France’s data protection authority, the CNIL, has imposed ten penalties on local authorities and a public body for failings in the security of their information systems. Announced on 9 November, the fines range from €3,000 to €20,000, according to the CNIL’s press release. No two-factor authentication, unsupervised contractors, obsolete servers: the list of flaws serves as a roadmap for every town hall, département and region.
Ten penalties, names kept secret
The decisions were handed down under the simplified sanction procedure. As ZATAZ points out, €20,000 is the maximum amount provided for under this procedure. The press release does not name the entities concerned: the CNIL states only that they are municipalities, départements and regions, along with one public body.
The amount of each fine was set taking several criteria into account: the seriousness and number of the failings, the nature of the data at stake (information on minors or bank details), the local authority’s budget, the number of people affected and the efforts made to achieve compliance. These inspections are part of a priority theme chosen by the CNIL for 2025, the cybersecurity of local authorities, which also targeted their contractors. The authority says it will devote half of its inspections and enforcement procedures in 2026 to data security.
The flaws identified, one by one
Under Article 32 of the GDPR, which requires security appropriate to the risks, the CNIL found a series of recurring shortcomings:
- remote access, notably for teleworking, without strong authentication, and privileged administrators without multi-factor authentication;
- external contractors with permanent access to the network, without case-by-case authorisation, and in some cases using shared accounts;
- logging that was incomplete or reviewed too late to detect an anomaly;
- insufficient network segmentation, allowing an intrusion to spread from one segment to another;
- servers running operating systems no longer supported by their vendor;
- weak passwords, sent to users in plain text or poorly stored;
- the lack of the security accreditation that France’s general security framework (RGS) makes mandatory before certain systems go live, in particular those used to interact online with residents.
The CNIL also notes that several of these local authorities have already suffered data breaches which, in its view, could have been avoided with appropriate measures.
Family portals and CCTV without an impact assessment
A second complaint concerns the data protection impact assessment (DPIA), mandatory for high-risk processing under Article 35 of the GDPR and Article 90 of France’s Data Protection Act (loi Informatique et Libertés). Some local authorities had carried out none for their parent portals, which manage school and extracurricular activities and handle children’s data and bank details. Others had skipped it for CCTV on public roads, which the CNIL regards as systematic, large-scale monitoring of a publicly accessible area.
A very real threat, as in Chambourcy
These penalties come as attacks on municipalities are on the rise. Over the weekend of 7 and 8 November, the town hall of Chambourcy, in the Yvelines département, shut down its IT network as a precaution after a cyberattack, reports InfosYvelines. Staff are working largely on paper, which is lengthening processing times. The municipality has filed a complaint and informed the CNIL, without specifying the extent of the data affected or whether there was encryption or a ransom demand. The same outlet cites the 2025 activity report of Cybermalveillance.gouv.fr: 5,078 local authorities and administrations received assistance in 2025, a 22% jump year on year.
What this changes for local authorities and their contractors
Each local authority’s budget was taken into account when calculating the fine, but it did not spare them the penalty. Other procedures are under way and could result, according to the CNIL, in fines, formal notices or reminders of their obligations. Software vendors and managed service providers are directly concerned: permanent, uncontrolled access by contractors is among the grievances. Finally, the CNIL links this initiative to the transposition of the NIS 2 directive, still in progress, which will impose new security requirements on local authorities.
Frequently asked questions
Which local authorities were penalised by the CNIL?
Their names were not disclosed with the announcement of 9 November. The CNIL states only that they are municipalities, départements, regions and one public body.
Why do the fines not exceed €20,000?
That is the legal ceiling for the simplified sanction procedure. Under this procedure, the amount also depends on the local authority’s budget and its efforts to achieve compliance.
What measures should a town hall prioritise?
Require multi-factor authentication for administrators and remote access, supervise every intervention by contractors, replace unsupported systems, make use of logs and carry out a DPIA before launching a family portal or a CCTV system.
Sources
- Cybersecurity of local authorities: the CNIL imposes ten penalties — CNIL, 2026-11-09
- Cybersecurity: the CNIL penalises ten local authorities — ZATAZ, 2026-11-09
- Cyberattack in Chambourcy: town hall paralysed, forced back to pen and paper — InfosYvelines, 2026-11-10