GDPR in practice · Episode #1
Articles 33 and 34 GDPR · CNIL · EDPB Guidelines
In recent weeks, breach alert emails have been piling up in our inboxes. In early November 2026, Engie confirmed that some of its customers’ data in France (names, postal addresses, email addresses, telephone numbers and contract references) had been accessed without authorisation at one of its service providers. The energy supplier states that it notified the CNIL (French data protection authority) and informed some of its customers by email.
Behind each of these messages lies a specific obligation under the General Data Protection Regulation (GDPR). Any organisation that suffers a personal data breach, whatever its size, must document it (Art. 33(5) GDPR) and, depending on the level of risk, notify it to the CNIL within 72 hours (Art. 33(1) GDPR), or even inform the individuals concerned (Art. 34(1) GDPR).
The stakes are real. Between May 2018 and May 2023, the CNIL received 17,483 breach notifications. Only half of them met the 72-hour deadline.
When a breach occurs, the organisation must first qualify the incident (1.), then, where required, notify it to the CNIL (2.) and inform the individuals concerned (3.). In every case, it must document it (4.). Failing that, it faces penalties (5.).
1. Qualify the incident
What is a data breach? The GDPR defines it as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed (Art. 4(12) GDPR).
Not every security incident is a personal data breach, however: personal data must actually be affected (EDPB Guidelines, para. 15).
The concept is broad. A breach may be malicious or accidental, and may affect three properties of the data:
their confidentiality, where data are accessed or disclosed without authorisation (hacking, an email sent to the wrong recipient);
their integrity, where data are altered without authorisation;
their availability, where data are lost or made inaccessible, for example through ransomware or accidental deletion without a backup.
The CNIL’s examples include the accidental deletion of medical records that had not been backed up, the loss of an unencrypted USB stick containing a customer database, and the malicious alteration of pupils’ marks.
The EDPB specifies that a ransomware attack is a breach even where a backup allows the data to be restored: the intrusion requires the organisation to check whether the data were accessed or copied (EDPB Guidelines, para. 23). A temporary loss of availability must also be recorded in the register (Art. 33(5) GDPR).
Assess the level of risk. Once the incident has been qualified, the organisation must assess, case by case, the risk it poses to individuals’ rights and freedoms. The CNIL relies on several criteria: the type of breach, the nature and volume of the data, the ease of identifying individuals, the severity of the possible consequences, the vulnerability of the individuals (minors, for example) and their number.
The EDPB stresses that data that seem harmless on their own become more sensitive once combined: a name, a postal address, a telephone number and contract references are enough to make a phishing attempt credible (EDPB Guidelines, paras 108 and 109). In case of doubt, it recommends notifying (para. 119).
The organisation’s obligations depend on this assessment:
no risk: entry in the internal breach register (Art. 33(5) GDPR);
risk: entry in the register and notification to the CNIL within 72 hours (Art. 33(1) GDPR);
high risk: entry in the register, notification to the CNIL within 72 hours and communication to the individuals concerned without undue delay (Art. 34(1) GDPR).
According to the CNIL, some breaches in principle present no risk: data that are already public, data deleted and then immediately restored, or data encrypted with a secure, uncompromised key, of which a backup copy exists.
2. Notify the CNIL within 72 hours
The principle. Where a breach presents a risk to individuals’ rights and freedoms, the controller must notify it to the CNIL without undue delay and, where feasible, not later than 72 hours after having become aware of it (Art. 33(1) GDPR). Where the notification is made after that deadline, it must be accompanied by reasons for the delay (Art. 33(1) GDPR).
When the clock starts. According to the CNIL, the deadline runs from the moment the organisation is reasonably certain that a security incident has affected personal data. Time spent on initial investigations does not count, provided they are carried out promptly. Examples of becoming aware include discovering the loss of a USB stick, receiving evidence sent by a third party, or verifying a cybercriminal’s claim to have stolen data. Conversely, an organisation that is slow to react when a breach is obvious may be regarded as having failed to notify it (EDPB Guidelines, para. 40).
Notify without waiting to know everything. There is no need to know the full extent of the breach before notifying: information may be provided in phases without undue further delay (Art. 33(4) GDPR). The CNIL thus distinguishes between an initial notification, to be made within 72 hours where possible, and a supplementary notification once further information is available. In its review of five years of the GDPR, it notes that waiting for experts’ final conclusions is one of the main causes of late notification.
If the investigation ultimately shows that no breach occurred, the organisation may inform the CNIL and ask for its notification to be amended accordingly. Notifying an incident that turns out not to be a breach does not give rise to any penalty (EDPB Guidelines, para. 60).
Content of the notification. The notification must at least:
describe the nature of the breach, including, where possible, the categories and approximate number of individuals concerned and the categories and approximate number of records concerned (Art. 33(3)(a) GDPR);
communicate the name and contact details of the data protection officer (DPO) or another contact point (Art. 33(3)(b) GDPR);
describe the likely consequences of the breach (Art. 33(3)(c) GDPR);
describe the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects (Art. 33(3)(d) GDPR).
How to notify. Notification is made online, through the CNIL’s personal data breach notification service. The CNIL provides a preparatory form that sets out the stages of the notification and allows the information to be gathered in advance. The service is reserved for controllers: individuals wishing to complain about a breach must use the online complaint service.
On receipt, the CNIL reviews the notification. It may close the file, in particular where the breach presents no risk or the individuals have been properly informed. It may also come back to the organisation with advice or questions, or even order it to inform the individuals concerned (Art. 58(2)(e) GDPR).
When the breach occurs at a service provider. The processor must notify the controller of any breach without undue delay after becoming aware of it (Art. 33(2) GDPR). It does not have to assess the risk first: that assessment is for the controller, which is in principle deemed to have become aware of the breach as soon as its service provider alerts it. Its own 72-hour deadline therefore runs from that alert (EDPB Guidelines, para. 44). Where the same incident affects several clients, the service provider must alert all of them (para. 47). The controller may entrust notification to its service provider, but remains responsible for it.
In a guidance note published in May 2026, the CNIL specifies that the unavailability of a service caused by a cyberattack at a service provider already constitutes, for its clients, an availability breach to be notified. Subsequent confirmation of a data leak then supplements the initial notification.
Joint controllers. Where several organisations jointly determine the purposes and means of the processing, their arrangement must specify which of them handles notifications (Art. 26(1) GDPR; EDPB Guidelines, para. 42).
Cross-border processing. Where the processing is cross-border, notification is addressed to the lead supervisory authority (Art. 56(1) GDPR), which is not necessarily the CNIL, even if individuals residing in France are affected.
3. Inform the individuals concerned
The principle. Where the breach is likely to result in a high risk to individuals’ rights and freedoms, the controller must also inform them without undue delay (Art. 34(1) GDPR). In case of doubt, the CNIL states that it can be consulted on whether such communication is appropriate. If it considers the risk to be high, it may require the individuals to be informed (Art. 34(4) GDPR).
Content of the communication. The communication describes in clear and plain language the nature of the breach. It contains at least the contact details of the DPO or another contact point, a description of the likely consequences of the breach and a description of the measures taken or proposed to address it (Art. 34(2) and 33(3)(b), (c) and (d) GDPR).
The CNIL recommends adding practical advice to help individuals protect themselves: changing their passwords, checking their account details, keeping their own backups. Where contact details have been exposed, it is also useful to warn them against phishing attempts that may exploit them.
The communication channel. The communication should take the form of a dedicated message, not a newsletter or routine message. A press release or a blog post is not enough: direct contact should be preferred (email, text message, letter, prominent banner on the website), or several channels combined. The organisation must also be wary of a channel compromised by the breach, which the attacker could use to impersonate it (EDPB Guidelines, paras 89 to 92).
Timing. Where there is an immediate risk, of identity theft for example, individuals may be informed even before the CNIL (EDPB Guidelines, para. 59). Conversely, communication may be delayed at the request of law enforcement authorities, so as not to hinder their investigation (Recital 88 GDPR).
Exceptions. Individual communication is not required in three cases:
the data had been rendered unintelligible to any unauthorised person, in particular by encryption whose key has not been compromised (Art. 34(3)(a) GDPR);
subsequent measures ensure that the high risk is no longer likely to materialise, for example resetting stolen passwords before they are used (Art. 34(3)(b) GDPR);
communication would involve disproportionate effort. It is then replaced by a public communication or similar measure informing individuals in an equally effective manner, such as a notice published on the organisation’s website (Art. 34(3)(c) GDPR).
4. Document every breach
The breach register. The controller must document any data breach, including those it has not notified. This documentation sets out the facts relating to the breach, its effects and the remedial action taken, and must enable the CNIL to verify compliance (Art. 33(5) GDPR).
According to the CNIL, the register should state in particular:
the nature of the breach;
the categories and approximate number of individuals and records concerned;
the likely consequences;
the measures taken or proposed;
where applicable, the reasons why the breach was not notified to the CNIL or to individuals.
The CNIL indicates that the summary of the online notification can serve as internal documentation.
The EDPB recommends also recording the reasoning behind each decision, in particular a decision not to notify (EDPB Guidelines, para. 125). The register may form part of the record of processing activities (Art. 30 GDPR), provided that breaches are clearly identifiable in it.
Prepare in advance. Documentation is prepared before the incident. An internal breach management procedure, identifying who must be alerted, the team in charge of the assessment and the decision-making chain, saves valuable time against the 72-hour deadline. Contracts with service providers should also provide for their assistance to the controller in meeting its security and breach obligations (Art. 28(3)(f) GDPR), as well as their duty to alert (Art. 33(2) GDPR).
5. Risks in case of non-compliance
Administrative fines. Breaches of the obligations relating to security (Art. 32 GDPR), notification (Art. 33 GDPR) and communication to individuals (Art. 34 GDPR) are subject to administrative fines of up to €10 million or, for an undertaking, up to 2% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 83(4)(a) GDPR). The CNIL states that it is stricter where negligence or an intention to conceal is evident.
The CNIL may also order the controller to communicate the breach to the individuals concerned (Art. 58(2)(e) GDPR). Its review may extend beyond the breach itself to the overall security of the processing.
A breach often reveals a security failure. In practice, a breach frequently leads the CNIL to examine the security measures in place before the incident (Art. 32 GDPR). In its review of five years of the GDPR, it notes that more than half of notified breaches result from hacking, led by ransomware and then phishing. It takes the opportunity to recall a few essential measures: building security into projects from the design stage, applying security updates regularly and training staff on cyber risks.
In the event of a cyberattack. The CNIL also advises filing a complaint with the police or gendarmerie and preserving the technical evidence useful to the investigation. Victims can obtain support from the French public service 17Cyber.
Data breach checklist
An internal breach management procedure exists, identifying who must be alerted and the decision-making chain.
Contracts with service providers provide for prompt alerts and assistance in the event of a breach (Art. 28(3)(f) and 33(2) GDPR).
As soon as the organisation becomes aware of the breach, or is alerted by its service provider, the start time of the 72-hour deadline is recorded (Art. 33(1) GDPR).
The incident is qualified: confidentiality, integrity or availability (Art. 4(12) GDPR).
The level of risk to individuals is assessed and reasoned.
Where there is a risk, the CNIL is notified within 72 hours, even with partial information, and the notification is then supplemented (Art. 33(1) and 33(4) GDPR).
Where there is a high risk, individuals are informed by a dedicated message, in clear terms, with advice on how to protect themselves (Art. 34(1) and 34(2) GDPR).
The breach is entered in the register, including where it is not notified (Art. 33(5) GDPR).
Corrective measures are implemented and documented (Art. 32 GDPR).
Sources
Regulation (EU) 2016/679 of 27 April 2016 (GDPR): Art. 4(12); Art. 26(1); Art. 28(3)(f); Art. 30; Art. 32; Art. 33(1) to (5); Art. 34(1) to (4); Art. 56(1); Art. 58(2)(e); Art. 83(4)(a); Recital 88
EDPB, Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0, 28 March 2023
Personal data breaches: review of five years of the GDPR, 27 March 2024 (CNIL)
Cyberattack: the processor at the centre of the crisis, 27 May 2026 (CNIL)
Engie confirms a data leak affecting customers in France, November 2026 (Cyber-securite.fr)
To go further and secure your practices against GDPR requirements, through our expertise we support you in managing data breaches, from qualification to notification, and in preventing personal data risks.