#Cybersecurity Lawyer in France for Businesses

Key points

• A cybersecurity lawyer protects your organisation’s legal position before, during and after an incident.
• A personal data breach must be notified to the CNIL (French data protection authority) without undue delay and, where feasible, within 72 hours of becoming aware of it, if there is a risk (Article 33 GDPR).
• For insured professionals, compensation under a cyber insurance policy requires a criminal complaint to be filed within 72 hours, under Article L. 12-10-1 of the French Insurance Code (Code des assurances).
• As at 1 October 2026, the French law transposing NIS2 has still not been adopted; its debate in plenary session at the National Assembly (Assemblée nationale) is scheduled for 7 October 2026. DORA has applied to the financial sector since 17 January 2025.
• The lawyer deals with the legal issues; technical investigation and remediation are the responsibility of independent specialist experts.

A cybersecurity lawyer advises companies on legal prevention of cyber risk, organises the response to an incident and handles the resulting disputes. You call on them upstream to frame contracts and compliance and then, in the event of an attack, for mandatory notifications, the criminal complaint and dealings with the insurer. Hashtag Avocats, a digital law firm in Paris, assists you on all three fronts.

Looking for an IT security lawyer for your company? That is what this page is about: it is aimed at companies and organisations, not at the IT security of law firms. An individual who has been the victim of hacking or an online scam? See our cybercrime lawyer page instead.

The situations we handle

Here are the most frequent requests, grouped by company profile. They are there to help you find your bearings: every situation is different and calls for its own analysis.

SMEs and mid-sized companies hit by ransomware or a data leak

Your systems have been encrypted or your data has been exfiltrated. We classify the incident legally, prepare the notification to the CNIL and the information of data subjects, draft the criminal complaint within the time limit relevant for insurance and oversee exchanges with the insurer. Details of this support are set out on our cyberattack lawyer for businesses page.

SaaS publishers, hosting providers and IT service providers

Your client blames you for a security flaw, or your own service provider has been hacked. As a processor within the meaning of the GDPR, you must notify any breach to your client “without undue delay” (Article 33.2 GDPR). We review your security and liability clauses, and we defend you if a claim is brought against you. See also our SaaS lawyer.

Companies within the scope of NIS2

Your sector is among those covered by the NIS2 Directive. Until the French law is adopted, we prepare your governance, your contracts and your incident management procedure on the basis of the Directive and the bill, flagging what may still change. The scope is detailed on our NIS2 lawyer page.

Financial entities and their IT service providers (DORA)

Since 17 January 2025, the DORA Regulation has required financial entities to have a single written contract with each ICT service provider, with minimum clauses: service levels, data location, assistance in the event of an incident, termination rights (Article 30). The financial entity remains fully responsible for its obligations, even when it outsources (Article 28). We audit and renegotiate these contracts, for financial entities and service providers alike. See our article on DORA obligations and ICT contracts.

Anticipate: reducing legal risk before an incident

Legal mapping and governance of cyber risk

The first task is to identify your actual obligations. Article 32 GDPR requires security measures “appropriate to the risk”: pseudonymisation, encryption, regular testing. This obligation is assessed according to the nature of your processing and the state of the art. We audit your legal commitments, your insurance policies and your documentation, then prioritise corrective actions. This work ties in with our GDPR compliance practice.

IT contracts and processors

A large part of cyber risk lies in your contracts: hosting, managed services, SaaS, maintenance. Article 28.3 f) GDPR requires the processing agreement to provide for the processor’s assistance in meeting security and notification obligations. We check the clauses on security, reversibility, liability and incident alerts. A well-negotiated contract determines your remedies if your service provider fails.

IT charter and internal rules

Internal practices are a frequent entry point for attacks. An enforceable IT charter governs access, passwords, remote working and personal devices. We draft it and organise its incorporation into the internal rules (règlement intérieur), so that it has legal effect.

Cyber insurance: check your cover before you need it

Since the LOPMI law (French Interior Ministry orientation and programming law), Article L. 12-10-1 of the Insurance Code makes compensation for losses caused by an attack on an information system conditional on a criminal complaint being filed within 72 hours of becoming aware of the attack. This condition applies to professionals, whether legal entities or individuals. We analyse your policies: scope of cover, exclusions, reporting obligations, interaction with your internal crisis procedures. To find out more, our article cyber insurance: cover, exclusions and refusal of compensation explains how to challenge a refusal.

NIS2 and DORA: anticipating sector-specific legislation

Directive (EU) 2022/2555, known as NIS2, is in force at European level. As at 1 October 2026, the French transposing law has still not been adopted: the bill on “resilience of critical infrastructure and strengthening of cybersecurity”, passed by the Senate on 12 March 2025, is scheduled for plenary session at the National Assembly on 7 October 2026. Until the law is published, no NIS2 penalty or deadline applies directly to French companies. The obligations envisaged – registration, risk management, incident notification, penalties – may change until final adoption. ANSSI (French national cybersecurity agency) already offers voluntary pre-registration for future in-scope entities. Regulation (EU) 2022/2554, known as DORA, has applied since 17 January 2025, but only to financial entities and their IT service providers. We monitor these texts and prepare your contractual and documentary upgrade. The entities concerned and the timetable are detailed on our NIS2 lawyer page.

React: organising the legal response to a cyberattack

Classify the incident and document it

The first hours determine what follows. We classify the facts legally: attack on the system, personal data breach, or both. Article 33.5 GDPR requires every breach to be documented internally, even those that will not be notified. This documentation will be used before the CNIL, the insurer and the court. The steps to take in the first hours are detailed in our guide “Cyberattack: what to do in the first hours?”, and step-by-step support for the attacked company on our cyberattack lawyer page.

Notify the CNIL and inform data subjects

If the personal data breach presents a risk to individuals, Article 33 GDPR requires notification to the CNIL without undue delay and, where feasible, within 72 hours of becoming aware of it. Informing data subjects is subject to a different threshold: it is only required where there is a high risk (Article 34). We detail these obligations on our personal data breach lawyer page.

File a criminal complaint and preserve insurance cover

Filing a criminal complaint has two objectives: triggering a public prosecution and preserving your compensation. Without a complaint within 72 hours of becoming aware of the attack, the insurer cannot pay the indemnity covering your losses (Article L. 12-10-1 of the French Insurance Code). Note: this 72-hour deadline is separate from the CNIL notification deadline, with a different recipient and a different purpose. On the criminal side, our cybercrime lawyer page details the offences and the steps for victims; in the event of an intrusion into your systems, remedies are presented on our computer hacking lawyer (in French) page.

The ransom question

ANSSI and Cybermalveillance.gouv.fr recommend not paying the ransom: no guarantee of recovery, possible disclosure despite payment, financing of crime. Payment is not, in itself, prohibited by French law. It may, however, expose the company to a risk under the European restrictive measures against cyberattacks, if the beneficiary is a listed person or entity. This decision should be taken with full legal advice. Our detailed guide “Ransomware: should you pay the ransom?” explores this legal framework in depth.

Legal deadlines after a cyberattack: summary table

These deadlines run in parallel and concern different recipients. They generally start from the moment you become aware of the incident, not from the attack itself.

Obligation	Deadline	Who it applies to	Legal basis
Notify the personal data breach to the CNIL	Without undue delay and, where feasible, no later than 72 hours after becoming aware of it (reasons for the delay to be given beyond that)	Controller, unless the breach is unlikely to result in a risk to individuals	Art. 33 GDPR
Alert your client, the controller	Without undue delay	Processor (hosting provider, SaaS publisher, managed service provider…)	Art. 33.2 GDPR
Inform the data subjects	Without undue delay	Where there is a high risk, subject to exceptions (encrypted data, risk neutralised, disproportionate effort)	Art. 34 GDPR
File a criminal complaint to preserve insurance compensation	No later than 72 hours after becoming aware of the attack	Insured legal entities and professionals (not private individuals)	Art. L. 12-10-1 French Insurance Code
Initial notification of a major ICT-related incident	4 hours after its classification as major, and no later than 24 hours after becoming aware of it	Financial entities subject to DORA	Art. 19 DORA; Delegated Regulation (EU) 2025/301, Art. 5
DORA intermediate and final reports	72 hours after the initial notification, then one month after the intermediate report	Financial entities subject to DORA	Delegated Regulation (EU) 2025/301, Art. 5
NIS2 early warning, notification and final report	24 hours, 72 hours, then one month	Essential and important entities, once the French law has been adopted	Art. 23 Directive (EU) 2022/2555

Failing to notify a personal data breach is also a criminal offence: five years’ imprisonment and a €300,000 fine (Article 226-17-1 of the French Criminal Code). On the CNIL side, a failure relating to security or notification can be penalised by up to €10 million or 2% of annual worldwide turnover (Article 83.4 GDPR). These penalties are enforced in practice: in two decisions of 8 January 2026, the CNIL imposed €42 million in fines on Free Mobile and Free after an intrusion affecting 24 million subscriber contracts, notably for insufficient security and incomplete information provided to individuals.

Challenge: asserting your rights after the incident

Once the emergency is over, several remedies become available: action against the defaulting IT service provider, holding the processor liable, challenging the insurer’s refusal of cover, defence against claims from customers or employees. These proceedings follow different logics and are prepared from the crisis management stage onwards, in particular by preserving evidence. Our cyber litigation lawyer (in French) page presents these remedies in detail.

What the lawyer does, what the technical experts do

A lawyer does not carry out security audits of systems, digital forensics or infrastructure restoration. These tasks fall to independent technical experts, with whom we coordinate our work. The roles are divided as follows:

What the lawyer does	What the technical experts do
Legal classification of the incident and of liabilities	Digital forensics and analysis of the compromise
Mandatory notifications (CNIL, data subjects)	Containment, eradication and restoration of systems
Criminal complaint and dealings with the insurer	Technical collection of traces and logs
Contracts, compliance, litigation and legal communication strategy	Security testing and infrastructure hardening

Two complementary practices dedicated to cyber risk

Handling cyber risk draws on two areas of the firm’s expertise. Arnaud Touati, co-founding partner, heads the Contractual IP-IT practice: personal data protection, IT contracts, artificial intelligence. Harry Allouche, co-founding partner, heads the Corporate/Tax practice: directors’ obligations, insurance, financial dimension of incidents. This dual perspective covers the contractual, regulatory and corporate aspects of a cyber crisis. Arnaud Touati is a member of the Paris and Luxembourg Bars. This page was written under his responsibility and updated on 1 October 2026.

FAQ: cybersecurity lawyer

What does a cybersecurity lawyer do?

They act on three levels: prevention (contracts, compliance, IT charter, insurance), incident response (notifications, criminal complaint, insurer) and litigation (service providers, processors, claims). They do not replace technical experts: they organise the legal side of the crisis and coordinate their work with them.

Do you have to notify the CNIL after a cyberattack?

Not always. Notification is required if the attack has led to a personal data breach likely to result in a risk to individuals (Article 33 GDPR). If no risk is likely, notification is not required, but the breach must be documented internally.

What is the deadline for notifying a personal data breach?

Notification must be made without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, not after the attack itself. Notification in phases is possible if not all the information is available immediately (Article 33.4 GDPR).

NIS2: does it apply to my company?

As at 1 October 2026, the French law transposing NIS2 has not yet been adopted, so the final national scope has not been settled. The bill covers essential and important entities in many sectors. ANSSI already allows voluntary pre-registration. A case-by-case analysis remains necessary, based on the applicable text as it stands.

What should you do in the first hours of a cyberattack?

Isolate the affected machines from the network without switching them off, unless encryption is in progress, and preserve the evidence: logs, copies, ransom note. File a criminal complaint before reinstalling your devices. If personal data is affected, prepare the notification to the CNIL. Inform your insurer, bearing in mind the 72-hour deadline under Article L. 12-10-1 of the French Insurance Code. These steps follow the recommendations of Cybermalveillance.gouv.fr.

Should you pay the ransom?

ANSSI and Cybermalveillance.gouv.fr recommend not paying: nothing guarantees that the data will be recovered or that it will not be disclosed, and payment encourages attackers. The decision commits the company and its directors; it should be taken with legal advice and documented.

Lawyer or IT security expert: who should you call first?

Both, in parallel. The technical expert contains the attack and collects the traces; the lawyer manages the legal deadlines, the criminal complaint, the insurer and dealings with the authorities. Involving the lawyer from the outset also makes it possible to organise the findings in a way that is useful for any future legal action.

How much does a cybersecurity lawyer cost?

Fees depend on the scope: one-off contract audit, compliance support, crisis management or litigation. They are set out in a prior fee agreement, on a fixed-fee or hourly basis. Every situation is different: the quote follows an initial discussion about your needs.

Official sources

• Regulation (EU) 2016/679 (GDPR), Articles 28, 32, 33 and 34: consolidated text on EUR-Lex
• Article L. 12-10-1 of the French Insurance Code (Law No. 2023-22 of 24 January 2023): Légifrance (in French)
• Directive (EU) 2022/2555 (NIS2), status of transposition in France: ANSSI NIS2 portal
• Regulation (EU) 2022/2554 (DORA): overview by the ACPR (French banking and insurance supervisor)
• Guide “Attaques par rançongiciels, tous concernés” (Ransomware attacks: everyone is concerned) (ANSSI-DACG): messervices.cyber.gouv.fr
• Ransomware quick-response guide: Cybermalveillance.gouv.fr (in French)
• Articles 226-17 and 226-17-1 of the French Criminal Code (security and notification of breaches): Légifrance (in French)
• Delegated Regulation (EU) 2025/301 (DORA incident reporting deadlines): EUR-Lex
• Directive (EU) 2022/2555 (NIS2), Article 23: EUR-Lex
• Bill on the resilience of critical infrastructure and the strengthening of cybersecurity: National Assembly legislative file
• CNIL, penalty against Free Mobile and Free (decisions of 8 January 2026): cnil.fr (in French)

Law in force as at 1 October 2026. This content provides general information and does not constitute legal advice. Every situation is different: contact our team to discuss your situation.