CNIL Issues Ten Cybersecurity Fines to French Public Bodies

France's data protection regulator, the CNIL, announced on November 9, 2026 that it had issued ten sanctions under its simplified procedure against collectivités territoriales (local authorities) and one établissement public, with fines of €3,000 to €20,000, for security failures under Article 32 GDPR and for missing data protection impact assessments.

Information last verified on November 9, 2026. This is a developing story; we update it as the record changes.

Scope of this article. This covers one French regulatory announcement under the GDPR and the loi Informatique et Libertés of January 6, 1978, as applied to French local authorities and public bodies. It does not cover other EU member states, it does not identify any sanctioned authority, and it is not an assessment of any particular commune's compliance. For the surrounding framework, see our overview of French data protection law.

What Happened

On November 9, 2026 the CNIL published an announcement titled "Cybersécurité des collectivités territoriales : la CNIL prononce dix sanctions". It states that in November 2026 the regulator issued ten financial sanctions through the simplified procedure against collectivités territoriales and one établissement public.

The announcement gives the number of sanctions and the range of the fines, and nothing more about who received them. It names no commune, department, region or public establishment, and it links no individual deliberation.

The sanctions grew out of a programme the CNIL set in advance. On March 21, 2025 it announced three priority inspection themes for 2025, one of which was the cybersecurity of local authorities, alongside mobile-app data collection and prison-service processing. That page records 321 inspections in 2024 and 5,629 personal data breach notifications received in 2024, 20 percent more than in 2023.

The inspections covered local authorities, other public bodies and their service providers, and tested whether the technical, organisational and physical measures protecting residents' data were sufficient.

The security findings

The announcement sets out six Article 32 GDPR findings. It introduces them as examples of what the inspections turned up, after noting that the breaches show the diversity of the flaws that can affect an information system, so the six are not a closed taxonomy. Remote authentication for staff connecting from outside the office, including from home, was not robust enough, and in particular there was no multifactor authentication for accounts with elevated privileges.

Outside providers, software publishers among them, could reach authority networks permanently rather than being authorised case by case, or did so through accounts shared between several employees.

Detection of abnormal behaviour was ineffective: logging was incomplete, or the logs were never exploited in real time or over the short term. Network segmentation was insufficient, which meant a single breach could spread across several network segments.

Some servers ran operating systems their publisher no longer maintained, so they received no security patches. Some passwords were too weak, were sent to users in cleartext, or were stored in conditions that could not keep them confidential.

The CNIL adds that several of the inspected authorities had already suffered one or more data breaches that adequate measures could have prevented. Several decisions also found that information systems used to interact with residents online had gone into service without the security homologation required by the référentiel général de sécurité (RGS), the general security framework for French administrative authorities.

The impact-assessment findings

Several authorities were sanctioned for deploying high-risk processing without first carrying out an analyse d'impact relative à la protection des données (AIPD), the French term for a data protection impact assessment.

The CNIL gives two examples of such processing. The first is the téléservices that let parents manage their children's school and extracurricular activities, because they involve both vulnerable people, namely children, and highly personal data, namely bank details. The second is vidéoprotection systems installed on the public highway, which the CNIL describes in quotation marks as constituting a systematic large-scale monitoring of a publicly accessible area.

The amounts

Des amendes allant de 3 000 € à 20 000 € (maximum légal pour ce type de procédure) ont été prononcées.

Source: CNIL, Cybersécurité des collectivités territoriales : la CNIL prononce dix sanctions, November 9, 2026, at the section Les sanctions prononcées.

The announcement lists the factors behind the amounts: the number of breaches found and their gravity, the categories of data processed, with minors' data and bank details called out, each authority's budget, the number of people affected, and the steps already taken to come into compliance.

The CNIL closes by saying it is devoting half of its 2026 inspections and enforcement action to data security, that other procedures are currently under way and could lead to sanctions, formal notices or reminders of obligations, and that its combined inspection and support work feeds into preparing for the NIS2 directive, which is still being transposed into French law.

What the Law Actually Says

Four provisions carry this action, and they do not all come from the same instrument. Three of them define the duties the CNIL enforced; the fourth is the procedure that let it issue ten decisions at once. Our explainer on how the GDPR operates inside French law sets out the relationship between the regulation and the national statute.

Article 32 GDPR, security of processing. The regulation requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, implementation costs, and the nature, scope, context and purposes of the processing. Article 32(1) lists examples including pseudonymisation and encryption, means of ensuring continued confidentiality, integrity, availability and resilience, means of restoring availability and access after an incident, and a process for regularly testing, assessing and evaluating the effectiveness of the measures. Article 32(2) directs that the assessment of an appropriate level of security take particular account of risks arising from accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data. Note that Article 32 sets a risk-calibrated standard, not a checklist: the six failures the CNIL describes are findings about particular systems, not items copied out of the regulation.

Article 35 GDPR, data protection impact assessment. Where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out an assessment of the impact of the envisaged processing before the processing begins. Article 35(3) then names three cases where an assessment is required in particular, and the third is systematic large-scale monitoring of a publicly accessible area. The phrase the CNIL placed in quotation marks for the camera systems is that statutory trigger reproduced almost exactly; in the French text the only difference is the leading article. Article 35(4) also obliges the supervisory authority to draw up and publish a list of processing types for which an assessment is required, and Article 35(7) sets out the minimum contents of the assessment.

Article 90 of the loi Informatique et Libertés. This is the provision to read carefully, because it is not simply the French echo of Article 35. It sits in Titre III of the statute, which transposes Directive (EU) 2016/680, the law enforcement directive. By Article 87, that title applies to processing by competent public authorities for the purposes of preventing and detecting criminal offences, investigating and prosecuting them, or executing criminal penalties, including protection against and prevention of threats to public security. Article 90 requires the controller to carry out an impact assessment where processing within that title is likely to create a high risk, in particular because it covers the sensitive categories listed in Article 6(I), and it adds a duty of prior consultation with the CNIL in defined cases.

So the CNIL cited a GDPR provision and a national provision belonging to a different legal regime in the same group of decisions. The announcement does not say which of the ten decisions rested on which provision, and the allocation has real legal consequences. Article 87 is not met by a public-safety motive alone. It requires both one of the criminal-enforcement purposes it lists, which include protection against and prevention of threats to public security, and that the processing be carried out by a competent authority or by a body entrusted with public-authority prerogatives for those same purposes.

Nothing the CNIL published here settles whether a commune's public-highway cameras meet that test, and we do not resolve it. The CNIL does treat the question as a live one for camera systems: its own vidéoprotection guidance says the duty to inform people flows from Article 13 GDPR together with either article 104 or article 116 of the loi Informatique et Libertés, depending on whether the system falls under the GDPR or under the police-justice directive. On the camera side specifically, our page on camera surveillance rules in France covers the wider authorisation and signage regime.

Article 22-1 of the loi Informatique et Libertés, the simplified procedure. This is the machinery that produced ten decisions at once. The CNIL president may bring proceedings under the simplified procedure where the corrective measures available are the appropriate response to the gravity of the breaches found, and the president of the formation restreinte, the CNIL body that imposes sanctions, or a single designated member of it, decides alone.

The ceiling is set in the second paragraph of Article 22-1: the administrative fine at stake must not exceed €20,000 and any daily penalty must not exceed €100 per day of delay. Those figures rise to €100,000 and €500 per day where the controller's total worldwide annual turnover for the previous financial year exceeds €50 million. The CNIL's announcement describes €20,000 as the legal maximum for this type of procedure, which is the lower tier; the announcement does not discuss the higher tier, and local authorities are funded by budgets rather than turnover.

Article 22-1 also requires that the case present no particular difficulty, judged against settled case law, previous decisions of the formation restreinte, or the simplicity of the questions of fact and law. The organisation receives the report of the rapporteur, the CNIL official who investigates the case and proposes the sanction, and may be represented or assisted, may file written observations, and may ask to be heard. The CNIL's own procedure page adds that the organisation has one month from receipt of the report to file written observations and that the procedure is a written one.

Then comes the provision that explains the anonymity of this entire announcement.

Il statue ensuite et ne peut rendre publiques les décisions qu'il prend.

Source: Loi n° 78-17 du 6 janvier 1978, article 22-1, at the sixth paragraph.

The decision maker rules, and may not make the decisions public. The confidentiality is not an editorial choice by the CNIL and not a courtesy to the authorities; it is written into the statute that creates the procedure.

The CNIL puts the same point in its own words on a separate page about the procedure, published on July 6, 2026: a simplified sanction cannot exceed €20,000 and the CNIL cannot disclose the name of the sanctioned organisation. The Conseil d'État, France's supreme administrative court, reproduced the publication bar verbatim on April 15, 2025 when it upheld a €20,000 simplified-procedure fine, so the restriction has been applied by a court and not only described by the regulator.

That is why there is no deliberation to read, and why the public register of CNIL sanctions lists simplified-procedure entries only by generic organisation type, with wording such as an association religieuse or a médecin, and without the link to the deliberation that ordinary-procedure entries carry. Local authorities already appear in that register the same way: earlier rows read simply a commune, or a collectivité territoriale, followed by the words procédure simplifiée.

A reader who wants to know whether a particular commune was among the ten will not find out from the CNIL. A resident who believes their own data was mishandled has a separate route, which is the complaint process; our guide to filing a complaint with the CNIL explains how that works and what it can and cannot achieve.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The money here is not the story. Ten fines topping out at €20,000 will not move the budget of a mid-sized French commune, and the CNIL plainly knows that, since it set the amounts partly by reference to each authority's budget. What the announcement delivers instead is a published catalogue of the specific failures a French regulator found sufficient to fine a public body for, and that catalogue is more useful to a mairie, the municipal administration, than the numbers are.

Read as a benchmark, the six security findings are notable for how ordinary they are. None of them involves a novel attack or an exotic technology. No multifactor authentication on administrator accounts, vendors with standing network access, logs that nobody reads, flat networks, unpatched servers and passwords sent in cleartext are the basic items on any security baseline. The implication a reader can fairly draw is that the CNIL is enforcing against the absence of fundamentals, not against sophisticated shortcomings.

The impact-assessment findings are less uniform than the security ones, and the school portals are the part worth watching. For public-space cameras the regulator simply reproduced the statutory wording. Article 35(3)(c) names systematic large-scale monitoring of a publicly accessible area outright, so that finding rests on an explicit trigger in the text.

The school téléservices do not. None of the three cases listed in Article 35(3) covers them: bank details are not special-category data under Article 9(1), and a booking-and-billing portal is neither profiling that produces legal effects nor monitoring of a public area. The CNIL's reasoning there runs through the general high-risk test in Article 35(1), together with the vulnerable-persons and highly-personal-data criteria that its own impact-assessment lists draw from the European guidelines.

That distinction matters, because the CNIL's published list of processing for which an impact assessment is not required points the other way. The list exonerates processing carried out by local authorities to manage school, extracurricular and early-childhood services, and its examples include the registration, follow-up and billing of exactly those services. It carries a caveat that the exemption does not remove other GDPR duties and that an assessment is advisable in case of doubt, and it has not been revised since 2019. Even so, an authority that read that list and concluded no assessment was needed for its parent portal was reading the regulator's own document. The announcement does not acknowledge that conflict, and this is the one finding here that an authority could answer by pointing to a published CNIL text.

There is a genuine transparency tension in the procedure itself, and it is worth naming because the statute creates it deliberately. Article 22-1 buys speed and volume by letting one person decide alone on the papers, and the price it sets is that the decisions stay unpublished. Ten sanctions can therefore issue in a month against bodies funded by taxpayers, over the handling of residents' and children's data, and the residents cannot learn whether their own authority was one of them. Compare the Fnac Darty decision of October 22, 2026, announced on October 29, 2026, where the CNIL imposed €7 million under the ordinary procedure and stated expressly that the decision was made public in view of the gravity of the breach, the scope of the processing and the number of people concerned. The ordinary procedure can name; the simplified procedure, by statute, cannot.

That constraint also limits what anyone, including us, can responsibly say about these ten cases. We have an announcement summarising ten decisions, not the decisions. The register of sanctions had not caught up at the time of writing, with its most recent 2026 entry dated April 2, 2026, so there is currently no second CNIL source against which to check the breakdown. Any account that assigns a particular finding to a particular authority, or that allocates the Article 35 and Article 90 counts between the ten decisions, is going beyond the record as it stands.

The forward-looking part of the announcement is the part a French public-sector reader should probably weigh most. The CNIL says half of its 2026 inspections and enforcement action is going to data security, that further procedures are already running, and that it is positioning this work for NIS2, which it describes as still in transposition. The regulator is describing a continuing programme rather than a closed exercise, and it has now shown what it fines for.

How This Affects You

If you work in a French local authority or a public establishment. The six security findings and the two impact-assessment examples in this announcement are the most recent statement of what the CNIL inspected and found wanting. The CNIL publishes, under Article 35(4) GDPR, a list of processing types for which an impact assessment is required, and under Article 35(5) a list of types for which one is not; its impact-assessment guidance pages host both. Read the second list rather than relying on it: it exonerates local-authority management of school, extracurricular and early-childhood services, including billing, yet the CNIL has now fined authorities for running parent-facing school téléservices without an assessment. Note also the point that is easy to miss: several decisions turned on information systems going live without RGS security homologation, which is an administrative-law requirement separate from the GDPR.

If you are a French resident, or a parent using a school portal. Nothing in this announcement tells you whether your own commune was sanctioned, and Article 22-1 means the CNIL cannot tell you. What the GDPR does give you, independently of any enforcement action, are the data subject rights, including access, and a route to lodge a complaint with the CNIL about a specific controller. A complaint is about your own situation; it is not a way to obtain an unpublished simplified-procedure decision about somebody else's.

If you are following French enforcement generally. The CNIL has been active on adjacent fronts in the same period: on November 5, 2026 it published a recommendation on session replay tools, which record or reconstruct a user's browsing, confirming that those tools require prior consent because no exemption under Article 82 of the loi Informatique et Libertés applies to them. That recommendation concerns website and app operators, including public ones, rather than the internal security questions at issue in these ten sanctions.

This is general legal information, not legal advice. It covers France, specifically the GDPR as applied by the CNIL and the loi Informatique et Libertés of January 6, 1978, and reflects sources verified on November 9, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• French data protection law
• The GDPR as it applies in France
• Rules on camera surveillance in France
• How to complain to the CNIL

Last updated: 2026-11-09. This is a developing story; details verified as of 2026-11-09.

Frequently Asked Questions

How many sanctions did the CNIL issue, and against whom?

Ten financial sanctions, issued in November 2026 under the simplified procedure and announced on November 9, 2026, against French collectivités territoriales (local authorities) and one établissement public (public establishment). The announcement does not state how the ten are divided between local authorities and the public establishment.

What were the fine amounts?

From €3,000 to €20,000. The CNIL states in the announcement that €20,000 is the legal maximum for this type of procedure, and Article 22-1 of the loi Informatique et Libertés sets that figure for the simplified procedure.

Did the CNIL name the local authorities it fined?

No. The announcement names no commune, department, region or public establishment, and links no individual decision. Article 22-1 of the loi Informatique et Libertés provides that the official deciding a simplified-procedure case may not make the decisions public.

Can I find out whether my own commune was fined?

Not from the CNIL. Because of the publication bar in Article 22-1, simplified-procedure decisions are not published, and the CNIL's public sanctions register lists such entries by generic organisation type only, without a link to the deliberation.

What security failures did the CNIL find under Article 32 GDPR?

The announcement sets out six, introduced as examples rather than a closed list: remote authentication that was not robust enough, notably no multifactor authentication for administrator accounts; outside providers with permanent or shared network access; ineffective detection of abnormal behaviour through incomplete or unexploited logging; insufficient network segmentation; obsolete and therefore unpatched server operating systems; and weak, cleartext or insecurely stored passwords.

Why did school parent portals need a data protection impact assessment?

The CNIL treats the téléservices through which parents manage school and extracurricular activities as high-risk processing because they involve both vulnerable people, namely children, and highly personal data, namely bank details, which engages the general high-risk duty in Article 35(1) GDPR. Note the tension: the CNIL's own published list of processing for which an assessment is not required exonerates local-authority management of school, extracurricular and early-childhood services, including billing, and that list has not been revised since 2019.

Why did public-space cameras need an impact assessment?

Article 35(3)(c) GDPR requires an assessment in particular for systematic large-scale monitoring of a publicly accessible area, and the CNIL quoted that wording when describing vidéoprotection systems on the public highway. The announcement also cites Article 90 of the loi Informatique et Libertés, which is the impact-assessment duty under the law enforcement regime in Titre III of that statute.

What is the CNIL's simplified sanction procedure?

A written procedure under Article 22-1 of the loi Informatique et Libertés for cases presenting no particular difficulty, in which the president of the formation restreinte or a single designated member decides alone on the basis of a rapporteur's report. The organisation has one month from receipt of the report to file written observations and may ask to be heard.

Is €20,000 always the ceiling under the simplified procedure?

No. Article 22-1 sets €20,000 and a daily penalty of €100, but raises them to €100,000 and €500 per day where the controller's total worldwide annual turnover for the previous financial year exceeds €50 million. The CNIL applied the lower tier here and described it as the legal maximum for this type of procedure.

Are more sanctions against French local authorities expected?

The CNIL states that other procedures are currently under way and could lead to sanctions, formal notices or reminders of obligations, and that it is devoting half of its 2026 inspections and enforcement action to data security. It does not give a number or a timetable.