CNIL fines ten French public bodies over weak cybersecurity

CNIL fines ten French public bodies over weak cybersecurity

9 November 2026: France's data protection regulator has issued ten fines of between 3,000 and 20,000 euros against local authorities and one public body, mostly for security failings under Article 32 of the GDPR. The findings single out the people who supply those authorities: software vendors with standing access to council networks, or logging in through accounts shared among their staff.

Not yet independently verified. This rests on the CNIL's own summary of 9 November 2026. The summary does not name the ten bodies or give each fine, and we have not read the individual decisions. We will update this when it can be confirmed, and remove this note.

Administrators without a second factor

The sanctions follow inspections the CNIL began after making local authority cybersecurity one of its annual themes in 2025, covering councils, other public bodies and their service providers. The regulator says some of the authorities had suffered data breaches that the right measures could have prevented.

On remote access, it found authentication too weak for staff connecting from outside, especially those with high privileges, with no multifactor authentication for administrators. Passwords were weak, sent to residents in clear text, or stored in ways that did not protect them.

Detection was a second failing. Logging was incomplete, or logs were not reviewed in real time or soon afterwards. Networks were not segmented enough to stop a breach spreading, and some servers ran operating systems their publishers no longer maintained.

A warning written for suppliers

The clearest message for anyone selling software to French public bodies concerns access. The CNIL faults arrangements in which outside providers could reach a council's network permanently, without authorisation case by case, or through accounts used by several employees. A vendor still supporting clients that way is creating a finding for its customer.

Several decisions also record that systems used to deal with residents online had not received the security accreditation, known as homologation, that France's general security framework requires before going live. A supplier delivering a resident portal should be ready to provide the documents that process depends on.

Two services that needed an impact assessment

Authorities were also sanctioned under Article 35 of the GDPR and Article 90 of the French data protection act for skipping impact assessments. The CNIL gives two examples. Online services where parents manage school and after-school activities involve children and bank details. Street video systems amount, in its words, to "une surveillance systématique à grande échelle d'une zone accessible au public", systematic large-scale monitoring of a publicly accessible area.

Why the amounts stay small, and what comes next

Twenty thousand euros is the legal maximum under the simplified procedure. The CNIL says each amount reflects the number and gravity of the failings, the categories of data, the authority's budget, the number of people affected and any remedial steps taken.

It is spending half of its 2026 inspections and enforcement on data security and says other procedures are under way that could end in fines, formal notices or reminders. It ties the work to the coming NIS2 directive, still being transposed in France, which will put further IT security duties on local authorities among others.

Our GDPR compliance category holds 11 products, among them Collibra and OMNIPRIVACY.

Sources

• CNIL: Cybersécurité des collectivités territoriales, la CNIL prononce dix sanctions, 9 November 2026