On 3 September 2026, the French data protection authority (CNIL) imposed a fine of EUR 500,000 on the Hôpital Privé de la Loire. The decision identifies two specific technical failings: the absence of multi-factor authentication on systems holding health data, and insufficient access controls. For 727,000 people concerned, including 524,000 patients, medical data circulated in an environment whose basic safeguards were not in place. The decision is instructive well beyond the healthcare sector.
What the CNIL found
The initial breach dates back to summer 2025. The CNIL's investigation established that the hospital had not deployed MFA on access to systems processing health data, and that its management of authorisations left active accounts without any business justification. These two failings are documented in deliberation No. SAN-2026-012, published on 3 September 2026 (CNIL, restricted committee deliberation, 3 September 2026). The authority concluded that Article 32 of the GDPR had been breached, which requires the implementation of appropriate technical measures taking into account the risks presented by the processing.
Two elements of this decision deserve your attention. First, the CNIL does not sanction the existence of a breach: it sanctions the insufficiency of preventive measures. The breach is evidence that those measures were lacking, not the cause of the sanction. Second, the amount set takes into account the establishment's turnover and the sensitive nature of the data concerned. For a larger organisation processing comparable volumes, the financial exposure would be proportionally higher.
What Article 32 concretely requires
Article 32 of the GDPR does not impose a closed list of measures. It applies a risk-based approach: measures must be appropriate in light of the state of the art, the cost of implementation, the nature of the data and the risks identified. The CNIL interpreted this article as indicating that the absence of MFA on systems containing health data cannot be considered an appropriate measure in 2025-2026, given the maturity of this technology and its now marginal cost.
This precedent has a general scope. If the CNIL considers MFA mandatory in the healthcare sector, the same logic will apply to any high-risk processing: financial data, HR data, customer data at volume. The argument that MFA represents an excessive constraint for your users will not be an admissible defence in a context where millions of professional accounts already benefit from it without any notable friction.
Access management: the failing that is easiest to document
The second failing, insufficient access controls, is often the hardest to defend in front of an auditor. Orphaned accounts, overly broad default permissions, and access maintained after an employee has left: these flaws can be documented by any inventory tool. Their existence within a scope subject to Article 32 GDPR indicates that the periodic access review programme is absent or inactive. The CNIL can identify this in system logs well before any formal proceedings are opened.
The access control requirements under NIS2 and DORA converge on the same practices. If your organisation has already conducted an IAM project under these two directives, the foundations for meeting Article 32 GDPR are probably in place. What is often missing is traceability: reviews must be documented, dated and assigned to an identifiable owner. The article on IAM access control under NIS2/DORA details the points that auditors check first during an inspection.
Three questions to ask before the end of the month
Is MFA active on all access to systems containing high-risk data? Include service accounts, administrator access and remote access. The absence of MFA on a single privileged account is enough to constitute a clear breach.
Is your authorisation register up to date? An annual review is insufficient if your headcount or your suppliers change frequently. The expected practice is a review at least quarterly, with automatic triggering at every departure or change of role.
Is the chain of responsibility documented? Article 32 requires not only that measures be implemented, but that their adequacy can be demonstrated. If you cannot produce the list of measures in place, their deployment date and the results of the last access review, you are not in a position to respond to a CNIL investigation.
What this precedent changes for your programme
The CNIL's sanction decisions now publish the technical measures considered insufficient. This transparency has an indirect effect: it sets, by implication, the minimum level expected. The absence of MFA on sensitive data is now documented as insufficient. Access controls that are not reviewed are likewise. These two points can no longer be treated as adjustments to schedule: they constitute active sanction risks, identifiable at any time.
Your organisation's GDPR compliance programme should integrate these precedents into its risk assessment. Not as a checklist to tick off, but as indicators of what the CNIL considers the non-negotiable baseline of Article 32. This baseline rises as available tools improve and their costs fall. What was acceptable in 2020 is no longer acceptable in 2026. Decision SAN-2026-012 sets a new limit.