This article in brief
- No French provision prohibits, as such, paying a ransom after a ransomware attack.
- ANSSI (French national cybersecurity agency) and Cybermalveillance.gouv.fr (French government cyber-assistance platform) recommend not paying: there is no assurance of recovery, and payment finances crime.
- Paying becomes unlawful if the recipient is targeted by the European restrictive measures against cyberattacks (Regulation (EU) 2019/796).
- For insured professionals, compensation for losses requires a criminal complaint within 72 hours of discovery (Article L. 12-10-1 of the French Insurance Code (Code des assurances)).
- Ransomware constitutes obstruction of an information system, punishable by 5 years’ imprisonment and a €150,000 fine.
- The decision to pay or not must be taken at the right level and documented in writing.
French law does not prohibit, as such, paying a ransom. But the authorities strongly advise against it: paying offers no assurance of recovering the data and finances crime. Payment becomes unlawful when the recipient appears on the European sanctions lists. Nor does it release the company from any obligation: a criminal complaint within 72 hours to preserve insurance compensation, notification to the CNIL (French data protection authority) and informing the individuals concerned if personal data is affected. Every situation is different.
Is paying a ransom illegal in France?
No general prohibition under French law
Contrary to a widespread belief, no French provision generally prohibits paying a ransom following a ransomware attack. The legislature made a different choice with the Law of 24 January 2023 on the orientation and programming of the Ministry of the Interior: regulating the insurability of the risk rather than prohibiting payment. Article L. 12-10-1 of the Insurance Code, introduced by that law, makes the payment of an insurance indemnity covering losses caused by an attack on an automated data processing system conditional on the victim filing a criminal complaint within 72 hours of becoming aware of the attack.
International sanctions: when paying becomes unlawful
The freedom to pay has a serious limit. Regulation (EU) 2019/796 and Decision (CFSP) 2019/797 establish restrictive measures against the perpetrators of cyberattacks threatening the Union or its Member States: asset freezes and a prohibition on making funds available to the listed persons and entities. Paying a ransom for the benefit of an entity targeted by these measures is therefore prohibited, and exposes the company to a risk of its own, separate from the attack it has suffered.
The practical difficulty is real: the identity of a ransom’s recipient is rarely certain. A prior check against the sanctions regimes, documented in writing, is part of the minimum due diligence before any decision. Paying the ransom is not, in itself, prohibited by French law, but it may expose the company to a risk under international sanctions if the recipient is a targeted entity.
Why the authorities advise against paying
The official position is consistent and unambiguous. Cybermalveillance.gouv.fr is explicit (in French: “Ne payez pas la rançon”; translation: do not pay the ransom). Three reasons are given: payment does not ensure the recovery of the data, stolen data may be disclosed despite payment, and the ransom finances organised crime, sustaining the attackers’ business model.
ANSSI makes the same recommendation in its guide “Attaques par rançongiciels, tous concernés” (translation: Ransomware attacks, everyone is concerned), co-produced with the Directorate of Criminal Affairs and Pardons (DACG) of the French Ministry of Justice. The guide stresses a point often overlooked in the urgency of the moment: file a criminal complaint systematically, and preserve the evidence before any reinstallation of the systems.
These recommendations do not have the force of a prohibition. They nevertheless carry great weight: a company that paid without prior analysis would struggle to justify its decision to its insurer, its shareholders or its partners.
Legal obligations during the crisis
Paying or refusing to pay does not change the legal obligations triggered by the attack. Three workstreams move forward in parallel.
Personal data. Ransomware that encrypts or exfiltrates personal data constitutes a personal data breach. If it is likely to result in a risk to individuals, the CNIL must be notified without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 of the GDPR). If the risk is high, the data subjects must be informed without undue delay (Article 34). Even without notification, the breach must be documented internally. Paying the ransom does not make these obligations disappear: exfiltrated data remains compromised, whether or not deletion is promised.
Criminal law. Ransomware amounts to obstructing the operation of an automated data processing system, punishable by 5 years’ imprisonment and a €150,000 fine (Article 323-2 of the French Criminal Code (Code pénal)), with the fraudulent extraction of data punishable by the same penalties (Article 323-3). Beyond its value for the investigation, the criminal complaint is a condition for insurance compensation of professionals if it is filed within 72 hours of discovery.
Evidence. Keep the logs, the images of the affected systems, the ransom note and any exchange with the attackers. Do not reinstall the machines before these items have been preserved: they will be used for the investigation, by the insurer and, where applicable, to demonstrate the company’s diligence in the event of a CNIL inspection.
Ransomware insurance in France: what the 72-hour complaint changes
Article L. 12-10-1 of the Insurance Code deserves a careful reading. It concerns legal entities and natural persons acting in the course of their professional activity: private individuals are not covered. The 72-hour period runs from the time the victim becomes aware of the attack, not from the attack itself. And it is not the same as the time limit for notifying the CNIL: two separate obligations, two different recipients, two different purposes. Cover, exclusions and challenging a refusal are detailed in our guide cyber insurance: cover, exclusions and refusal of claims.
As for cover of the ransom payment itself, it is a matter of contractual freedom: everything depends on the cover, limits and exclusions in your policy. The only legal certainty is negative: without a criminal complaint within 72 hours, the indemnity covering the losses caused by the attack cannot be paid.
Who decides whether to pay, and how should the decision be documented?
The decision to pay or refuse belongs to the company, in practice to its management body. It should never be taken by the IT manager alone, nor in the rush of the first hours. A defensible decision relies on several opinions: a technical assessment of whether systems can be restored without paying, a legal analysis of the risks, including the international sanctions check, the insurer’s position, and an assessment of the obligations towards the data subjects.
Each step deserves a written record: who decided, when, on the basis of what information and what advice. This documentation protects the company in its dealings with the insurer, the CNIL and, where applicable, the court. It shows that the decision, whatever it is, was taken with due diligence.
The lawyer acts at every link in this chain: characterising the obligations, making the complaint and the notifications legally sound, dealing with the insurer and handling any subsequent litigation. Our cybersecurity team assists companies with these crisis decisions, including on personal data breaches; the remedies specific to the intrusion are presented by our computer hacking lawyer (in French). For the very first steps, see also our guide: cyber attack: what to do in the first hours
Lawyer, negotiators, technical providers: who does what?
Handling a ransomware attack involves different professions with complementary roles. The incident response provider analyses the attack, contains its spread and leads the restoration. Specialised intermediaries may handle exchanges with the attackers when the company decides to make contact, if only to buy time or check whether the data they claim to hold is real.
The lawyer, for their part, makes the framework legally sound: compliance of decisions with legal obligations and sanctions regimes, compliance with the complaint and notification time limits, review of contractual obligations towards clients and partners, preparation of what follows, from a CNIL inspection to litigation. The lawyer also ensures that everything is consistent: what the company declares to its insurer, the CNIL, the data subjects and the investigators must rest on the same established facts. This documentary consistency is one of the company’s best safeguards after the crisis.
For a company hit by ransomware, the ransom is only one aspect of the crisis: notifications, the criminal complaint, the insurer and communication are handled in parallel. If the insurer then refuses cover, the dispute with the cyber insurer (in French) is prepared from the very first days, by keeping every document.
FAQ: paying a ransomware ransom
Does paying guarantee that you recover your data?
No. This is precisely one of the reasons for the official recommendation: there is no assurance of recovery, and exfiltrated data may be disclosed despite payment. Payment also sustains the attackers’ business model.
Is paying a ransom punishable by law?
No, not as such: no French provision lays down a general prohibition. However, payment becomes unlawful if the recipient is a person or entity targeted by the European restrictive measures against cyberattacks, which prohibit making any funds available.
Must you notify the CNIL after a ransomware attack?
Yes, if personal data is concerned and the breach is likely to result in a risk to individuals: notification without undue delay and, where feasible, within 72 hours (Article 33 of the GDPR). Informing the individuals is also required if the risk is high (Article 34). In any event, document the breach internally.
Should you file a criminal complaint before restoring the systems?
Yes, that is the order recommended by ANSSI: preserve the evidence and file a complaint before reinstallation. For insured professionals, a complaint within 72 hours of discovery is also a condition for compensation of losses (Article L. 12-10-1 of the French Insurance Code).
Official sources
- Cybermalveillance.gouv.fr, quick-response fact sheet (French title: “Rançongiciel ou ransomware : que faire si votre organisation est victime d’une attaque ?”; translation: Ransomware: what to do if your organisation is the victim of an attack?) – cybermalveillance.gouv.fr (in French)
- ANSSI and the French Ministry of Justice (DACG), guide “Attaques par rançongiciels, tous concernés” (translation: Ransomware attacks, everyone is concerned) – cyber.gouv.fr
- DG Trésor (French Treasury), European restrictive measures to combat cyberattacks (Regulation (EU) 2019/796 and Decision (CFSP) 2019/797) – tresor.economie.gouv.fr
- Article L. 12-10-1 of the French Insurance Code, complaint within 72 hours and compensation for cyber risks – Légifrance (in French)
- Article 323-2 of the French Criminal Code, obstructing the operation of an automated data processing system – Légifrance (in French)
- Articles 33 and 34 of Regulation (EU) 2016/679 (GDPR) – EUR-Lex
This article presents the law for general information purposes. It does not constitute legal advice. Every situation is different and calls for a specific analysis. Content compliant with the professional conduct rules of the legal profession.
