← All resources

CNIL closes France Travail injunction, no penalty (08/10/2026)

Published October 9, 2026 · 7 min read · CyberNovaLabs.io

On 8 October 2026 the CNIL closed its injunction against France Travail without applying the 5,000 EUR daily penalty. For an SME, the useful part is not the 5 million fine but the four security measures the regulator treated as mandatory.

In short

On 8 October 2026 the CNIL published the closure of the injunction it had issued against France Travail: by a deliberation of 23 September 2026 it found the organisation compliant and did not apply the penalty of 5,000 euros per day of delay.^[1] That injunction came with a 5 million euro fine decided on 22 January 2026 (deliberation SAN-2026-003) for breaching the security obligation in Article 32 GDPR, after a breach affecting 36.8 million people.^[2][3][4] For a smaller company the useful information is not the amount: it is the list of four measures the regulator treated as mandatory, plus the finding that they already appeared in the organisation's impact assessments and had never been deployed.^[2]

GDPR data security: the four measures the CNIL required

The January injunction did not ask for « better security ». It listed four specific measures, to be evidenced against an implementation schedule.^[2] In substance:

• A password policy with account access restriction mechanisms — lockout after repeated failures, not merely a length requirement.
• Multi-factor authentication on the accounts of CAP EMPLOI advisers, that is, on external accounts that reached the main database.
• Active supervision of the information system and of activity logs — logs that merely exist are not enough; someone has to read them.
• Access limited to the data actually needed — an adviser should not have been able to open files on people they were not supporting.

Translate the list by replacing « CAP EMPLOI adviser » with « external accountant », « web agency », « temp worker » or « IT provider ». The four points become a four-line audit grid, published by the regulator itself, on a perimeter almost every SME shares: the access it grants to third parties.

A fine is paid once, a daily penalty is paid every day

Many owners register the 5 million euros and conclude the case has nothing to do with a twenty-person firm. The number to watch is the penalty: 5,000 euros per day of delay, a mechanism that does not scale with the size of the original fine.^[1][2] Here, compliance within the deadline brought it down to zero. The fine is frozen on the day of the decision; the remedial work stays in the organisation's own hands. An SME served with a formal notice has the same lever, on one condition: being able to prove, with dated evidence, what it changed and when.

The ANSSI report on the attack against the French tax administration described the same technical chain: stolen credentials, no multi-factor authentication, no detection during exfiltration. We covered it in our analysis of the ANSSI report on the DGFiP breach and missing MFA.

The trap: a measure written down but never deployed

The harshest part of the January decision is a finding about method: the CNIL notes that the organisation had identified these security measures in its impact assessments without implementing them.^[2] An internal document that records a risk and its countermeasure stops protecting you the day it produces no effect. It becomes evidence that the risk was known.

The practical consequence for any SME that has run an audit, a data protection impact assessment (DPIA) or a security plan: every unimplemented line is a dated debt. Either you do it, or you write down why you are not doing it and which measure replaces it. In front of a regulator, a plan with no completion date and no named owner weighs against you rather than for you.

France, Belgium, the Netherlands, Luxembourg: one obligation, four authorities

The obligation at stake is Article 32 GDPR, which requires appropriate technical and organisational measures. Because the GDPR is a European regulation, that text is identical in the four countries we work in; what differs is the competent authority and its procedure.

The ceiling is set by the regulation too, not by the country: a breach of Article 32 falls under Article 83(4) GDPR, up to 10 million euros or 2 % of total worldwide annual turnover, whichever is higher. The daily penalty, by contrast, is a procedural tool specific to each authority: do not carry the 5,000 euro per day figure outside France without checking. For regulatory deadlines country by country we maintain the cybersecurity deadlines calendar, and for Belgian scope specifically, our NIS2 Belgium page.

If the breach happens anyway: the countdown

These four measures lower the probability; they do not take the risk to zero. The day a breach is established, the 72-hour notification deadline in Article 33 GDPR starts running, including when the incident happened at a supplier. We have covered both recent patterns: the Jims breach and notification duties and the 72-hour clock when the breach comes from a supplier.

At CyberNovaLabs.io

CyberNovaLabs.io works with SMEs in the Netherlands, Belgium, France and Luxembourg on exactly those four points: inventory of external access, multi-factor rollout, log supervision, and clearing audit recommendations that were never implemented. For a review of your access and logging, see our cybersecurity services or request a meeting. Work is quoted per project.

Sources

1. CNIL — Cloture de l'injonction prononcee a l'encontre de FRANCE TRAVAIL (08/10/2026)
2. CNIL — Violation de donnees : sanction de 5 millions d'euros a l'encontre de FRANCE TRAVAIL (22/01/2026)
3. Legifrance — Deliberation SAN-2026-003 du 22 janvier 2026
4. L'Usine Digitale — France Travail : 36,8 millions de victimes de la fuite de donnees (janvier 2026)

Read next