
OYAT
INPLP member firm · Paris, France
Oyat is a new independant law firm co-founded on 1st of January 2022 by Marie-Hélène Tonnellier, Caroline Basdevant-Soulié, Laurent de la Brosse who used to be partners at Latournerie Wolfrom law firm. Oyat has 8 partners, 30 lawyers and covers 16 areas of expertise: labor law, social security law, M&A, private equity, public business law, environmental law, energy law, IT, personal data protection, cybersecurity, AI, intellectual property, commercial law, construction law, real estate law, and litigation. Phone: +33 1 81224020Website: www.oyat.lawEmail: cabinet@oyat.lawAddress: 164 rue du Faubourg Saint-Honoré, 75008 Paris mh.tonnellier@oyat.law+33 1 81 22 40 10/+33 6 80 94 38 01www.linkedin.com/in/mariehelenetonnellier/ Marie-Hélène has co-founded the Oyat law firm and heads the Digital & IP department. Both in advice and in litigation, she deals with all issues relating to IT and ecommerce issues, for private and public companies. She writes regularly in the legal literature specializing in these topics. Marie-Hélène also provides specialized training in new technology law and personal data. She is in particular responsible for teaching "IT contracts", for the Master 2 Law of Creation and Digital at Paris-Saclay University since 1995 and at HEAD school (Hautes Etudes Appliqués du Droit) for the Master 2 Law of Digital and Intellectual Property. She also regularly takes part in seminars, and was the previous President of IFCLA Association. She's very active in the AFDIT Association. Marie-Hélène holds a postgraduate degree (DEA) in Business Law (University Paris I – Panthéon Sorbonne) and a postagraduate degree (DESS) in Notarial Law (University Paris II – Assas) c.barraco-david@oyat.law+33 1 81 22 40 15www.linkedin.com/in/charlotte-barraco-david-avocat/ Charlotte Barraco-David is a French qualified lawyer and Counsel at Oyat law firm. She is involved in all types of matters relating to the law governing new technologies and particularly in personal data law. Charlotte assists public and private operators in implementing the obligations provided for in the French law governing data protection (loi informatique et libertés) of 1978 and in the General Data Protection Regulation (GDPR) (drafting confidentiality policies, outsourcing, crisis management in case of data leakage, assistance in the relationships with the French supervisory authority (CNIL), appointments of DPOs, developing a plan for complying with the GDPR, compliance reviews for asset acquisition projects...). She assists clients in litigation and prelitigation matters before the CNIL (onsite verifications, formal notices, sanctioning proceedings initiated by the "formation restreinte", the CNIL's enforcement body). She has been a data protection officer (DPO) since 2013, and she is now certified by the French Standardisation Agency (AFNOR). Charlotte is a member of AFCDP (French professional association of DPOs), of ADIJ (French association for the development of legal informatics), of AFDIT (French association for informatics and telecommunications law) and of of IAPP (International Association of Privacy Professionals). Charlotte holds a postgraduate degree (DESS) in Space and Telecommunications Law with a focus on information society law from the University of Paris XI – Sceaux, France and a postgraduate degree (DEA) in International and European Law from the University of Versailles – Saint Quentin, France. Stéphanie Lapeyre-Castellane has been a member of the Paris Bar since 2015 and joined OYAT as a partner in 2026. She heads the ‘Personal Data and Cybersecurity’ practice and co-heads the ‘AI’ practice. She began her career at August Debouzy, subsequently moving to DLA Piper. Stéphanie specializes in new technology law and provides both advisory and litigation support to her clients on their innovative projects. Her clientele, mainly major French and international companies (GAFAM, CAC 40, Next 40, major public organizations), operate in a wide range o
Representatives

Marie-Hélène Tonnellier
partner

Charlotte Barraco-David
member

Stéphanie LAPEYRE CASTELLANE
member
Contact
Publications
- Consolidation of the French doctrine on personal data and pseudonymisation after the CJEU’s SRB rulingFollowing the CJEU's SRB ruling (C-413/23, 4 September 2025), French doctrine on the qualification of personal data and pseudonymisation has consolidated through the decisions of the Conseil d'État (13 February 2026, n° 498628) and the CNIL in the IQVIA case (26 May 2026, n°SAN-2026-008): pseudonymisation remains a risk-reducing security measure, not a passport to anonymity.18 June 2026
- Consent as the lawful basis for monitoring the activities of employees: really?A recent case decided by the French Court de cassation demonstrates technical disregard of the GDPR, particularly in employment litigation matters.24 June 2025
- Data Governance Act: data intermediation services provider, a new player involved in personal data processing?Data sharing is a subject of ever-increasing importance, and one that is occupying the European Union exponentially, which has sought to promote data exchange mechanisms as part of its European data strategy. The Data Governance Act, which came into force on September 24, 2023, is a major piece of legislation in this strategy, and provides a framework for data intermediation, among other things, with the aim of promoting the exchange of data, particularly personal data.13 June 2024
- Data transfers across the Atlantic… a storm in a teacup?!The European Commission's new adequacy decision concerning the United States puts a stop to the European doctrine that was taking shape on the use of American tools involving transfers of personal data across the Atlantic, not without a touch of perplexity.26 September 2023
- Cyber insurance: the French legal framework is changingFrance makes the payment by insurers in case of cyber attacks conditional upon the prior filing of a criminal complaint within 72 hours.6 April 2023
- The French doctrine on the use of the cloud tested against free American solutions for educationAfter a member of the French Parliament warned about the potential unlawfulness of using Office 365 and Google Workspace for free in schools, the French Minister of Education and Youth decided to ban their use in French schools.9 February 2023
- CNIL orders 3 websites to stop using Google AnalyticsThe French supervisory authority has adopted 3 formal notices against famous French websites requiring them to stop using Google Analytics because of unlawful data transfers to the United States.4 May 2022
Join the network
Applications from qualified privacy practices are reviewed individually by the INPLP board.