← Lois sur la protection des données et la cybercriminalité par pays
France : protection des données, cybercriminalité, amendes et peines
The CNIL is one of the EU's most active authorities, with nine-figure cookie and adtech fines and recent breach sanctions.
- Law
- GDPR + Code pénal (art. 323-1 et seq.)
- Authority
- CNIL
- Max fine
- €20M or 4% (GDPR); e.g. Google €325M (2025)
- Breach notification
- 72h (GDPR)
- DPO
- Mandatory in GDPR art. 37 cases
Crimes
| Fraudulent access to an automated data system (STAD) | Art. 323-1 Code pénal | Up to 3 years + €100k; 5 to 7 years with damage or state systems |
| Escroquerie (fraud) | Art. 313-1 Code pénal | Up to 5 years |
| Extortion | Art. 312-1 Code pénal | — |
| Identity theft | Art. 226-4-1 Code pénal | — |
Risks
- Cookies and adtech (Google €325M, SHEIN €150M in 2025)
- Breaches exposing bank data (Free and Free Mobile, €42M, Jan 2026)
- Poorly protected health data (IQVIA, €5M, May 2026)
- Employee monitoring (Amazon France Logistique, €32M)
Source: Légifrance – Code pénal · GDPR Local – Top 2026 · GDPR Local – maiores multas