CNIL issues ten cybersecurity fines to French local authorities

What happened

In November 2026 the CNIL imposed ten simplified sanctions on French communes, departments, regions and a public establishment for cybersecurity shortcomings. The fines range from €3,000 to €20,000 and address failures such as weak authentication, lack of network segmentation, outdated operating systems, and missing Data Protection Impact Assessments. The action underscores the regulator’s focus on securing public‑sector data ahead of the NIS2 directive implementation.

Penalty

Des amendes allant de 3 000 € à 20 000 € (maximum légal pour ce type de procédure) ont été prononcées.

Why it matters for trust and compliance

• Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
• The sanctions highlight the growing enforcement of cybersecurity and data‑protection obligations for public bodies in France.
• Takes effect November 9, 2026.
• Penalty: Des amendes allant de 3 000 € à 20 000 € (maximum légal pour ce type de procédure) ont été prononcées..
• It relates to NIS2. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Map the security requirements to existing controls and close gaps.