Organisations processing personal data in France meet the GDPR through a national law, the loi Informatique et Libertés, and a regulator, the CNIL, that publishes detailed security recommendations and enforces them at volume. In 2025 the CNIL issued 83 sanctions, 67 of them through its simplified procedure, and insufficient security, such as weak passwords or shared accounts, was among the leading reasons. For security teams the practical question is which CNIL recommendations an inspector will treat as the state of the art for GDPR Article 32. This guide covers the French national rules that differ from the GDPR baseline, the CNIL's security guidance on passwords, logging and its 2024 security guide, cookies, enforcement, and a rollout plan. It is for security, privacy and IT leads in organisations established in France or targeting French users. For the GDPR baseline, see the GDPR Compliance Guide for Security Teams.
Key takeaways
- CNIL recommendations set the bar for Article 32. They are not binding standards, and the CNIL accepts other measures that give equivalent security, but they are what inspectors compare you against.
- Passwords are measured in entropy. Deliberation 2022-100 sets minimum entropy of 80 bits for a password alone, 50 bits with access restrictions and 13 bits with a device the person holds, and drops forced periodic changes for ordinary users.
- Keep access logs for six months to a year. Deliberation 2021-122 recommends retaining traceability logs for at least six months and at most one year, with automated analysis.
- Volume enforcement is real. The simplified procedure lets one member of the restricted committee impose fines of up to 20,000 euros (100,000 euros above 50 million euros turnover), and security failures are a leading reason.
- Children and cookies differ from the baseline. Under-15s need joint consent with a parent where processing rests on consent for an online service, and refusing cookies must be as easy as accepting them.
The French framework on top of the GDPR
The loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (loi Informatique et Libertés) was rewritten by ordonnance n° 2018-1125 to sit alongside the GDPR. Légifrance shows it in force on 8 November 2026, with amendments as recent as May 2026, so always read the current consolidated version. The law restates the GDPR principles (Article 4 lists lawfulness, fairness and transparency, purpose limitation, minimisation, accuracy, storage limitation and security), uses the national flexibility the GDPR allows, transposes the ePrivacy cookie rule, and sets the CNIL's powers and procedures.
| Topic | GDPR baseline | French rule or CNIL position | What security teams do |
|---|---|---|---|
| Security of processing | Art. 32: measures appropriate to the risk | CNIL 2024 security guide, password and logging recommendations used as the reference | Map your controls to the CNIL fact sheets and recommendations |
| Passwords | No specific rule | Deliberation 2022-100: entropy levels, lockout, hashing with salt or key | Align password policy and storage; record the entropy case per system |
| Access logging | Implied by Art. 32 | Deliberation 2021-122: log access, creation, modification and deletion; keep 6 to 12 months; analyse automatically | Set SIEM retention and alerting on personal data systems |
| Children's consent | Art. 8: 16, Member States may lower to 13 | Loi Informatique et Libertés Art. 45: joint consent of parent and child under 15 for consent-based online services | Age checks and parental consent flows for optional features |
| Cookies and trackers | ePrivacy Directive Art. 5(3) | Transposed into the loi Informatique et Libertés; CNIL guidelines and recommendation of 2020; refusing as easy as accepting | Consent management with equal accept and refuse options |
| Sanctions | Art. 83 fines | Simplified procedure under Art. 22-1 for smaller cases; formation restreinte for larger ones | Treat CNIL letters and inspections as incidents with deadlines |
CNIL security guidance: the 2024 security guide
The CNIL published the 2024 edition of its Guide de la sécurité des données personnelles (Practice guide for the security of personal data) on 26 March 2024. It contains 25 fact sheets in five parts and is built around the Article 32 obligation to implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk". The 2024 edition added five fact sheets: cloud computing, mobile applications, artificial intelligence, application programming interfaces, and security data governance (pilotage de la sécurité des données). Some earlier multi-topic sheets were split and expanded, and guidance on personal devices used for work was added.
- Use it as a gap checklist: each fact sheet separates elementary precautions from reinforced measures. Score each sheet that applies to you and keep the result as Article 32 evidence.
- APIs and cloud: the new sheets are where most modern estates have gaps. API keys, service accounts and tokens that reach personal data fall under the same access control expectations as user accounts. See the Secrets Management Guide.
- AI: the AI sheet is a starting point; for GDPR questions specific to AI systems, see the AI and GDPR Guide.
Passwords: deliberation 2022-100
The CNIL's recommendation on passwords and other shared secrets was adopted by deliberation n° 2022-100 of 21 July 2022, published on 14 October 2022, and repealed the 2017 recommendation. It describes itself as a state-of-the-art reference: controllers may use other measures if they can show equivalent security.
| Case | Minimum entropy | Typical use (CNIL examples) | Access restriction expected |
|---|---|---|---|
| Password alone | 80 bits | Forum, blog | None required beyond strength |
| Password with access restriction | 50 bits | E-commerce, business accounts, webmail | Temporary lockout or attempt limits, CAPTCHA, or blocking after 10 failures with a risk-appropriate unlock |
| Password with a device the person holds | 13 bits | Bank card PIN, phone | Blocking after 3 failed attempts, combined with possession of the device |
- Composition examples for 80 bits: at least 12 characters with upper case, lower case, digits and special characters from a list of at least 37; or at least 14 characters with upper case, lower case and digits; or a passphrase of at least 7 words.
- Storage: never in clear text; where authentication is on a remote server, transform passwords with a secure, non-reversible function using a salt or key. The CNIL names scrypt and Argon2, citing ANSSI. See the Password Hashing and Key Derivation Guide.
- Renewal: no forced periodic changes for standard users; periodic renewal is still recommended for privileged accounts such as administrators.
- Compromise: after a suspected compromise, notify the CNIL within 72 hours where the breach rules apply, force a change at next login and advise users to change the same password elsewhere.
- Beyond passwords: the CNIL considers two-factor authentication and certificates more secure, and says privileged accounts often need more than a password.
Logging: deliberation 2021-122
Deliberation n° 2021-122 of 14 October 2021, published on 18 November 2021, covers logging for traceability of access and actions by authorised users of systems that process personal data. The CNIL says it is neither prescriptive nor exhaustive, but it gives the clearest retention figure in French guidance.
- What to log: access, creation, modification and deletion actions on personal data processing, with the user identifier, date and time, and the equipment identifier.
- Retention: at least six months and at most one year for standard logging. Longer retention, up to three years in the most common cases, may be justified for internal control processing.
- Analysis: automated analysis so that misuse is detected quickly, and short-term use of the data for security.
- Protect the logs: technical and organisational measures to stop logs being used for other purposes, such as staff monitoring. See the Privacy in Security Logging and Monitoring Guide.
Include non-human identities: a service account or API key that reads customer records should appear in the same access logs with its own identifier. Shared technical accounts defeat traceability, and shared accounts appear among the CNIL's own reasons for simplified-procedure sanctions.
Cookies and children
The CNIL adopted revised guidelines and a recommendation on cookies and other trackers in September 2020 and expected sites to comply within six months, by the end of March 2021. Its summary for the public sets three principles: inform users clearly about purposes before consent, "Refuser doit être aussi facile que d'accepter" (refusing must be as easy as accepting), and treat one-click acceptance against a multi-step refusal as a risk of influencing the user. Cookie and tracker failures were the largest sanction theme in 2025, with 21 sanctions. The CNIL has since added guidance on tracking pixels in emails. For implementation detail, see the Cookie and Tracking Technology Compliance Guide and the Consent Management Guide: Cookies, CMPs and GPC.
For children, Article 45 of the loi Informatique et Libertés applies to online services where processing relies on the user's consent (not on a contract): for a child under 15, the holders of parental authority must consent jointly with the child. The CNIL's recommendation says parents cannot override a child's refusal and the child cannot override a parent's objection, and that in practice express consent from one parent is enough, with the other presumed, provided the other can object.
Enforcement: how the CNIL acts
The CNIL can act through formal notices (mises en demeure), the restricted committee (formation restreinte), and since 2022 a simplified procedure. Under the simplified procedure, citing Article 22-1 of the loi Informatique et Libertés, the president of the restricted committee or a designated member decides alone and can issue a reminder of obligations, an order to comply with a daily penalty, or a fine. The CNIL's page gives fine ceilings of 20,000 euros for companies with turnover under 50 million euros and 100,000 euros above that, and daily penalties of up to 100 or 500 euros respectively.
| CNIL 2025 figure | Value |
|---|---|
| Sanctions | 83, total fines 486,839,500 euros |
| Through the simplified procedure | 67 (16 by the restricted committee) |
| Cookies and trackers | 21 sanctions |
| Employee video surveillance | 16 organisations |
| Insufficient security (simplified procedure) | 14 organisations, for example weak passwords or accounts shared between users |
| Formal notices | 143 |
The CNIL also sanctioned processors in 2025 for failing their own obligations: security, following the controller's instructions, and deleting data at the end of the contract. Processors serving French customers should not assume the controller carries all the risk. For enforcement patterns across Europe, see the GDPR Enforcement Decisions on Security Failures Guide.
Rolling out a CNIL-aligned programme
- Scope: list processing operations in France or targeting French users, and which are consent-based online services (children's rule) or use trackers (cookie rules).
- Gap-check against the security guide: score each applicable fact sheet of the 2024 guide, starting with the five new sheets.
- Classify authentication cases: for each system, record which of the three entropy cases applies and confirm lockout, storage and privileged account rules. Pilot policy changes on one system first, with a rollback to the previous policy if support calls spike.
- Set logging: confirm access logs on personal data systems capture user or service identity, time and device, are kept six to twelve months, and are analysed automatically.
- Retire shared accounts: replace shared human and technical accounts with individual identities or vaulted, attributable access.
- Fix consent flows: equal accept and refuse options, no trackers before consent, and joint parental consent for under-15s on optional consent-based features.
- Prepare for contact: a playbook for CNIL inspections and formal notices, with an owner and deadlines, and processor contracts that cover deletion at the end of service.
Small organisations can meet most expectations with a password manager, MFA for administrators and remote access, provider-managed logs with the right retention, and a compliant consent tool. Large organisations should map the CNIL guidance into their control framework so that audits test it directly.
Detection and measurement
- Entropy compliance: percentage of systems whose password policy meets the CNIL case recorded for them.
- Shared accounts: number of shared human or technical accounts with access to personal data, trending to zero.
- Log coverage and retention: percentage of personal data systems sending access logs to analysis with 6 to 12 months retention.
- MFA on privileged access: percentage of administrator accounts using two-factor authentication or certificates.
- Cookie compliance: pages where trackers fire before consent, from regular scans.
- Security guide score: share of applicable fact sheets at "reinforced" level.
Common failure patterns
- Shared accounts: a team login or shared database account with personal data access, a cited reason for simplified-procedure security sanctions.
- Short passwords with no lockout: eight-character passwords on a webmail or customer portal without attempt limits do not meet the 50-bit case.
- Logs kept forever, or not at all: both conflict with deliberation 2021-122.
- Refuse button hidden: a one-click accept beside a second-layer refuse.
- Processor assumes no duty: data left with a processor after contract end.
Framework mapping
| French or CNIL requirement | GDPR | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Password recommendation 2022-100 | Art. 32 | IA-5 |
| Logging recommendation 2021-122 | Art. 32, Art. 5(1)(e) | AU-2, AU-11, AU-6 |
| 2024 security guide | Art. 32 | Several families |
| Article 45 children's consent | Art. 8 | PT-4 |
Practitioner checklist
- Read the current consolidated loi Informatique et Libertés on Légifrance and note the date checked.
- Score your controls against the 25 fact sheets of the CNIL 2024 security guide.
- Record the CNIL entropy case for every authentication system and enforce matching lockout rules.
- Hash stored passwords with a salted or keyed non-reversible function such as Argon2 or scrypt.
- Stop forced periodic password changes for standard users; keep renewal and MFA for privileged accounts.
- Keep personal data access logs six to twelve months and analyse them automatically.
- Eliminate shared accounts, including shared technical and service accounts.
- Make refusing cookies as easy as accepting, and block trackers before consent.
- Implement joint parental consent for under-15s on consent-based online features.
- Write an inspection and formal notice playbook with owners and deadlines.
Standards and references
- Légifrance: Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés
- CNIL: Practice guide for the security of personal data, 2024 edition
- CNIL: Mots de passe, recommandations pour maîtriser sa sécurité
- CNIL: Recommandation relative aux mesures de journalisation
- CNIL: Évolution des règles d'utilisation des cookies
- CNIL: Recommandation 4, consentement d'un parent pour les mineurs de moins de 15 ans
- CNIL: La procédure de sanction simplifiée
- CNIL: Sanctions et mesures correctrices, bilan 2025
Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · France NIS2 Implementation Guide · France SecNumCloud Guide · Password Policy Guide (NIST-aligned). This guide summarises French data protection law and CNIL guidance and is not legal advice.