BreachCensus

Commission Nationale de l'Informatique et des Libertes

FRcnil.fr

The Commission Nationale de l'Informatique et des Libertes is France's independent data protection authority. Under GDPR Article 33, a controller must notify the CNIL of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Breach Census checks the CNIL's published sanctions listing daily; that listing anonymises the organisation involved in almost every row (showing only a category, such as "mobile phone operator"), so an action recorded here is linked to a named organisation only on the rare occasion the CNIL has separately press-released it by name.

Enforcement actions

ReferenceTypeAmountDateOrganisation
12032026-minist-re——March 12, 2026—
05032026-association-ayant-pour-objet-de-promouvo—€6,000March 5, 2026—
29012026-tablissement-public-exer-ant-une-activit—€20,000January 29, 2026—
CNILTEXT000053408671—€5,000,000January 22, 2026—
CNILTEXT000053352643—€15,000,000January 8, 2026—
CNILTEXT000053352594—€27,000,000January 8, 2026—
CNILTEXT000053391342—€3,500,000December 30, 2025—
30122025-societe-exercant-une-activite-de-fret-ae—€10,000December 30, 2025—
29122025-societe-editant-uneapplication-mobile—€270,000December 29, 2025—
CNILTEXT000053151799—€1,700,000December 22, 2025—
18122025-societe-exercant-une-activite-de-program—€15,000December 18, 2025—
18122025-societe-exercant-une-activite-de-collect—€20,000December 18, 2025—
15122025-societe-exercant-une-activite-d-edition-—€15,000December 15, 2025—
11122025-etablissement-public-exercant-une-activi—€20,000December 11, 2025—
11122025-candidat-aux-elections-legislatives-de-2-3—€5,000December 11, 2025—
08122025-societe-exercant-une-activite-de-commerc—€20,000December 8, 2025—
04122025-parti-politique-proc-dure-simplifi-e—€5,000December 4, 2025—
27112025-societe-ayant-pour-activite-la-creation-——November 27, 2025—
13112025-societe-exploitant-un-fonds-de-commerce-—€20,000November 13, 2025—
13112025-groupement-d-interet-economique-gie-exer—€20,000November 13, 2025—
16102025-societe-exercant-une-activite-de-gestion—€20,000October 16, 2025—
16102025-societe-de-centres-d-appels—€250,000October 16, 2025—
CNILTEXT000052266505—€100,000September 18, 2025—
11092025-commune-proc-dure-simplifi-e—€10,000September 11, 2025—
11092025-association-gerant-un-lycee-et-un-intern—€7,000September 11, 2025—
04092025-societe-developpant-et-commercialisant-u—€7,000September 4, 2025—
30042025-societe-editant-un-site-web-de-rencontre—€20,000April 30, 2025—
10042025-societe-de-commerce-de-detail-d-articles—€20,000April 10, 2025—
CNILTEXT000051120331—€40,000December 19, 2024—
19122024-centre-d-appel-proc-dure-simplifi-e—€20,000December 19, 2024—
17102024-societe-ayant-pour-activite-la-fournitur—€20,000October 17, 2024—
10102024-societe-commercialisant-des-portefeuille—€750,000October 10, 2024—
26092024-organisme-de-formation-destine-aux-profe—€15,000September 26, 2024—
19092024-armurerie-vendant-ses-articles-en-ligne-—€20,000September 19, 2024—
25072024-etablissement-d-enseignement-superieur-p—€20,000July 25, 2024—
23052024-societe-gerant-une-plateforme-d-appels-p-2—€10,000May 23, 2024—
23052024-societe-gerant-une-plateforme-d-appels-p—€15,000May 23, 2024—
31012024-societe-ayant-pour-activite-le-soutien-a—€10,000January 31, 2024—
31012024-editeur-de-site-web-actualites-dans-le-d—€20,000January 31, 2024—
31012024-chirurgien-dentiste-proc-dure-simplifi-e—€5,000January 31, 2024—
CNILTEXT000049128617—€100,000January 31, 2024—
24012024-activite-de-commerce-de-gros-pharmaceuti—€20,000January 24, 2024—
CNILTEXT000048907667—€105,000December 29, 2023—
29122023-societe-de-conseil-en-systemes-et-logici—€100,000December 29, 2023—
CNILTEXT000048989272—€32,000,000December 27, 2023—
11122023-ministere-2——December 11, 2023—
11122023-ministere——December 11, 2023—
16112023-societe-ayant-une-activite-de-soutien-au—€8,000November 16, 2023—
15112023-commune-proc-dure-simplifi-e—€6,000November 15, 2023—
26102023-societe-ayant-pour-activite-principale-l—€2,000October 26, 2023—
CNILTEXT000048222771—€600,000October 12, 2023—
28092023-commerce-interentreprises-de-produits-su—€20,000September 28, 2023—
28092023-societe-de-fabrication-de-produits-de-co—€20,000September 28, 2023—
CNILTEXT000047682157—€150,000June 8, 2023—
CNILTEXT000047552103—€380,000May 11, 2023—
28032023-societe-de-programmation-informatique-pr—€20,000March 28, 2023—
23012023-societe-de-conseil-en-systemes-et-logici—€5,000January 23, 2023—
29122022-societe-developpant-des-logiciels-de-ges—€15,000December 29, 2022—
CNILTEXT000046693390—€300,000November 30, 2022—
CNILTEXT000046650733—€600,000November 24, 2022—
CNILTEXT000046562676—€800,000November 10, 2022—
CNILTEXT000046280956—€250,000September 8, 2022—
CNILTEXT000046198070—€600,000August 3, 2022—
CNILTEXT000045614368—€1,500,000April 15, 2022—
21032022-restaurant—€10,000March 21, 2022—
30122021-vente-de-mobilier-sur-internet-et-en-mag—€120,000December 30, 2021—
CNILTEXT000044810599—€300,000December 28, 2021—
CNILTEXT000044609709—€180,000December 28, 2021—
CNILTEXT000044286815—€400,000October 29, 2021—
CNILTEXT000044115170——September 24, 2021—
CNILTEXT000043668709—€500,000June 14, 2021—
11012021-soci-t-de-d-veloppement-de-solutions-inf—€75,000January 11, 2021—
06012021-commerce-de-d-tail-d-optique—€250,000January 6, 2021—
CNILTEXT000042848036—€20,000December 8, 2020—
08122020-soci-t-de-prestations-de-garde-d-enfants——December 8, 2020—
CNILTEXT000042676787—€6,000December 7, 2020—
CNILTEXT000042675720—€3,000December 7, 2020—
18112020-coop-rative-de-commercants-d-taillants—€150,000November 18, 2020—
CNILTEXT000042563756—€2,250,000November 18, 2020—
CNILTEXT000042203965—€250,000July 28, 2020—
30122019-societe-d-aide-a-domicile-des-personnes-——December 30, 2019—
10102019-soci-t-de-photographies-li-es-la-petite-——October 10, 2019—
CNILTEXT000038810992—€180,000July 18, 2019—
CNILTEXT000038629823—€20,000June 13, 2019—
CNILTEXT000038552658—€400,000May 28, 2019—
31012019-tablissement-public-national-a-caract-re——January 31, 2019—
31012019-soci-t-de-gestion-immobili-re——January 31, 2019—
CNILTEXT000037856073——December 26, 2018—
CNILTEXT000037830841——December 19, 2018—
CNILTEXT000037413673——September 6, 2018—
CNILTEXT000037435170——September 6, 2018—
CNILTEXT000037273346——July 24, 2018—
24072018-groupe-de-presse——July 24, 2018—
CNILTEXT000037110598——June 21, 2018—
CNILTEXT000037013610——May 7, 2018—
CNILTEXT000036403140——January 8, 2018—
21122017-societe-d-electronique-et-de-telecommuni——December 21, 2017—
16112017-service-en-ligne-de-demarches-administra——November 16, 2017—
18072017-location-de-vehicules——July 18, 2017—
13042017-association-politique——April 13, 2017—
03112016-societe-de-vente-distance——November 3, 2016—
13102016-parti-politique——October 13, 2016—
20092016-commerce——September 20, 2016—
13092016-societe-de-courtage-en-assurance——September 13, 2016—
07072016-association——July 7, 2016—
21042016-societe-de-production-et-de-vente-de-spi——April 21, 2016—
18062015-societe-vente-d-abonnements-en-ligne——June 18, 2015—
27112014-site-internet-d-information——November 27, 2014—
12062014-societe-de-transport-et-de-logistique——June 12, 2014—
2007201-location-de-vehiciles————

Questions and answers

How many enforcement actions from Commission Nationale de l'Informatique et des Libertes does Breach Census have on file?

Breach Census has 110 enforcement actions from Commission Nationale de l'Informatique et des Libertes on file.

What date range do Commission Nationale de l'Informatique et des Libertes's actions on Breach Census cover?

Dated actions on file from Commission Nationale de l'Informatique et des Libertes range from June 12, 2014 to March 12, 2026.

Are Commission Nationale de l'Informatique et des Libertes's actions on Breach Census linked to a named organisation?

None of the 110 Commission Nationale de l'Informatique et des Libertes actions on file are linked to a named organisation — Commission Nationale de l'Informatique et des Libertes anonymises the organisation on almost every action it publishes.

What is Commission Nationale de l'Informatique et des Libertes's breach-notification rule?

GDPR Article 33 requires notice to the CNIL without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach.