How to File a CNIL Complaint in France (What It Can and Cannot Do)

A complaint to the CNIL, France's data protection authority, is free to file online at cnil.fr/fr/plaintes and can lead to an investigation, a formal notice, or a fine paid to the State. It cannot get a complainant compensation; only a civil court can award damages.

Information last verified on 19 July 2026. This article presents general legal information, not legal advice.

Jurisdiction scope: This article covers the CNIL, the data protection authority for France. Complaints about an organisation established in another European Union country may fall under that country's own data protection authority instead, depending on where the organisation is established and where the decisions about the data are made.

What the CNIL Is and What It Supervises

The Commission Nationale de l'Informatique et des Libertes, known as the CNIL, is France's independent administrative authority for data protection. It supervises how organisations, public and private, collect, use, store, and share personal data under the RGPD (the French name for the EU's General Data Protection Regulation) and the French Loi Informatique et Libertes.

The CNIL's core job is oversight of an organisation's practices, not resolution of an individual's personal dispute. It can investigate a data controller, order it to fix a specific practice, and in serious cases fine it. What it does not do is act as a court that decides an individual's claim for money.

This distinction shapes the entire complaint process described below, so it is worth stating plainly before anything else: a CNIL complaint is a regulatory tool aimed at the organisation's conduct, not a claims process aimed at a personal payout.

Before You Complain: Contact the Organisation First

The CNIL's own complaint page recommends contacting the organisation directly before turning to the CNIL. The online complaint form itself asks a complainant to describe the steps already taken with the organisation and what came of them.

This step matters in practice for two reasons. First, many issues, particularly access, rectification, or erasure requests, get resolved once an organisation is formally asked in writing. Second, a documented prior attempt strengthens a complaint if it later proceeds to the CNIL, since it shows the organisation had a fair chance to correct the problem on its own.

An organisation that receives a data subject rights request generally has one month to respond, from the date it receives the request. That period can be extended by up to two further months for a complex request, but only if the organisation tells the requester about the extension within the original one month window. If the organisation misses the deadline, or never replies at all, that failure is itself grounds to complain to the CNIL, with the original request and any response kept as evidence.

What to Include in a CNIL Complaint

A complaint filed with the CNIL must be written in French. It should identify the organisation involved, including its name, address, and SIREN business registration number where relevant. It must include the complainant's own identity and contact details, and it should attach copies of the essential supporting documents, such as correspondence already exchanged with the organisation, the relevant web address if the issue involves a website, and a short explanation of the complainant's relationship to the organisation (customer, former employee, and so on).

The complaint can be submitted two ways: online through cnil.fr/fr/plaintes, or by post to CNIL, Service des Plaintes, 3 Place de Fontenoy, 75007 Paris. Both routes are free of charge; the CNIL does not publish any filing fee for either method.

A well documented complaint, one that lays out dates, the organisation's response or silence, and the specific data protection rule at issue, moves through the CNIL's review more efficiently than a general grievance.

What the CNIL Can Do, and What It Cannot Do

Once a complaint is accepted for review, the CNIL has a defined set of corrective tools. It can issue a rappel a l'ordre, an official reminder to comply; a mise en demeure, a formal notice giving the organisation a set period, generally one to three months, to fix the problem; an injunction to bring processing into compliance, backed if necessary by a daily penalty payment; a temporary or permanent limitation, suspension, or prohibition on processing; withdrawal of a certification; suspension of data transfers to a country outside the EU; an administrative fine; and publication of the decision, except under the simplified procedure described below, which is never made public.

What the CNIL cannot do is order the organisation to pay the complainant. Its corrective powers run toward the organisation's practices and, where fines apply, toward the public treasury. A complainant does not receive any portion of a CNIL fine.

No Compensation From the CNIL: Why a Court May Be Needed

This is the point most complainants get wrong, and it is worth stating without qualification: the CNIL cannot award damages to an individual. The CNIL's own guidance is direct on this question. Only a judge can order the organisation responsible for a data file to pay compensation, and only where it is proven that the organisation committed a fault that caused measurable harm.

In practical terms, a complainant who wants money for harm caused by a data protection breach, such as financial loss, distress, or reputational damage, generally needs to bring a separate civil claim before a court (a tribunal judiciaire), not a CNIL complaint. The two paths can run alongside each other: a CNIL complaint targets compliance and possible sanction against the organisation, while a court case targets compensation for the individual. Filing one does not substitute for the other.

Anyone weighing whether to complain to the CNIL, sue in civil court, or do both should keep that split squarely in mind before choosing a path, since the outcomes each path can deliver are genuinely different.

How Long a CNIL Complaint Takes

The CNIL commits to informing a complainant of the status of their file within at least three months. That figure is frequently misread as a resolution deadline. It is not. It is a service commitment to give an update on where things stand, not a promise that the matter will be closed by that date.

A straightforward file, for example an unanswered access request that the CNIL resolves with a quick reminder to the organisation, can close well inside three months. A complex file that leads toward a formal sanction procedure, with document requests, an inspection, and a hearing before the CNIL's restricted formation (formation restreinte), routinely runs much longer. Complainants should treat the three month figure as a checkpoint for information, not a countdown to closure.

The CNIL can also close a file without further action, a classement sans suite, if it finds no breach or decides the matter does not warrant a formal procedure.

The Simplified Sanction Procedure and the RGPD Fine Ceilings

Not every sanctioned file goes through the CNIL's full ordinary procedure. A simplified sanction procedure exists for less complex or less severe cases. It is decided alone by the president of the CNIL's restricted formation, or another member of that formation, rather than by the full panel. Fines issued this way are capped at 20,000 EUR, with any daily penalty payment capped at 100 EUR per day. Decisions issued under the simplified procedure are never published and never name the sanctioned organisation.

More serious cases go through the ordinary procedure, where the RGPD's general fine ceilings apply: up to 10 million EUR or 2 percent of worldwide annual turnover for less severe breaches, and up to 20 million EUR or 4 percent of worldwide annual turnover for the most severe, whichever figure is higher.

Scale matters here. In 2025 the CNIL issued 83 total sanctions, 67 of them through the simplified procedure, for a combined total of about 486.8 million EUR. That headline number is dominated by two large fines against major technology companies over cookie consent practices; strip those two cases out and the remaining 81 sanctions totalled roughly 11.8 million EUR. A single individual complaint about, for example, an unanswered access request or an unlawfully placed video surveillance camera is far more likely to land in simplified-procedure territory, capped at 20,000 EUR, than anywhere near the headline figure. Early in 2026 the CNIL issued 23 further simplified sanctions totalling 133,750 EUR, several concerning cameras operated without the required prefectural authorisation or filming employees on a permanent basis.

Appealing a CNIL Decision

A CNIL sanction, or a formal notice (mise en demeure) issued by its president, can be challenged before the Conseil d'Etat, France's highest administrative court. The deadline is two months from notification of the decision, extended to four months for an organisation located outside France. The Conseil d'Etat rules in first and last instance on these appeals, meaning there is no further ordinary layer of appeal above it.

This appeal route runs from the sanctioned organisation's side, since it is the organisation that is being ordered to pay a fine or comply with a notice. A complainant whose file is simply closed without action is in a different position, and the closure of an individual complaint does not carry the same formal sanction-appeal mechanics described here.

The Individual Rights Most Complaints Are Built On

Most CNIL complaints trace back to one of a small set of individual rights under the RGPD: the right of access to one's own data, the right to rectification of inaccurate data, the right to erasure, the right to object to certain processing, and the right to limit processing while a dispute is resolved. A fuller description of these rights, which apply across the European Union, sits in this guide to RGPD data subject rights.

The pattern behind a typical complaint is simple: a person exercises one of these rights in writing, the organisation misses the one month response window or refuses without a valid basis, and the person then brings that documented history to the CNIL. The complaint form itself is built around this sequence, which is exactly why the CNIL asks what steps were already taken before the file reaches its desk.

Complaints about French data protection generally sit within the broader framework covered in this overview of France's data privacy laws, and readers dealing specifically with an unlawful camera or recording device may also want the companion guide to recording conversations in France. For the fuller range of France coverage on this site, see the France hub.

Disclaimer

This article is provided for general informational purposes only and does not constitute legal advice. Data protection rules, CNIL procedure, and sanction figures change over time; a person considering a complaint or a court claim should confirm current requirements directly with the CNIL at cnil.fr or with a qualified French lawyer before acting.