GDPR
GDPR · General Data Protection Regulation · Regulation (EU) 2016/679 · personal data · personal data breach · RGPD
The EU regulation, applicable since 25 May 2018, that governs the use of personal data and requires every organisation to protect it with security measures appropriate to the risk.
In practice
For cybersecurity, three articles matter. Article 32 requires technical and organisational measures appropriate to the risk and mentions encryption, pseudonymisation, the ability to restore data and regular testing. Article 33 requires a personal data breach to be notified to the supervisory authority (the CNIL in France) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people, and Article 34 requires the people affected to be informed when the risk is high; every breach must also be recorded in an internal register. Fines reach €10 million or 2% of annual worldwide turnover for security failings, and €20 million or 4% for breaches of the principles or of people’s rights, whichever amount is higher.
Real case: on 13 January 2026, the CNIL fined Free Mobile (€27 million) and Free (€15 million), €42 million in total, after an intrusion exposed data linked to 24 million subscriber contracts, in particular for inadequate security measures (Article 32).
How to protect yourself
- Keep your record of processing activities and your breach register up to date.
- Prepare and test a 72-hour notification procedure.
- Encrypt sensitive data and limit how long you keep it.
