On 8 October 2026, the French data protection authority (CNIL) published the closure of the order issued against France Travail. Its deliberation of 23 September 2026 ends the formal notice of 22 January 2026. No penalty payment was enforced: the body had put in place the four measures required. This decision is not insignificant. It documents, for the first time in such detail, the measures the CNIL considers necessary and sufficient to meet the security obligations of Article 32 GDPR following a very large-scale data breach.
The breach, the sanction, the order
In March 2024, attackers accessed France Travail's systems through social engineering, targeting accounts used by staff of Cap emploi, a partner organisation. The exposed data includes names, dates of birth, social security numbers, email and postal addresses, and telephone numbers. After checks and de-duplication, France Travail confirmed 36.8 million people concerned: one of the largest personal data breaches ever recorded in France (source: France Travail disclosure, 2024).
On 22 January 2026, the CNIL's restricted committee imposed a fine of EUR 5 million. It also attached to the decision an order covering four specific points, with a conditional penalty of EUR 5,000 per day in the event of non-compliance within the set deadline. The legal basis: Article 32 of the GDPR, which requires controllers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (source: CNIL deliberation SAN-2026-003, 22 January 2026).
The CNIL noted in its decision that most of the appropriate measures had been identified by France Travail in its data protection impact assessments, without ever having been effectively implemented. The organisation knew what it should have done. It had not done it.
The four measures: a benchmark for your security programme
The four points of the order constitute a rare operational benchmark: the CNIL explicitly documents what was missing, and its acceptance of compliance documents what is sufficient to address it.
1. Robust password policy. The measure concerns the strength of passwords used on the systems concerned. France Travail had to put in place a policy requiring passwords of sufficient length and complexity, backed by mechanisms that restrict access to accounts after failed attempts. This measure applies to internal accounts as well as to the accounts of partners accessing the systems, in this case Cap emploi.
2. Multi-factor authentication for partner advisers. The order specifically targeted Cap emploi advisers accessing France Travail's systems. A partner's access to your information system is a distinct attack surface, subject to the same security obligations as internal access. Partner accounts not protected by MFA represent a documented entry vector: exactly the one used in this attack. You will find a detailed analysis of the access control gaps that NIS2 and DORA flag as audit priorities.
3. Log supervision of the MAP tool. MAP is the internal tool France Travail uses to manage jobseekers' files. The order required effective supervision of this tool's activity logs. Without log supervision, a data exfiltration can continue for weeks without triggering any alert. The late detection of the France Travail incident illustrates exactly this risk.
4. Limiting authorisations to the data strictly necessary. The principle of access minimisation requires that each user, internal or partner, access only the data strictly necessary for their mission. France Travail had to review its access rights to apply this principle to all accounts concerned by the order. This measure is directly linked to the scale of the breach: 36.8 million records accessible from accounts whose rights had not been restricted.
What the CNIL implicitly says about Article 32 GDPR
The CNIL did not invent these four measures. It drew them from the impact assessments that France Travail had itself produced. This is where the most important lesson lies: the failure was not the absence of a risk analysis. It was the absence of implementation of what that analysis prescribed.
Article 32 GDPR requires measures that are "appropriate" to the risk. The CNIL specifies here what it means by appropriate for an organisation processing data at very large scale: a robust password policy with account lockout, MFA on high-risk access, log supervision, and the principle of least privilege applied. These four measures are not good-practice recommendations. According to the deliberation, they are the minimum requirements in this context.
None of these measures is technically complex. Each has appeared for years in ANSSI (France's national cybersecurity agency) guidance, in ISO 27001 controls and in NIS2 requirements. What France Travail lacked was not knowledge: it was the mechanism for turning a risk analysis into operational measures that are deployed and verified.
Three questions to ask your security programme
Do your impact assessments produce deployed measures or archived documents? A DPIA that identifies a risk without generating a dated, assigned and verified action plan reproduces exactly the situation France Travail was in before the incident. The document exists. The measure does not.
Do your partners' accounts benefit from the same controls as internal accounts? In most organisations, partner access is managed with less rigour than internal access. Yet both share the same information system. The entry vector of the France Travail attack, social engineering on a Cap emploi account, can be reproduced in any organisation whose partners have access not protected by MFA.
Does your log supervision cover the tools that access sensitive data at scale? HR management systems, CRM tools, beneficiary management platforms: each accesses large volumes of personal data, and insufficient supervision delays the detection of an exfiltration by several weeks. The detection delay is directly correlated with the scope of the data exfiltrated.
Compliance that cannot be verified does not count
The closure of the France Travail order marks the end of an administrative procedure. It does not mark the end of the risk. The 36.8 million social security numbers exposed in 2024 still circulate in criminal databases. The organisation has put the required measures in place. It could have done so two years earlier, before the incident.
For your organisation, the question is not whether your risk analyses identify the right controls. It is whether those controls are actually deployed, verified and maintained. The CNIL does not sanction the absence of documentation. It sanctions the absence of implementation. The difference between the two is measured, in this case, in EUR 5 million and 36.8 million people concerned.