#Cyberattack Lawyer in France: Support for Businesses

Key points

• A cyberattack calls for a dual legal classification: an attack on the information system (Articles 323-1 to 323-3 of the French Criminal Code) and, if personal data is affected, a data breach within the meaning of the GDPR.
• Notification to the CNIL (French data protection authority) is made without undue delay and, where feasible, within 72 hours of becoming aware of the breach, where there is a risk (Article 33 GDPR).
• To preserve cyber insurance compensation, the company files a criminal complaint no later than 72 hours after becoming aware of the attack (Article L. 12-10-1 of the French Insurance Code).
• Paying a ransom is advised against by ANSSI (French National Cybersecurity Agency) and Cybermalveillance.gouv.fr (French government cyber-assistance platform); it is not prohibited as such, but it may expose the company to European sanctions regimes.
• The lawyer organises the legal response; technical investigation and remediation are matters for independent specialist experts.

A cyberattack lawyer organises the legal response of the company under attack: classifying the facts, mandatory notifications, filing a criminal complaint, activating insurance cover and protecting your contractual position. The lawyer acts as soon as the alert is raised, in coordination with the technical experts, then prepares the remedies. Hashtag Avocats, a digital law firm in Paris, assists businesses at every stage of the legal handling of a cyberattack.

This page details the crisis path of a company that has been attacked. For risk prevention and an overview of our work, see our cybersecurity lawyer page; for regulatory preparation in essential sectors, our NIS2 lawyer page tracks the transposition of the directive.

Legally classifying the attack: a decisive step

Classifying the facts drives everything else: obligations, deadlines, contacts, remedies. The French Criminal Code punishes fraudulent access to, or remaining in, an automated data processing system with 3 years’ imprisonment and a €100,000 fine, increased to 5 years and €150,000 where data is deleted or modified (Article 323-1). Obstructing the operation of the system – typical of ransomware – exposes the offender to 5 years and €150,000 (Article 323-2), as does the fraudulent extraction or transmission of data (Article 323-3).

If the attack affected personal data – customer files, employee data, login credentials – a second regime applies in addition: the GDPR data breach regime. The two classifications frequently overlap. We analyse the first technical findings to determine which obligations apply to your company, within what deadlines and towards whom.

Immediate obligations of a company hit by a cyberattack

Documenting the incident and preserving evidence

Article 33(5) of the GDPR requires every data breach to be documented internally, including breaches that will not be notified: facts, effects, remedial action taken. This documentation will be used with the CNIL, the insurer and the court. It requires logs and traces to be preserved before any systems are restored. For an operational sequence of the first steps, see our article cyberattack: what to do in the first hours.

Notifying the CNIL and informing the individuals concerned

Notification to the CNIL is not systematic: it is required if the breach is likely to result in a risk to individuals, without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR). It can be made in phases if not all the information is available immediately. Informing the individuals concerned is subject to a separate threshold: high risk (Article 34). A processor that is the victim alerts the controller without undue delay. Our personal data breach lawyer page details these obligations.

Filing a complaint within 72 hours: the insurance condition

Since the LOPMI law (French law on the orientation and programming of the Ministry of the Interior), Article L. 12-10-1 of the Insurance Code makes payment of the indemnity covering losses caused by an attack on the system conditional on a criminal complaint being filed no later than 72 hours after becoming aware of the attack. This condition applies to professionals, whether legal entities or individuals. Note: this deadline is separate from the CNIL notification deadline – a different recipient, a different purpose, the same practical starting point. The complaint also triggers the public prosecution and establishes your status as a victim.

Ransomware: what does French law say when a ransom is demanded?

Ransomware constitutes obstruction of the operation of the system, punished by Article 323-2 of the Criminal Code, and is often combined with data exfiltration. ANSSI and Cybermalveillance.gouv.fr recommend not paying the ransom: there is no certainty of recovery, data may be disclosed despite payment, and payment finances crime. Payment is not, in itself, prohibited by French law, but it may expose the company to a risk under European restrictive measures if the recipient is a listed person or entity.

Management is accountable for this decision: it should be taken with full legal advice, in liaison with the insurer and the authorities. We analyse the issues in our article ransomware: should you pay the ransom?

Insurer, service providers, contracts: using your levers

Notifying the claim to the insurer

The claim notification follows the policy you have taken out: contractual deadlines, scope of cover, exclusions, cooperation obligations. We review your cover, prepare the claim notification and make sure your statements to the insurer, the CNIL and the authorities are consistent. A contradiction between these accounts would weaken your position if cover is refused.

IT service providers and processors

If the attack came through a service provider – a hosting provider, a managed services provider, a SaaS vendor – its contractual obligations come into play. Article 28(3)(f) of the GDPR requires the processor to assist the controller in complying with its security and notification obligations. We audit the contracts concerned, send any necessary formal notices and preserve your liability claims. These actions are prepared during the crisis itself, in particular by preserving evidence: our cyber litigation lawyer (in French) page presents these proceedings.

Communicating during the crisis without creating new risks

Customers, partners, employees, the press: every statement commits the company. Communication must remain consistent with the CNIL notification and the information given to the individuals concerned – which may take the form of a public communication where individual information would involve disproportionate effort (Article 34(3) GDPR). The CNIL also warns of scams targeting breach victims, such as fake organisations offering to “delete” the stolen data: informing your contacts of these secondary risks is part of a controlled response.

During the crisis: who does what between the lawyer and the technical experts

A lawyer does not carry out digital forensics, containment or infrastructure restoration. These tasks are for independent technical experts, with whom we coordinate our work throughout the crisis:

What the lawyer does	What the technical experts do
Legal classification of the facts and liabilities	Digital forensics and analysis of the compromise
CNIL notification, information to individuals, filing a criminal complaint	Containment, eradication and restoration of systems
Notifying the insurer and following up the cover	Technical preservation of traces and logs
Formal notices, claims against service providers, framing communication	Hardening the infrastructure after the incident

FAQ: cyberattack lawyer

What are the consequences of a cyberattack for a company?

Beyond the interruption of business, the attack triggers legal obligations: internal documentation, possible notification to the CNIL, informing the individuals concerned, a criminal complaint within 72 hours for insured professionals. It can then lead to litigation: claims against a service provider, discussions with the insurer, claims by customers or employees.

Who should you contact after a ransomware attack in France?

On the technical side, incident response experts; Cybermalveillance.gouv.fr directs businesses to listed service providers. On the legal side, a lawyer to organise the complaint, the notifications and the relationship with the insurer. Filing a complaint within 72 hours is a condition of compensation for insured professionals.

Should you pay the ransom?

ANSSI and Cybermalveillance.gouv.fr recommend not paying: there is no certainty of recovery and payment finances crime. Payment is not prohibited as such by French law, but it becomes unlawful if the recipient is targeted by European restrictive measures. The decision deserves prior legal analysis, case by case.

What is the deadline for filing a complaint after a cyberattack?

To preserve cyber insurance compensation, professionals file a criminal complaint no later than 72 hours after becoming aware of the attack (Article L. 12-10-1 of the Insurance Code). The starting point is awareness of the attack, not the attack itself. After that, a complaint is still possible, but the insurance indemnity is jeopardised.

Can the CNIL penalise a company that is the victim of an attack?

Being attacked is not a fault in itself. However, the CNIL penalises breaches of the security obligation under Article 32 of the GDPR revealed by the attack, as shown by the penalties imposed in January 2026 on Free and Free Mobile (€42 million in total) and France Travail, the French public employment service (€5 million). Hence the importance of documenting the measures taken, before and after the incident.

Official sources

• Articles 323-1 to 323-3 of the French Criminal Code (attacks on automated data processing systems): Légifrance (in French)
• Regulation (EU) 2016/679 (GDPR), Articles 28, 32, 33 and 34: consolidated text on EUR-Lex
• Article L. 12-10-1 of the French Insurance Code (Law No. 2023-22 of 24 January 2023): Légifrance (in French)
• Ransomware quick-response guide: Cybermalveillance.gouv.fr (in French)
• Guide “Ransomware attacks, all concerned” (ANSSI-DACG): messervices.cyber.gouv.fr
• European restrictive measures against cyberattacks (Regulation (EU) 2019/796): DG Trésor
• CNIL, penalties against Free and Free Mobile of 13 January 2026: cnil.fr (in French)
• CNIL, penalty against France Travail of 22 January 2026: cnil.fr (in French)
• CNIL, “Vigilance” alert on scams targeting breach victims (24 June 2026): cnil.fr (in French)

Legal position checked as at 5 October 2026. This content provides general information and does not constitute legal advice. Every situation is different: contact our team to explain your situation.