Key points
- The first hours determine the evidence, compensation and compliance with legal time limits.
- Isolate the affected systems without reinstalling them: reinstalling destroys the evidence.
- For insured professionals, compensation for cyber losses requires a criminal complaint within 72 hours (Article L. 12-10-1 of the French Insurance Code).
- The CNIL must be notified without undue delay and, where feasible, within 72 hours if there is a risk to individuals (Article 33 of the GDPR).
- The data subjects are informed only if there is a high risk (Article 34 of the GDPR).
- The lawyer coordinates the legal response, in parallel with the work of the technical teams.
As soon as you discover a cyberattack, isolate the affected systems without erasing them, keep a precise timeline and mobilise your technical and legal teams. If you are a professional insured against cyber risks, file a criminal complaint within 72 hours of discovery. Then assess the impact on personal data: the CNIL (French data protection authority) must be notified without undue delay and, where feasible, within 72 hours if there is a risk, and the data subjects informed if there is a high risk. Every situation is different.
What to do in the first hours after a cyber attack
A cyberattack disrupts the business at the worst possible moment. Yet the decisions taken in the first hours shape what follows: the strength of the evidence, insurance cover and compliance with legal obligations. Our team of cybersecurity lawyers observes that legal difficulties often arise from technical reactions that are understandable but hasty.
Here is the action plan we recommend, to be adapted to your organisation.
- Set up a small crisis unit. Bring together management, the IT manager, an in-house lawyer or external lawyer, and communications. Appoint a single decision-maker and a secure communication channel, outside any messaging systems that may be compromised.
- Isolate without destroying. Disconnect the affected machines from the network, but do not systematically switch them off and do not reinstall anything. Logs, disk images and fraudulent messages are the evidence of the offence and of your diligence.
- Start a written timeline. Record each event with the date and time: discovery, symptoms, decisions, contacts. This log will serve the insurer, the CNIL, the investigators and, where applicable, the court.
- Reread your contracts. Cyber insurance policy, managed services and hosting contracts, customer contracts: they contain reporting deadlines, notification obligations and cooperation clauses that are already running. The pitfalls of these policies are detailed in our guide cyber insurance: exclusions and refusals of cover.
- Notify your insurer of the loss and file a criminal complaint. For legal entities and professionals, payment of compensation covering losses caused by an attack on an automated data processing system is conditional on filing a complaint no later than 72 hours after becoming aware of the attack (Article L. 12-10-1 of the Insurance Code). The period runs from discovery, not from the attack itself.
- Identify the data affected. Determine whether personal data has been accessed, exfiltrated or encrypted: customers, employees, prospects. This assessment determines the obligations under Articles 33 and 34 of the GDPR.
- Analyse the notification obligations. If there is a risk to the rights and freedoms of individuals, notify the CNIL without undue delay and, where feasible, no later than 72 hours after becoming aware of it (Article 33 of the GDPR). Informing the data subjects follows a separate criterion: it is required only if there is a high risk (Article 34).
- Control your communication. Do not communicate too early or beyond the established facts. An inaccurate public statement may later be used against the company.
Who must you notify after a cyberattack in France?
Several recipients must or may be notified, under conditions and time limits that should not be confused. The following table summarises the main scenarios.
| Recipient | Trigger | Time limit | Legal basis |
|---|---|---|---|
| CNIL | Personal data breach likely to result in a risk to individuals | Without undue delay and, where feasible, within 72 hours of becoming aware; notification in phases possible | Article 33 of the GDPR |
| Data subjects | High risk to their rights and freedoms, subject to exceptions (encrypted data, measures removing the risk) | Without undue delay | Article 34 of the GDPR |
| Insurer | Loss covered by cyber or fraud insurance | Contractual reporting deadline; complaint within 72 hours for compensation of professionals’ losses | Contract and Article L. 12-10-1 of the Insurance Code |
| Police, gendarmerie or public prosecutor | Offence detected (unauthorised access, obstruction, data extraction) | As soon as possible, and within 72 hours if insurance compensation is at stake | Articles 323-1 to 323-3 of the French Criminal Code (offences); Article L. 12-10-1 of the Insurance Code (72-hour period) |
| Controller (if you are a processor) | Any data breach affecting the processing entrusted to you | Without undue delay after becoming aware | Article 33(2) of the GDPR |
| Contractual partners and customers | Incident notification clauses in current contracts | Contractual deadlines | Contracts (including clauses derived from Article 28 of the GDPR) |
Two 72-hour periods therefore coexist, and must never be confused. The one in Article 33 of the GDPR concerns notification of the breach to the CNIL. The one in Article L. 12-10-1 of the Insurance Code concerns the criminal complaint that conditions compensation for professionals. The recipients, conditions and starting points differ.
If the attack hits your processor, the allocation of roles is strict: the provider alerts you without undue delay, but it is you, as controller, who notifies the CNIL. The CNIL illustrated this interplay in a practical fact sheet published on 27 May 2026, devoted to the processor in a cyber crisis.
Should you report the incident to ANSSI?
The question often arises in the first hours. As at 5 October 2026, the French law transposing the NIS2 Directive has not yet been enacted: the general regime of mandatory incident notification to ANSSI (French national cybersecurity agency), provided for by the bill under consideration, is therefore not in force for most companies. It may change once the text is finally adopted.
ANSSI nevertheless invites future entities in scope, as of now, to pre-register online and to report their security incidents to it. This step lets you anticipate the future framework. Entities in the financial sector, for their part, remain subject to their own regime for notifying major incidents, derived from the DORA Regulation, applicable since 17 January 2025. So always check the sector-specific regimes applicable to your business, in addition to the GDPR.
Mistakes to avoid
Paying a ransom without prior analysis. Cybermalveillance.gouv.fr (French government cyber-assistance platform) recommends not paying: payment offers no assurance of recovery and finances crime. It may also expose the company to a risk under international sanctions if the recipient is an entity targeted by European restrictive measures. If paying is considered, the decision must be documented and informed by legal advice.
Reinstalling everything immediately. Restoring systems before copying the media and logs destroys the evidence. You weaken the criminal complaint, your position with the insurer and your ability to demonstrate your security measures in the event of an inspection.
Communicating too quickly. Publicly announcing that no data has leaked before the investigations are complete, or downplaying the incident, can backfire on the company. Informing individuals, when required, must follow specific content: accurate, controlled communication is better than fast, approximate communication.
Neglecting internal documentation. Even when no notification to the CNIL is required, every breach must be documented internally: facts, effects, measures taken (Article 33(5) of the GDPR). This record can be requested during an inspection.
Lawyer and technical provider: two complementary roles
The incident response provider contains the attack, analyses the modus operandi and restores the systems. This technical work is essential. It does not cover the legal side of the crisis.
The lawyer ensures that decisions are legally sound as they are taken: assessment of the data affected, whether to notify and what to include, filing the complaint in time, dealings with the insurer, review of contractual obligations towards customers and partners. The lawyer also anticipates litigation: compensation claims by data subjects, disputes with providers, follow-up to a CNIL inspection. Our page on cyber litigation (in French) details these situations.
Finally, the crisis often reveals contractual weaknesses: missing notification clauses, poorly allocated liability with the managed services provider, unsuitable insurance. A legal post-incident review, carried out once things have calmed down, turns the incident into a remediation plan. Where personal data has been compromised, the assistance continues in the field of personal data breaches.
Frequently asked questions after a cyberattack
Do you always have to notify the CNIL after a cyberattack?
No. Notification is required only if the personal data breach is likely to result in a risk to the rights and freedoms of individuals (Article 33 of the GDPR). However, every breach must be documented internally, even without notification.
Does the 72-hour period run from the date of the attack?
No. The starting point is when the company becomes aware of the breach, not the date of the intrusion. The rule applies both to notification to the CNIL and to the complaint that conditions insurance compensation, two separate obligations.
Who notifies the CNIL if the attack hits our processor?
The processor must alert you without undue delay, but notification to the CNIL is the responsibility of the controller (Article 33 of the GDPR). The data processing agreement must organise this cooperation.
Is filing a criminal complaint mandatory?
No general provision requires you to file a criminal complaint. But for insured professionals, a complaint within 72 hours is a condition for compensation of losses caused by the attack on the information system (Article L. 12-10-1 of the French Insurance Code). Cybermalveillance.gouv.fr also recommends filing a complaint before reinstalling the affected devices.
What penalties does the perpetrator of a cyberattack face?
Fraudulently accessing or remaining in a system is punishable by 3 years’ imprisonment and a €100,000 fine; obstructing its operation by 5 years and €150,000; fraudulently extracting data by 5 years and €150,000 (Articles 323-1 to 323-3 of the French Criminal Code). These penalties are increased when the offence is committed by an organised gang.
Official sources
- Articles 33 and 34 of Regulation (EU) 2016/679 (GDPR), notification of data breaches and communication to data subjects – EUR-Lex
- Article L. 12-10-1 of the French Insurance Code (Code des assurances), criminal complaint within 72 hours as a condition for compensation of cyber risks – Légifrance (in French)
- Article 323-1 of the French Criminal Code (Code pénal), unauthorised access to and remaining in an automated data processing system – Légifrance (in French)
- ANSSI and the French Ministry of Justice (DACG), guide “Attaques par rançongiciels, tous concernés” (translation: Ransomware attacks, everyone is concerned) – cyber.gouv.fr
- CNIL, fact sheet on the processor in a cyber crisis (French title: “Cyberattaque : le sous-traitant au centre de la crise”; translation: Cyberattack: the processor at the centre of the crisis), 27 May 2026 – cnil.fr (in French)
This article presents the law for general information purposes. It does not constitute legal advice. Every situation is different and calls for a specific analysis. Content compliant with the professional conduct rules of the legal profession.
