Cybersecurity Policy Report, Recommendations for DPOs’ Activity Reports Offered in France, (Apr 28, 2026)

By Tony Foley

Asserting that activity reports written by data protection officers (DPOs) contribute to compliance management and allow DPOs to report their activities to an organization’s management, the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has offered recommendations concerning the development of reports and proposed a model for DPOs to use in drafting and submitting them.

CNIL said in a press release yesterday that, while an activity report was not required, it fit naturally within the scope of a DPO’s mission by making it possible to report to the highest level of management. An activity report also makes it possible to assess and monitor the level of maturity of the organization’s data protection plan over time and can be used both internally and externally to communicate on compliance issues.

CNIL specifies that activity reports are intended to make diagnoses on an organization’s main processing operations, assess the risk of such processing at the legal, financial, and reputational levels, document steps to comply with regulations, promote the adoption of data protection practices, and identify obstacles and define measures to be implemented to improve the level of personal data protection. Once developed, an activity report allows organizations to ask themselves whether priority actions have been carried out, which treatments or projects require special attention, and whether technical and organizational measures implemented by an organization are adapted to the challenges of processing.

CNIL points out that the European Union’s General Data Protection Regulation (GDPR) requires DPOs to report to the highest level of management and said an activity report made it possible, at least once a year, for DPOs to present a complete overview of their activities. Accordingly, organizations can ask a DPO to produce an activity report without undermining the DPOs independence. CNIL recommends that DPOs make a formal presentation of an activity report at a meeting, creating a privileged moment between the DPO and the organization to discuss compliance levels.

CNIL also said an activity report could serve as an awareness-raising tool for employees and their representative bodies, strengthening the visibility of the DPO and highlighting actions carried out and those to be pursued. Key elements of a report should be shared to show progress made and to offer a time for collective exchanges on associated issues, it said.

With respect to developing an activity report, CNIL noted that DPOs had a great deal of freedom regarding their preparation and their form, structure, and content. The agency offered several best practices for consideration, including looking at the report as a “living” document developed over time, relying on CNIL’s tool to monitor the maturity of an organization’s data protection. The agency also provides an activity report template, which may be downloaded from the release but is available only in French, that organizations may adapt to their needs.

News: InternationalLegislation DataPrivacy DataSecurity GDPR