#Personal Data Breach Lawyer in France

Key points

• Every data breach must be documented internally (Article 33(5) GDPR), but not every breach has to be notified to the CNIL (French data protection authority).
• Notification to the CNIL is made within 72 hours of becoming aware of the breach, if the breach presents a risk to individuals (Article 33).
• Individuals concerned only have to be informed if there is a high risk, and exceptions apply (Article 34).
• A processor that has been hacked must alert the controller without undue delay (Article 33(2)); it is the controller that notifies the CNIL.
• Compensation for individuals requires proven damage, even non-material damage: it is never automatic (CJEU, C-300/21).

A personal data breach lawyer helps you classify the incident, decide whether to notify the CNIL and inform the individuals concerned, then handle what follows. Contrary to a common belief, notification is not automatic: it depends on the risk created for the individuals concerned. In Paris, Hashtag Avocats assists corporate officers and DPOs (Data Protection Officers) with these decisions, under the pressure of the 72-hour deadline.

Classifying the data breach

A data breach is not limited to hacking. It covers three types of breach: confidentiality (unauthorised access or disclosure, exfiltration), integrity (alteration of data) and availability (loss of access or destruction, including by ransomware). An email sent to the wrong recipient, a stolen laptop or a database encrypted by an attacker are all potential breaches.

Classification drives everything else: the nature of the data affected, the volume, the individuals concerned, the possible consequences. This analysis underpins the risk assessment, on which the notification obligations depend. It is carried out in the heat of the moment, using the findings of the technical teams, and documented precisely.

Three separate obligations, three different thresholds

Documenting internally: always

Article 33(5) of the GDPR requires every breach to be documented: facts, effects, remedial action taken. This obligation applies even when no notification is due. The CNIL can require the breach register during an inspection; keeping it rigorously shows that the incident is under control.

Notifying the CNIL: when there is a risk

Notification to the CNIL is required “without undue delay and, where feasible, not later than 72 hours” after becoming aware of the breach (Article 33(1)). It is not due if the breach is “unlikely to result in a risk” to the rights and freedoms of individuals. This risk criterion, assessed case by case, is the core of the legal analysis: notifying wrongly creates unnecessary exposure, while failing to notify because the risk was underestimated creates greater exposure.

Informing individuals: when there is a high risk

Informing the individuals concerned is subject to a separate threshold: “high risk” (Article 34(1)). Article 34(3) provides three exceptions: appropriate protection measures, such as encryption that renders the data unintelligible; subsequent measures that remove the high risk; disproportionate effort, in which case a public communication is allowed. Notifying the CNIL therefore does not exempt you from informing individuals, and vice versa: the two obligations are handled separately.

The 72-hour deadline: starting point and notification in phases

The deadline runs from the time you become aware of the breach, not from the date of the attack. An intrusion discovered weeks after the event opens a 72-hour period from the discovery. Going beyond the deadline remains possible if the reasons are given to the CNIL.

You will never have all the information within 72 hours. Article 33(4) allows notification in phases: an initial notification with the facts known, supplemented as the investigation progresses. Waiting to understand everything before notifying is a common mistake. Do not confuse this deadline with the one in Article L. 12-10-1 of the French Insurance Code (Code des assurances), which requires professionals to file a criminal complaint within 72 hours to preserve insurance compensation: two obligations, two recipients.

Hacked processor: who does what?

When the breach occurs at a processor – a hosting provider, a SaaS vendor, an HR service provider – the GDPR clearly allocates the roles. The processor notifies the controller “without undue delay” after becoming aware of the breach (Article 33(2)); the 72-hour deadline does not apply to it. It is the controller that notifies the CNIL. The data processing agreement must organise the processor’s assistance with these obligations (Article 28(3)(f)).

The CNIL illustrated this dual obligation of the processor – notifying for its own processing and assisting its clients – in a guidance sheet whose title translates as “Cyberattack: the processor at the centre of the crisis” (original French title: “Cyberattaque : le sous-traitant au centre de la crise”). A processor that is late in raising the alert may incur liability: our analyses of the processor’s liability in the event of a breach cover this point in detail, and our cyber litigation lawyer (in French) page covers the remedies.

After notification: CNIL inspection and compensation claims

Notification does not close the matter. The CNIL may open an inspection into whether the security measures comply with Article 32. The January 2026 penalties against Free and Free Mobile (€42 million in total, Articles 32, 34 and 5(1)(e)) and against France Travail, the French public employment service (€5 million, Article 32) show that the authority also examines the quality of the information given to individuals after the incident.

The individuals concerned can claim compensation under Article 82. The CJEU requires proven damage and a causal link (C-300/21); fear of misuse of the data can constitute compensable non-material damage (C-340/21). Finally, the CNIL warns of secondary scams targeting breach victims, with some messages even mentioning the CNIL’s telephone number: crisis communication must prevent this risk of repeat victimisation.

What the lawyer does, what the technical experts do

Investigating the compromise, containing it and restoring the systems are matters for independent technical experts. The lawyer handles the legal side: assessing the risk for individuals, deciding whether to notify, drafting the notification and the information to individuals, dealing with the CNIL, safeguarding communications and preparing for any litigation. The two workstreams are coordinated hour by hour during the crisis. This work is part of our overall practice in GDPR compliance and cybersecurity.

FAQ: personal data breaches

Does every data breach have to be notified to the CNIL?

No. Notification is not due if the breach is unlikely to result in a risk to the rights and freedoms of individuals (Article 33(1) GDPR). However, every breach, whether notified or not, must be documented in the internal register (Article 33(5)). You must be able to justify the risk assessment.

What is the deadline for notifying a data breach in France?

Without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. The starting point is the discovery, not the attack. Any delay must be justified. An initial notification can be supplemented later, in phases (Article 33(4)).

What does a notification to the CNIL contain?

A description of the breach and, where possible, the categories and approximate number of individuals and records concerned, the contact details, the likely consequences and the measures taken or proposed (Article 33(3) GDPR). How it is drafted matters: it sets out the version of the facts that the CNIL will examine.

Do the customers or employees concerned have to be told?

Only if the breach is likely to result in a high risk for them (Article 34(1)). Exceptions exist, in particular when encryption renders the data unintelligible (Article 34(3)). When it is due, the information must be clear and complete: the CNIL has penalised incomplete information to individuals.

What does a company risk if it does not notify?

A failure to notify or inadequate information to individuals is added to any security failure. The CNIL penalties of January 2026 – €42 million for Free and Free Mobile, €5 million for France Travail – illustrate the scale of the amounts at stake after a breach. On top of this come compensation claims from the individuals concerned, which must be proven case by case.

Official sources

• Regulation (EU) 2016/679 (GDPR), Articles 28, 32, 33, 34 and 82: consolidated text on EUR-Lex
• CJEU, 4 May 2023, C-300/21, Österreichische Post: EUR-Lex
• CJEU, 14 December 2023, C-340/21: EUR-Lex
• CNIL guidance sheet (original French title: “Cyberattaque : le sous-traitant au centre de la crise”; translated title: “Cyberattack: the processor at the centre of the crisis”), 27 May 2026: cnil.fr (in French)
• CNIL, penalties against Free and Free Mobile of 13 January 2026: cnil.fr (in French)
• CNIL, penalty against France Travail of 22 January 2026: cnil.fr (in French)
• CNIL, “Vigilance” alert on scams targeting breach victims (24 June 2026): cnil.fr (in French)
• Article L. 12-10-1 of the French Insurance Code: Légifrance (in French)

Legal position checked as at 5 October 2026. This content provides general information and does not constitute legal advice. Every situation is different: contact our team to have the incident analysed.