Personal Data Breaches: Understanding the Rise in Incidents and Managing CNIL Notification Requirements
DPO Conslting Rejoin Grant Thornton
In recent times, hardly a week goes by without the media reporting that an organization has suffered a cyberattack leading to a data breach. Websites such as https://bonjourlafuite.eu.org/ or ethical hackers like https://x.com/_SaxX_ regularly track these incidents, with the main observation being that their frequency has significantly increased in recent years.
This trend is also reflected in data from the CNIL, which has seen a rise in the number of breach notifications. According to the 2026 Personal Data Breach Barometer published by Forum INCYBER, based on CNIL open data, between September 2024 and September 2025, 8,613 data breaches were reported to the CNIL, compared to 5,919 the previous year (a 45% increase). This represents nearly 24 notifications per day over a full year.
The purpose of this article is not to analyze the root causes of data breaches or provide expert cybersecurity insights, but rather to offer practical guidance on anticipating common vulnerabilities and to focus on CNIL notification requirements.
To begin with, the GDPR defines a personal data breach in Article 4(12) as:
“a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.”
One aspect that may be surprising during notification is that while the definition includes five types of incidents (destruction, loss, alteration, unauthorized disclosure, and unauthorized access), only three types of breaches must be classified when notifying:
Destruction and loss both fall under loss of availability. Whether data is deleted or the storage medium is lost, the result is the inability—temporary or permanent—to access the data.
Alteration corresponds to loss of integrity, as any modification compromises data accuracy.
Finally, unauthorized disclosure and unauthorized access correspond to loss of confidentiality. For example, sending data to the wrong recipient or unauthorized access both compromise confidentiality.
To prevent or mitigate loss of availability, integrity, or confidentiality, several measures can be implemented.
A robust backup strategy is essential. A useful guideline is the 3-2-1(-1-0) rule:
Implement access control mechanisms to prevent unauthorized individuals from accessing data. This applies both to digital systems and physical documents containing personal data.
Use strong passwords and prioritize multi-factor authentication (MFA). Refer to ANSSI recommendations developed in collaboration with the CNIL on this topic.
Regularly update security components such as antivirus software, firewalls, and website elements. Vulnerabilities are constantly discovered and patched, and these updates are essential to prevent exploitation.
Encrypting storage devices and data during transmission reduces the risk of unauthorized access in case of loss or interception.
Finally, and most importantly, raise awareness among employees. Human nature tends toward convenience—people want immediate access to systems and information. However, security measures (passwords, badges, restricted access points, etc.) may slow them down, leading them to bypass these controls (reusing passwords, sharing credentials, propping doors open, etc.).
Security measures and common attack vectors (phishing, CEO fraud, etc.) must therefore be clearly explained, using simple and practical examples.
Not all breaches must be notified to the CNIL—only those that pose a risk to individuals’ rights and freedoms. However, all breaches must be documented internally in a register.
The CNIL provides a preparatory document outlining the notification steps.
The first step is choosing the type of notification: initial, complete, or supplementary. It is often advisable to submit an initial notification within the 72-hour deadline, and complete it later with additional details, such as corrective measures implemented.
The second step is identifying the notifying entity. In some cases, a processor may notify on behalf of the controller, depending on contractual arrangements.
The third step focuses on the breach itself:
The fourth step involves assessing the impact on affected individuals, including the severity level.
Finally, organizations must determine whether:
With the entry into force of the NIS2 Directive, questions remain about whether security incidents will need to be reported to multiple authorities (e.g., ANSSI, CNIL, and ARS for the healthcare sector).
The European Data Protection Board (EDPB), in its review of the Omnibus project, has called for harmonization of notification deadlines and the creation of a single reporting entry point to meet multiple regulatory obligations simultaneously.
DPO Consulting can support you in assessing risk levels, managing data breach notifications, and implementing appropriate cybersecurity measures through its dedicated Cyber practice.
.png)
.svg)
.png)
