CNIL lawyer in Paris: responding to the inspection, the formal notice and the sanction procedure.

Receive the team, ask for the inspection order and immediately inform management, the data protection officer and your lawyer. The French Data Protection Act (loi Informatique et Libertés) gives authorised officials access to premises where data is processed, from 6:00 to 21:00, the prosecution service having to be notified in advance (Art. 19, I). Premises or parts of premises used as a private home may be visited only with the prior authorisation of the liberty and custody judge. The person responsible for the premises must be told that they may refuse the visit. The officials may request disclosure of any documents, take copies, collect information and access programs and data. Appoint a single point of contact, note the questions asked and the documents handed over, and give only answers that you can verify. The report is drawn up in the presence of both sides where the inspection takes place on site: read it before signing it and have your observations recorded if a finding seems inaccurate or incomplete. The list of documents seized is annexed to it. This report will serve as the basis for the rapporteur if sanction proceedings are started, which is why it should be treated as the first document in the file.

Yes, within a precise framework. Article 19, II, of the French Data Protection Act provides that the person responsible for the premises is informed of the right to object; if that right is exercised, the visit requires a prior order from the liberty and custody judge (JLD) of the judicial court (tribunal judiciaire) within whose jurisdiction the premises are located. The same provision nevertheless allows the judge to authorise a visit without prior notice to the person responsible where urgency, the seriousness of the facts or the risk of documents being destroyed justifies it; objection is then no longer possible, and the occupier may be assisted by a lawyer of their choice. Objecting is therefore not a fault in itself, but it has practical consequences: it delays the visit and may lead the Commission to return with an order. Article 226-22-2 of the French Criminal Code (Code pénal) punishes obstruction of the CNIL's work with one year's imprisonment and a fine of 15,000 euros, notably opposing a visit authorised by the judge, refusing to provide the relevant information and documents or concealing them. The decision whether to object is therefore made with full knowledge, after weighing what the inspection team is looking for and what the company gains by deferring.

In principle, no. Article 19, III, of the French Data Protection Act provides that secrecy cannot be invoked against the Commission's members and officials. The provision nevertheless reserves three exceptions: information covered by the professional secrecy applying to the relationship between a lawyer and client, the confidentiality of sources in journalistic processing and, under certain conditions, medical confidentiality. For the latter, individual medical data from processing for care, diagnosis or research may be disclosed only under the authority and in the presence of a doctor. Business secrecy is not listed among these exceptions; it does not, on its own, therefore allow a requested document to be withheld. In practice, set aside before the inspection the advice and correspondence exchanged with your lawyer, flag them as such if the inspection team asks for them and have the difficulty recorded in the report. For health data, arrange for a doctor to be present rather than refusing outright, which could be read as a lack of cooperation or, worse, as obstruction.

They can be disputed, but the principle is firmly accepted. Article 19, III, of the Act allows officials, outside an on-site inspection or one on summons, to consult from an online service data that is freely accessible or made accessible, including through imprudence, negligence or the act of a third party, and to transcribe it into documents usable for the inspection. They may also act under an assumed identity to inspect an online service. In the SERGIC case, a property management company argued that the online findings were void because the officials had downloaded documents exposed by a flaw in its website. The Council of State rejected the argument and held that officials may download files made accessible by a security defect; the company's application was dismissed (CE, 4 November 2020, No. 433311). A useful challenge therefore concerns the content rather than the method: date and time of the finding, version of the site, path followed, configuration of the trackers at that precise moment. Hence the value of archiving the state of the site before any correction.

The time limit is set by the decision itself. Article 20, III, of the French Data Protection Act allows the CNIL's chair, where the breach can be brought into compliance, to serve formal notice on the controller or its processor within the time limit the chair sets. The formal notice may require a data subject's requests to be met, processing to be brought into compliance, a data breach to be communicated, or data to be rectified and erased. The chair may require proof of compliance within a time limit that the chair sets, reduced to twenty-four hours in urgent cases; the chair closes the procedure when that is done. The reply must therefore show, with supporting documents, what was changed and on what date: screenshots, new information notices, amended contracts, internal procedures, technical logs. If the deadline is unrealistic, a reasoned request for an extension is better than silence. The formal notice may be made public at the chair's request; the closing decision then receives the same publicity.

Yes. The Council of State rules alone, with no appeal, on the acts that the Commission adopts in the exercise of its supervisory powers, including those of its chair (CJA, Art. R. 311-1, 4°), within the two-month period laid down by Article R. 421-1 of the same Code. The municipality of Beaucaire had challenged a formal notice concerning, among other things, the impact assessment for its video-surveillance system: the Council of State examined the lawfulness of the decision, held the impact assessment to be necessary given the scale of the system and dismissed the application. It also held inadmissible the claims seeking repeal of the formal notice on the ground that the municipality had complied with it (CE, 30 April 2024, No. 472864). Likewise, TotalEnergies was able to challenge the reminder of its obligations issued after complaints from three employees; its application was dismissed, the court noting that it had been informed of the complaints and given the opportunity to submit its observations (CE, 1 December 2025, No. 498023). The challenge is therefore open, but it requires a genuine legal ground.

No. Article 20, IV, of the French Data Protection Act allows the chair to bring the matter before the restricted committee, possibly after a warning or a corrective measure, which means that these steps are possible but not mandatory. The Council of State so held, under the numbering of the Act then in force, in respect of SERGIC, fined 400,000 euros for a security defect on its website and excessive retention of documents of rental applicants: it held that the sanction was not subject to a prior formal notice, and then considered proportionate a fine representing less than 1% of the company's turnover (CE, 4 November 2020, No. 433311). This outcome is unfavourable to the organisations inspected: an inspection can lead directly to a report proposing a sanction. It requires every inspection to be treated as the possible start of sanction proceedings, by correcting the defects found without delay and keeping proof of those corrections. Conversely, where a formal notice has been served, its performance, justified within the time limit, allows the chair to close the formal notice procedure, without the text then barring a referral to the restricted committee.

Notification of the report opens the adversarial phase. Under Article 40 of the Decree of 29 May 2019, the respondent has one month to send written observations to the rapporteur and to the chair of the restricted committee; each later submission is filed within the same period and the respondent always has the option of filing last. The procedural file is made available to the respondent, who may take a copy. The respondent is summoned at least fifteen days before the hearing, or seven days in the case of a re-examination or a postponement to a later hearing, and may be assisted or represented by a lawyer of their choice; in that case, the lawyer alone receives procedural documents, apart from the appointment of the rapporteur and the notification of the decision. The Council of State holds that the rights of the defence apply from the notification of the report provided for by Article 22 of the Act, and not to the rapporteur's earlier steps, save in cases of irremediable prejudice; it dismissed on this point the application of the app publisher Voodoo (CE, 14 May 2024, No. 472221). The observations must address each breach, the period covered, the measures taken and the financial information, before the investigation is declared closed.

It applies the caps in Article 20, IV, 7°, of the Act and the criteria in Article 83(2) of the GDPR: nature, gravity and duration of the infringement, number of data subjects, intentional or negligent character, measures taken to mitigate the damage, degree of cooperation, categories of data, previous infringements and financial benefits obtained. The Council of State carries out a proportionality review, but does not require the Commission to spell out the calculation: in the Voodoo case, it held that the restricted committee did not have to state the figures behind the method of determining the 3 million euro fine (CE, 14 May 2024, No. 472221). For Orange, it accepted an overall fine of 50 million euros, representing 0.11% of worldwide turnover, without a breakdown by breach (CE, 16 October 2026, No. 501268). In the Ubeeqo case, the fine of 175,000 euros was assessed taking into account the turnover of the group to which the company belonged (CE, 6 December 2023, No. 467368). All three applications were dismissed: the discussion on the amount is prepared from the written observations onwards, with figures to support it.

Yes, corrective measures may mitigate the sanction, their speed and effectiveness being assessed together with the other circumstances of the case. In the Optical Center case, customer invoices were accessible without authentication on the optician's website. The Council of State held a fine of 250,000 euros to be disproportionate because it had been set without taking account of the speed with which the company had put corrective measures in place, and reduced it to 200,000 euros (CE, 17 April 2019, No. 422575). The decision, given under the former wording of the 1978 Act, illustrates a criterion now found in Article 83 of the GDPR: the measures taken to mitigate the damage. It has a clear limit. In the Futura Internationale case, fined 500,000 euros for telephone canvassing despite objections, the court noted that the corrections made during the proceedings had not effectively ended the breaches and that the company had failed in its duty to cooperate; the application was dismissed (CE, 1 March 2021, No. 437808). A late, partial or unproven move to compliance therefore weighs much less in this assessment. Date each correction, keep the previous state and send the supporting evidence to the rapporteur.

It may be. Article 22 of the French Data Protection Act allows the restricted committee to make the measures it takes public and to order their insertion in publications that it designates, at the expense of the sanctioned person; it may also order that each data subject be individually informed of the infringement and the measure. In the SERGIC and Voodoo cases and the one mentioned below, the decision was published under the company's name for two years, then anonymised. The Council of State reviews the proportionality of this publicity, but accepts it widely: it upheld the two-year publication of a 30,000 euro sanction against a public housing office that had used its tenant file to send them a letter unrelated to the purposes of the processing, noting its deterrent effect on players in the sector (CE, 5 October 2020, No. 424440). The same analysis was adopted for the mobile games publisher Voodoo, whose apps reached a very wide audience (CE, 14 May 2024). Publicity is therefore argued in the written observations, with arguments specific to the case: small number of people, immediate correction, no lingering risk.

The simplified procedure is provided for by Article 22-1 of the French Data Protection Act, as amended with effect from 28 May 2026. The CNIL's chair may start it where a reprimand, an order or a fine is the appropriate response and the case raises no particular difficulty, having regard to settled case law, earlier decisions of the restricted committee or the simplicity of the questions raised. The fine incurred may then not exceed 20,000 euros and the daily penalty payment 100 euros; these amounts rise to 100,000 euros and 500 euros where the controller's total worldwide annual turnover for the preceding financial year exceeds 50 million euros. The chair of the restricted committee, or a member of that committee whom the chair designates, rules alone on the basis of the report of a member of staff, after the respondent has been able to submit written observations and ask to be heard. Decisions made under this procedure may not be made public. The chair of the restricted committee may refuse to use it or discontinue it, in which case the procedure resumes with the safeguards of Article 22. The same requirements of proof and reply therefore apply, on a shorter scale.

Yes, as evidence, without binding the judge. Customers of a crypto-asset wallet manufacturer, a victim of cyberattacks, sought compensation for the disclosure of their data; the CNIL had sanctioned the company for inadequate security measures. The Paris judicial court (tribunal judiciaire) recalled that "It is settled that the decision given by the CNIL does not bind the court" (TJ Paris, 4 March 2025, No. 22/03497) (our translation), while ordering the reopening of the hearing so that the claimants could request its disclosure. In another case arising from the same leaks, the pre-trial judge ordered the company to lodge with the court registry, for the judge's own use, the confidential version and a redacted version of the decision, before examining the conditions for disclosing them, recalling that "although business secrecy or the principle of confidentiality do not in themselves constitute an obstacle to compulsory production of a document" (TJ Paris, 9 December 2025, No. 22/00774) (our translation), production remains subject to a legitimate reason, to its necessity and to the absence of disproportionate interference. These interim decisions are unfavourable to the sanctioned company. The victim must nonetheless prove the damage: the Court of Cassation holds that "mere infringement of the General Data Protection Regulation does not, on its own, give rise to a right to compensation" (Court of Cassation, social chamber, 24 June 2026, appeal No. 24-22.792) (our translation).