Cybersecurity Policy Report, Recommendations for Data Breach Prevention Offered in France, (Jan 28, 2025)

By Tony Foley

The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), published guidance today on appropriate measures that controllers can take to prevent large magnitude breaches of personal information.

CNIL was notified of more than 5,600 breaches in 2024, an increase of 20% over the previous year, and the number of breaches involving more than a million people doubled over the same time frame, it said in a news release.

As a result, CNIL has made cybersecurity one of the four planks of its 2025-2028 strategic plan. The agency plans to support organizations by producing recommendations to protect personal data, checking on organizations to assess their compliance with the implementation of security measures, and raising awareness among individuals about cybersecurity to make them more likely to actively protect their data.

The release also references CNIL’s personal data security guide, which may be accessed from the release but is available only in French. CNIL noted that incidents in 2024 involving large database processing indicated the need for enhanced security measures in light of the risk, including perimeter security measures. In addition, based on breach reports received, CNIL found that attackers’ methods often exploited the same vulnerabilities, including obtaining access to login data of employees or partners, exploiting security holes in firewalls or VPN gateways, and overly broad access authorizations allowing attackers to access large volumes of data, including data extractions in bulk.

CNIL recommends several potential strategies to combat these vulnerabilities, including multifactor authentication, employee training, limits on network access to authenticated devices, implementation of an authorization policy and effective data partitioning from the front end to the back end, and real-time analysis of network flows and logs, among others.

News: InternationalLegislation DataSecurity DataBreach