What happened
The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for victims of personal data leaks, covering actions from discovery up to day 30. It is part of the Cybermois 2026 campaign to raise public awareness on cybersecurity and data‑breach handling.
Why it matters for trust and compliance
- Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
- The new CNIL guide equips citizens with clear steps to mitigate risks after a personal data breach, strengthening individual data‑privacy protection.
- Takes effect October 1, 2026.
Who is affected
controller processor individual Cybermalveillance.gouv.fr
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Confirm access, correction, deletion and opt-out requests are handled within the required time.
- Revisit retention schedules and data minimisation for the data involved.
- Map the security requirements to existing controls and close gaps.
- Check breach-notification procedures and timelines against the requirement.