Two ways you find out
French organisations have had a rough few years of headlines: the Viamedis and Almerys third-party payer breaches in early 2024, France Travail shortly after, then a run of telecom, retail and sports federation leaks. Behind each headline sit dozens of smaller organisations that learned about their own exposure in one of two ways:
- You detect it. An alert, an anomalous export, a ransom note, an employee who noticed something.
- Someone else tells you. A journalist, a researcher, a customer who found their record on a leak forum, a vendor's notification email, or your own name in a Telegram channel.
The second case is now more common than the first, and it is the one organisations handle worst, because nobody "declared an incident". There was no alert, so there was no process. Yet the legal clock behaves the same way.
The clock: what GDPR actually requires
Under GDPR Article 33, the controller must notify the competent supervisory authority (in France, the CNIL) "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to people's rights and freedoms. If you notify late, you must give the reasons for the delay.
Key points people get wrong:
- "Aware" is not "fully understood". The EDPB guidance treats awareness as a reasonable degree of certainty that a security incident has compromised personal data. You do not get to wait for the forensic report.
- Notification can be phased. Article 33(4) allows you to provide information in stages. File an initial notification with what you know, then complete it. The CNIL's online service is built for this.
- Processors notify controllers. If you are a processor (a SaaS, an MSP, a payroll provider), Article 33(2) requires you to inform the controller without undue delay. Your customers then own the CNIL notification. Contracts often shorten this to 24 or 48 hours.
- Every breach is recorded. Article 33(5) requires documenting all breaches, including the ones you decide not to notify, with facts, effects and remedial action. This internal register is the first thing an auditor asks for.
Article 34 adds communication to the people affected when the breach is likely to result in a high risk to them. Exceptions exist: the data was rendered unintelligible (properly encrypted, key not compromised), you took measures that remove the high risk, or individual contact would involve disproportionate effort, in which case a public communication replaces it.
Sector rules can be stricter. Electronic communications providers fall under the ePrivacy breach regime, which requires notifying the CNIL within 24 hours. Entities in scope of NIS2 have their own incident reporting track toward ANSSI, separate from GDPR. We untangle the overlaps in NIS2, DORA and GDPR untangled.
Hour 0 to 24: establish facts, preserve evidence
Confirm and scope
If the trigger is external ("your data is on a forum"), get a copy of the published sample through a controlled analyst workstation, never by downloading it to a corporate laptop. Then answer, in writing:
| Question | Why it matters |
|---|---|
| Is this our data, or a recycled older leak? | Recycled compilations are common. Check field formats, IDs and dates against your systems. |
| Which system produced it? | Column names, internal IDs and export formats usually identify the source application or the vendor. |
| How many people, which categories? | Health, financial, identity documents and children's data push toward high risk. |
| Is it still happening? | An open access path changes the priority from paperwork to containment. |
| Are we controller or processor? | Determines who notifies the CNIL. |
Do not run the sample through public online services that store submissions. If you need to check whether a specific mailbox appears in known exposures, do it per address (the /email/ lookup is designed for this) rather than uploading the whole file anywhere.
Preserve evidence
The temptation is to fix things immediately. Fix, yes, but capture first:
- Export and secure logs from identity providers, VPN, firewalls, databases, SaaS audit logs. Many have short default retention.
- Snapshot affected cloud resources and virtual machines before rebuilding.
- Keep a timestamped incident journal: who decided what, when, on which information. This is what you will show the CNIL, your insurer and possibly a judge.
- Record hashes of files you collect (a sample, a ransom note) so their integrity is provable later.
If a criminal offence is involved (intrusion, extortion), file a complaint with the police or gendarmerie. It is useful for insurance, for any later prosecution, and it signals good faith. Do not pay or negotiate before legal counsel and, if you have one, your insurer's crisis line are involved.
Hour 24 to 72: notify
The CNIL accepts breach notifications through its online teleservice. Expect to provide:
- Nature of the breach (confidentiality, integrity, availability) and how it happened, as far as known.
- Categories and approximate number of data subjects and records.
- Likely consequences for the people concerned.
- Measures taken or planned, including to mitigate adverse effects.
- Contact point, normally your DPO.
Write it the way you would want to read it: factual, dated, no speculation, explicit about what is still unknown. "Investigation ongoing, complement to follow" is an acceptable sentence. Silence is not.
Do not let the 72-hour deadline wait on certainty. A late, perfect notification is worse than an on-time, incomplete one. Notify, then complete.
Communication: the part that decides reputation
When Article 34 applies, the message to individuals must use clear and plain language and describe the nature of the breach, the likely consequences, the measures taken, and the contact point. In practice, the good notifications we have seen share some traits:
- Specific about the data. "Your name, postal address and IBAN" beats "some personal information".
- Actionable. Tell people what to watch for: phishing using the leaked data, fake bank advisor calls (very common in France after IBAN leaks), SIM swap attempts.
- Honest about uncertainty. People forgive "we do not yet know"; they do not forgive minimisation followed by revisions.
- Consistent across channels. Customer service, the website, social media and the press all need the same script before the first email leaves.
Expect your announcement to be used as phishing bait within days. Criminals send fake "breach compensation" or "verify your account" emails mimicking your notification. Say explicitly in your message what you will never ask for.
Credential resets and identity hygiene
If credentials or authentication data are involved, contained or not:
- Force resets for affected accounts, and revoke active sessions and tokens at the identity provider. A password reset alone does not invalidate a stolen session.
- Check for persistence: new MFA methods, OAuth app consents, mailbox forwarding rules, new API keys, new admin accounts created during the intrusion window.
- Rotate secrets that lived in the compromised system: service account passwords, API keys, database credentials, signing keys.
- Warn about reuse. Users who reused the leaked password elsewhere are now exposed outside your perimeter. Say so plainly.
If your employees' credentials appeared in a third party's breach (not yours), you still have work: reset where reused, and watch for credential stuffing against your SSO and VPN.
Who can help in France
- cybermalveillance.gouv.fr, run by the GIP ACYMA, is the national assistance platform for individuals, companies (particularly SMEs) and local authorities. It provides diagnosis, guidance and a directory of referenced providers who can intervene.
- ANSSI and CERT-FR are the reference for operators: entities designated as operators of vital importance (OIV), operators of essential services, and entities in scope of the French NIS2 transposition have regulatory incident reporting obligations toward ANSSI, separate from the CNIL notification. CERT-FR also publishes alerts and advisories worth following.
- Your sector CSIRT or regional response centre (CSIRT régional) can help smaller organisations triage before they engage a commercial provider.
- The CNIL publishes guidance on breach handling and notification. Read it before you need it.
A note on processors and supply chain
Many recent French breaches originated at a service provider. If the breach is at your vendor:
- You remain the controller. The vendor's notification to you starts your awareness clock.
- Demand the facts in writing: scope, data categories, timeline, containment, and their own CNIL status.
- Check the contract: notification deadlines, audit rights, sub-processor lists. If they are vague, that is your lesson for the next renewal.
What to do Monday
- [ ] Write down who decides "this is a personal data breach" and who files with the CNIL. Name a deputy.
- [ ] Make sure your breach register (Art. 33(5)) exists and has an owner.
- [ ] Prepare notification and customer communication templates in French, reviewed by legal now, not during the crisis.
- [ ] List the logs you would need and verify their retention is long enough to cover a breach discovered months later.
- [ ] Review processor contracts for notification deadlines shorter than 72 hours.
- [ ] Save the contacts: CNIL teleservice, cybermalveillance.gouv.fr, your CSIRT, your insurer's crisis line, outside counsel.
- [ ] Run a one-hour tabletop where the trigger is "a journalist emails us a sample", not "the SIEM alerts".
The 72 hours are short. They are much shorter if the first 24 are spent working out who is supposed to do what.
