{"id":197294,"date":"2026-03-19T07:04:00","date_gmt":"2026-03-19T11:04:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/19\/cybersecurity-and-personal-data-the-cnil-toughens-its-stance\/"},"modified":"2026-03-19T08:05:11","modified_gmt":"2026-03-19T12:05:11","slug":"cybersecurity-and-personal-data-the-cnil-toughens-its-stance","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/19\/cybersecurity-and-personal-data-the-cnil-toughens-its-stance\/","title":{"rendered":"Cybersecurity and Personal Data: The CNIL toughens its stance"},"content":{"rendered":"

Cybersecurity and Personal Data: The CNIL toughens its stance<\/a><\/p>\n

https:\/\/www.dataprotectionreport.com\/2026\/03\/cybersecurity-and-personal-data-the-cnil-toughens-its-stance\/<\/a><\/p>\n

Publish Date: 2026-03-19 07:04:00<\/a><\/p>\n

Source Domain: www.dataprotectionreport.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

On 9 February 2026, the Commission Nationale de l\u2019Informatique et des Libert\u00e9s (CNIL) published its 2025 report on its enforcement action. Beyond the \u20ac487 million \u2013 in cumulative fines \u2013 largely driven (unsurprisingly) by two sanctions related to cookies, another trend deserves attention:\u00a0the growing numbers of fines for failure to ensure the security of personal data and, more specifically, for personal data breaches.\u00a0<\/p>\n

A threat already identified \u2013 From awareness to action<\/p>\n

As early as 2024, the CNIL warned of a\u00a020% increase in breach notifications and a surge in large-scale data breaches. It noted that attackers regularly exploited the same vulnerabilities, which included compromise of login credentials and failure to detect intrusions, and also frequently involved processors.<\/p>\n

Although the number of sanctions may still appear small relative to the number of data breach notifications (5,629 in 2024), four significant fines were announced within two months, targeting both controllers and processors:<\/p>\n

\u20ac1.7M against a software publisher in the social welfare sector (December 2025);<\/p>\n

\u20ac1M against a marketing processor of a streaming platform (December 2025);<\/p>\n

\u20ac5M against the French public body in charge of employment (January 2026); and<\/p>\n

\u20ac42M against a major ISP (January 2026).<\/p>\n

What to expect in 2026<\/p>\n

This focus is in line with the CNIL\u2019s 2025\u20132028 strategic plan, in which cybersecurity features as one of the four priority areas. It is also reflected in the guidance issued on 30 April 2025 regarding how security measures should be strengthened. This emphasised rigorous identity and access management, real-time logging and analysis of network traffic, regular cybersecurity training for staff, and better oversight of security arrangements with processors and subprocessors.<\/p>\n

More specifically, the CNIL now requires companies holding customer, prospect, and user databases comprising data relating to several million individuals to implement multi-factor authentication for their employees, partners, processors, and any other parties that can access the database remotely. It also encourages adherence to the recommendations already published by the CNIL and France\u2019s National Agency for the Security of Information Systems (ANSSI).<\/p>\n

Compliance with this requirement for multi-factor authentication will be subject to\u00a0inspections by the CNIL from 2026 onwards. Failure to implement multi-factor authentication may lead to the commencement of enforcement proceedings.<\/p>\n

To access the CNIL\u2019s 2025 review: Sanctions and corrective measures: the CNIL presents its 2025 review | CNIL \u2013 to access the CNIL\u2019s recommendations on multi-factor authentication: https:\/\/cnil.fr\/fr\/recommandation-mfa<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Cybersecurity and Personal Data: The CNIL toughens its stance https:\/\/www.dataprotectionreport.com\/2026\/03\/cybersecurity-and-personal-data-the-cnil-toughens-its-stance\/ Publish Date: 2026-03-19 07:04:00 Source…<\/p>\n","protected":false},"author":1,"featured_media":197295,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/images.bannerbear.com\/direct\/y0aJ23zRDdqMxX4OGl\/requests\/000\/137\/820\/592\/w0gWbdEPaYajVgyvzrVklOA5j\/9c339d85fd5296a271c5cfe134590ffb7981fa89.png","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[30,24],"class_list":["post-197294","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-breach","tag-cybersecurity"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/197294"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=197294"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/197294\/revisions"}],"predecessor-version":[{"id":197296,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/197294\/revisions\/197296"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/197295"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=197294"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=197294"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=197294"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}