Cybersecurity Policy Report, Priorities for 2026 Outlined by French Privacy Agency, (Apr 7, 2026)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), identified several priorities that it will emphasize in its 2026 audit activity in a press release last week, including implementation of its guide on data processing in recruitment, monitoring the use of the country’s single electoral register, and data processing by sports federations.

Recruitment guide. CNIL published a guide in 2023 designed to assist recruiters collecting and using candidates’ personal data, and its 2026 initiative will verify whether recruiters are complying with requirements of the European Union’s General Data Protection Regulation (GDPR). Audits will focus on key elements of the guide, including automated decision-making systems, informing candidates, and data retention periods. CNIL plans to target large companies and recruitment firms, and the agency’s work in this area will foreshadow the exercise of its future powers as a market surveillance authority under the EU AI (Artificial Intelligence) Act.

Single electoral register. CNIL said the “single electoral register” was a file held by the National Institute of Statistics and Economic Studies (INSEE) allowing for the control and management of electoral lists, among other functions. The agency will conduct checks over the course of the year to verify the uses of the file, which contains all voter data in the country, and identify any misuse.

Sports federations. After a surge in memberships following the Paris Olympics and Paralympics in 2024, sports clubs have processed a large volume of data, including health information and data related to the commission of offenses, concerning a significant number of minors. CNIL has published several educational resources (available for download from the press release) for these organizations, and plans to monitor their proper implementation, focused on verifying the relevance of the data collected, retention periods, and security.

Coordinated enforcement effort. CNIL also said it would conduct checks on the transparency and completeness of the information provided to data subjects as part of its participation in the coordinated enforcement effort launched earlier this year by the European Data Protection Board (CPR, March 12). The action aims to harmonize the effective application of the GDPR and coordination between supervisory authorities, and CNIL will coordinate with the EDPB, culminating in a report presenting the results, identifying difficulties encountered, best practices observed, and avenues for improvement.

News: InternationalLegislation DataPrivacy DataSecurity GDPR