France's CNIL published on November 9, 2026 ten simplified financial sanctions against local authorities (collectivités territoriales) and a public establishment for cybersecurity failures under GDPR Article 32 and missing impact assessments under Article 35. Fines range from EUR 3,000 to the EUR 20,000 ceiling of the simplified procedure.
Other French local authorities, their IT providers and software editors, and the DPOs and CISOs of French public sector entities must immediately review their Article 32 security controls and complete outstanding Article 35 DPIAs, or face the same simplified fines up to EUR 20,000, higher amounts under the ordinary procedure, and publication of the sanction. Further CNIL procedures are ongoing and may bring more sanctions or formal notices.
- Authority : Commission nationale de l'informatique et des libertés (CNIL)
- Entity : ten French local authorities (collectivités territoriales) and a public establishment
- Measure and amount : ten simplified fines from EUR 3,000 to EUR 20,000 (legal maximum for the procedure)
- Legal basis : GDPR Article 32 (security of processing), GDPR Article 35 (DPIA), Article 90 of the Loi Informatique et Libertés
- Decision date : November 9, 2026
- Official source : CNIL release, November 9, 2026
What happened
The CNIL made local-authority cybersecurity a 2025 control theme and dedicated half its 2026 controls to data security. The ten sanctions close controls on communes, departments, regions and a public establishment. Several controlled entities had suffered preventable data breaches. Fines reflect the number and gravity of failings, the data categories (minors, bank details), each budget, and corrective steps taken.
The breach
The decisions cite GDPR Article 32 for a recurring set of failings: no multi-factor authentication for administrators, permanent editor access without case-by-case authorization or via shared accounts, incomplete logging with no real-time exploitation, weak network segmentation, obsolete unpatched server operating systems, and passwords transmitted in clear or stored insecurely. Several entities had also skipped the homologation required before go-live by the référentiel général de sécurité (RGS), mandated by Ordonnance n° 2005-1516 of December 8, 2005.
The decisions also cite GDPR Article 35 and Article 90 of the Loi Informatique et Libertés for missing impact assessments. A data protection impact assessment (DPIA), required by GDPR Article 35, is an analysis carried out before deploying processing that presents high risks to the rights and freedoms of individuals, to evaluate those risks and adopt the necessary security measures. The CNIL singles out two high-risk operations run without a DPIA: school activity portals handling minors' and bank data, and public-space video surveillance, a large-scale systematic monitoring of a publicly accessible area.
Who else is in the same regime
The same Article 32 and Article 35 duties bind every French public sector entity processing residents' data, and their providers and editors. Obsidian tracks texts under the GDPR across 10 jurisdictions as of November 2026, spanning national application laws alongside the directly applicable regulation. Peer authorities have enforced Article 32: the Greek HDPA (Teleperformance), Italian Garante (Wind Tre), and Swedish IMY (Miljödata). The CNIL's 2026 programme makes local authorities and vendors the enforcement focus in France.
What to check now
- Enable multi-factor authentication for all administrator accounts.
- Grant external provider access case by case; remove shared accounts.
- Activate complete logging with real-time anomaly detection.
- Segment the network to contain breaches away from residents' data.
- Patch or retire obsolete, unsupported server operating systems.
- Enforce robust password policies with secure storage and no clear-text transmission.
- Complete RGS homologation before any new public-facing system goes live.
- Run Article 35 DPIAs for school portals and public-space video surveillance.
Continuous per-jurisdiction monitoring surfaces this kind of CNIL decision the moment it publishes.
