The SNCF has appointed a Data Protection Representative, Jean-Luc Dufournaud, who is also the company's Chief Legal Officer.

The Data Protection Correspondent makes sure that the company is properly protecting the information it holds on its staff and customers. He ensures compliance with French Data Protection Act no. 78-17 of 6 January 1978, which pertains to data processing of information relating to directly or indirectly identified or identifiable individuals, by reference to an identification number or to one or more pieces of information pertaining to the said individual.

To guarantee fundamental rights and the individual liberties of all with regard to data confidentiality, all processing of personal data must be declared before it is carried out. Personal data means all information pertaining to a directly or indirectly identified or identifiable person, by reference to an identification number or to one or more pieces of information pertaining to said individual.

Sncf.com provides a list of automatic data processing procedures declared by those responsible for them, as well as changes made to these processes. This list, which the Data Protection Correspondent is legally responsible for creating and updating, is called the "Register". This register is a compilation of information produced for each procedure, based on the declarations received. The register is available to the public and to anyone who wishes to view it, in accordance with the law.

The Data Protection Correspondent ensures that individuals (staff and third parties) subject to data processing can exercise the rights recognised by the French Data Protection Act, in particular following claims, requests, data access and rectification, by ensuring that the necessary communication is established with the right department.