CNIL fines ten French local authorities over weak cybersecurity
On 9 November 2026 the CNIL announced ten fines of EUR 3,000 to 20,000 against French local authorities for weak security and missing DPIAs.
On 9 November 2026 France's data protection authority, the CNIL, announced ten fines against local authorities and one public body for cybersecurity failings. The fines range from EUR 3,000 to EUR 20,000, the legal maximum under the simplified sanction procedure. They follow checks after the CNIL made the cybersecurity of local authorities one of its annual inspection themes in 2025.
What the CNIL found
Under Article 32 of the GDPR (security), the checks found:
- remote access for staff, including teleworking, without strong enough authentication, and no multi-factor authentication for administrators;
- external providers, such as software vendors, with permanent access to the network, without case-by-case authorisation or through accounts shared between several employees;
- incomplete logging, or logs not reviewed in real time or shortly after;
- insufficient network segmentation, so one breach could spread across several segments;
- servers running operating systems no longer updated by their vendor;
- weak passwords, passwords sent in clear to residents or stored without guaranteed confidentiality.
Some of the authorities had suffered data breaches that the CNIL says could have been avoided. Several had also put information systems into service without the security approval that France's general security framework (RGS) requires.
Several authorities were also fined for not carrying out a DPIA before high-risk processing: online services where parents manage their children's school activities (children's data and bank details), and video surveillance of public streets.
What comes next
The CNIL says it devotes half of its inspections and enforcement in 2026 to data security, and that other procedures are ongoing. It links this work to the preparation for NIS2, which will bring new security requirements for local authorities; for the state of the French bill, see NIS2 in October 2026.
What to do now
Check the basics the CNIL named: multi-factor authentication for remote and administrator access, controlled supplier access, logs that someone reviews, segmentation and supported systems. Then list the processing that needs a DPIA, starting with services for children and video surveillance.
Dazr Compliance turns these measures into recurring controls with owners and evidence, keeps the record of processing and a DPIA register, and tracks supplier reviews with their due dates. The interface is available in French.
Sources
For information only, not legal advice. Last updated 10 November 2026.
Also available in: Français