What Changed
- CNIL issued ten financial sanctions ranging from €3,000 to €20,000 against French local authorities following 2025 cybersecurity audits.
- Audits revealed breaches of GDPR Article 32, including missing multi-factor authentication, unsegmented networks, obsolete server systems, and failure to complete RGS security accreditations.
- Several entities were sanctioned under GDPR Article 35 and French law for failing to conduct Data Protection Impact Assessments on high-risk processing like school portals and public video surveillance.
The French Data Protection Authority (CNIL) announced in November 2026 that it has issued ten simplified sanctions against French local authorities (collectivités territoriales) and a public institution for data protection non-compliance. The enforcement decisions follow a control campaign initiated by CNIL in 2025 targeting the public sector, covering municipalities, departments, regions, and their third-party service providers.
The fines imposed ranged between €3,000 and €20,000, which represents the legal maximum under CNIL's simplified sanction procedure. Fine amounts were calibrated based on the number and severity of breaches, the categories of data processed (such as minors' data and banking details), each entity's budget, the volume of affected individuals, and remedial compliance efforts.
CNIL identified multiple security breaches under Article 32 of the General Data Protection Regulation (GDPR). Key non-compliance findings included:
- Inadequate remote authentication controls, specifically the absence of multi-factor authentication (MFA) for administrative accounts;
- Permanent or shared network access permitted to external software vendors without case-by-case authorization;
- Ineffective anomaly detection caused by incomplete logging or lack of short-term log exploitation;
- Insufficient network segmentation, obsolete server operating systems lacking security updates, and weak or unencrypted password transmission and storage;
- Failure to complete mandatory security accreditation (homologation de sécurité) required by France's General Security Framework (Référentiel général de sécurité, RGS) before launching online administrative services.
Furthermore, entities were sanctioned under GDPR Article 35 and Article 90 of the French Data Protection Act (loi Informatique et Libertés) for failing to perform Data Protection Impact Assessments (DPIAs) prior to launching high-risk processing activities. Unassessed systems included online portals for school and extracurricular activities involving minors and financial data, as well as public street video surveillance systems.
CNIL stated that half of its control and enforcement resources in 2026 are dedicated to data security. Additional regulatory actions remain ongoing. CNIL noted that local public entities must also align their security posture with incoming requirements under the EU NIS2 Directive currently being transposed.
Who May Be Affected
French local authorities (communes, departments, regions), public institutions, and IT service providers or software vendors supplying French public entities.
Cross-Border Context
Relevant across the EU, Switzerland, and international markets for technology vendors supplying public authorities, illustrating strict enforcement of GDPR technical security controls and readiness for the EU NIS2 Directive.
What to check next
- CNIL guidance on cybersecurity controls for local authorities and public bodies
- Transposition progress and requirements of the EU NIS2 Directive in France
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.