act, so the supervisory relationship for AI-adjacent work is likely to develop further rather than settle.

Set against each other, the two thresholds behave differently, and knowing which is which prevents wasting a scoping call on the wrong one.

Threshold	Type of test	Who can verify it	What failure looks like
Native-standard French	Capability, judged by output	Any Caledonian reader, in ten minutes	Content ranked behind metropolitan pages with no volume to cushion it
2021 standard contractual clauses	Documentary, binary	Either party, by checking the version	Transfer treated as lacking adequate safeguards under Article 46
Data processing agreement	Documentary, contractual	Client legal review	No defined limits on processor activity or end-of-engagement handling
Transfer impact assessment	Analytical, jointly produced	Regulator, on request	The step a supervisory authority looks for and most often finds missing
Consent before tracking scripts	Technical, observable	Anyone, using browser developer tools	Scripts firing before opt-in, visible in seconds regardless of policy text
Exporting entity legal position	Open question	Nobody, from published sources alone	Assumed rather than checked, then discovered later

The practical argument for offshore delivery here

Compliance decides whether an offshore agency may work here. Geography decides whether it should.

Noumea runs at UTC+11 all year, with no daylight saving. Our Bali office is UTC+8, three hours behind, and Jakarta and Bandung are UTC+7, four hours behind. A Caledonian morning is our early morning. Live calls, same-day turnaround and fixing something before the client's day ends all sit inside normal working hours on both sides.

A metropolitan French agency sits nine to ten hours from Noumea depending on the season, with perhaps one or two hours of overlapping working day. That is workable for monthly reporting and poor for anything that needs a decision this week. Prompt monitoring in particular produces findings that decay: a citation pattern observed on Monday is worth acting on by Wednesday, not at the next monthly review.

There is a technical dimension too. The territory connects through submarine cable, with the Gondwana links carrying international traffic. That makes hosting location a real page-experience decision rather than a default, in a way it is not for a business in a densely peered metropolitan market. Where a site is hosted, and how far a request travels before it is answered, shows up in the measurements Google actually uses.

None of this makes an offshore agency the right answer automatically. It makes the time-zone argument run the opposite way to the one people assume, which is that distance from Paris is a disadvantage. From Noumea, Paris is the distant option.

Tessar Napitupulu writes about qualifying to work in a market before selling into it, and about measuring citation rather than assuming it, in Cited or Silent, available as a free gated edition, with retailer editions on Amazon, Google Play and Apple Books. Both of the thresholds described here sit inside scoping for our SEO service for New Caledonia and our GEO service for New Caledonia, before anything is signed.

---

Frequently Asked Questions

Does the GDPR apply in New Caledonia?

Not as European Union law. New Caledonia is a sui generis collectivity outside the direct territorial scope of EU law. What applies is French national statute: the loi Informatique et Libertes, as rewritten by ordonnance number 2018-1125 of 12 December 2018 and extended to the territory alongside French Polynesia, Wallis and Futuna and the French Southern and Antarctic Lands, in force from 1 June 2019 in step with the decree amending decree number 2005-1309. The resulting obligations are equivalent to the European regime and the CNIL in Paris is the competent supervisory authority. The precise version is both correct and stronger than the loose one.

What does an Indonesian agency need in place to work with a Caledonian client?

Three documents, because Indonesia holds no European adequacy decision. Standard contractual clauses in their 2021 form, adopted 4 June 2021 under implementing decision 2021/914, since older clauses have been unusable since 27 December 2022 even where signed earlier and modified clauses become ad hoc ones requiring submission to the CNIL. A data processing agreement setting out permitted activity, instructions, security measures and end-of-engagement handling. And a transfer impact assessment following Schrems II, jointly assessing whether destination law permits the required protection. Administrative fines under the regime reach 20 million euros or 4% of worldwide turnover.

Is AI visibility monitoring heavy on personal data?

Usually not, which surprises people. A record of prompts and the citations returned against them is not personal data on its own; it is a record of what a machine said about a brand. It becomes personal data at the point of joinder, when results are attached to CRM records, user-level analytics or identified individuals. That is a design decision made at setup rather than something that happens by accident, so it can be decided deliberately rather than by defaulting to maximum collection. Consent management still applies separately, meaning no tracking script should fire before an explicit opt-in.

How do I test whether an agency can really write French?

Ask for a sample written specifically for this territory rather than a translated corporate page. Check whether Caledonian place names carry their accents and whether local vocabulary survives editing rather than being smoothed toward metropolitan phrasing. Ask who performed the review and what their relationship to the language is. Then have a Caledonian read it, which is the only test that finally matters. This is worth ten minutes because the consequence is structural: in a market where the pool of local French content is thin, a weak local page competes directly against a strong metropolitan one with nothing in between to cushion the difference.

Should we run campaigns in Kanak languages?

Not on the basis of a traffic projection, because no such projection can be honestly produced. The territory has 28 Kanak languages, per the Vice-Rectorat language service, with approximately 76,000 speakers aged 15 and over recorded at the 2019 census, plus a further 17,000 who understand one without speaking it, and none registers measurable commercial search or prompt volume in any tool available to us. That reflects the limits of measurement infrastructure rather than the standing of the languages. The defensible approach is narrower: preserve Kanak and Melanesian terminology and place names accurately inside French-language content, since those tokens are part of how a system recognises a page as belonging to this territory.

Is working with an agency in Asia better or worse than one in France?

On time zones, decisively better, and the argument runs opposite to the one people assume. Noumea is UTC+11 year-round. A Bali office is three hours behind and Jakarta four, so a Caledonian morning falls inside a normal working morning for both. A metropolitan French agency is nine to ten hours away with perhaps one or two hours of overlap, which is fine for monthly reporting and poor for findings that decay within days, as citation monitoring does. From Noumea, Paris is the distant option. Hosting is worth attention too, since the territory connects through submarine cable and hosting location becomes a real page-experience decision rather than a default.

---