Forty-five per cent of French people received at least one data breach notification in 2026: this is the statistic published by Cybermalveillance.gouv.fr at the launch of Cybermois on 1 October (source: Cybermalveillance.gouv.fr press release, 1 October 2026). In 2025, the figure was 30%. In twelve months, individual breach notification has moved from an administrative exception to a mass practice. What your recipients now know changes the real nature of your obligation.
Article 33 and Article 34: two regimes that organisations confuse
Most GDPR programmes have built breach notification around Article 33: reporting the incident to the competent authority within 72 hours. This obligation is well known, documented, and often run through a formalised process.
Article 34 follows a different logic. It does not address the authority: it requires the organisation to contact the data subjects directly as soon as a breach is "likely to result in a high risk to their rights and freedoms". The two obligations coexist. Notifying the CNIL does not exempt you from notifying data subjects when the risk requires it.
In practice, many organisations handle Article 33 with care and treat Article 34 as a secondary formality. When the individual notification goes out, it often arrives late and does not tell data subjects what they need to do.
What the CNIL-Cybermalveillance guide reveals
On 1 October 2026, the CNIL and Cybermalveillance.gouv.fr published a practical resource titled "Personal data breach: what to do in 3 key steps?". This document, presented as a checklist, details the reflexes to adopt from the day of discovery to D+30.
This guide is not intended for your compliance teams. It is intended for your customers. By providing a structured reference framework, the CNIL creates an informal benchmark for judging the quality of your own notifications. Among the people who received a notification, 59% say they have become more vigilant against phishing attempts, 53% changed their passwords, and 44% increased monitoring of their bank accounts (source: Cybermalveillance.gouv.fr, press release, 1 October 2026). These people now know what a good notification should trigger for them. They will know whether your message enabled them to act.
The three most frequent gaps
By contrast, the guide highlights the typical weaknesses of institutional notifications.
No ranking of the data exposed. The guide explicitly distinguishes the types of compromised data according to their level of risk: an IBAN, a password, an email address or a phone number do not call for the same actions. Most organisational notification templates treat all cases with a single message.
No timeline. The guide structures actions from D0 to D+30. A notification that only describes what happened does not tell data subjects what they must do within 48 hours, or in three weeks.
Lack of actionable content. Article 34 requires the notification to describe "the measures taken or proposed" and the likely consequences. The contact details of the data protection officer must be included. Few organisational notifications reach this level of precision.
What the Free Mobile fine illustrates
In January 2026, the CNIL imposed two penalties on Free Mobile and Free for a total of 42 million euros (source: CNIL, decision SAN-2026-004, 14 January 2026). The incident had exposed the data of 24 million contracts, including IBANs.
The investigation identified several GDPR breaches. One concerned breach notification: the CNIL found that the data subjects had not received the information they needed to protect themselves effectively. It was not only the decision to notify or not that was sanctioned: it was the content and adequacy of the notification.
This precedent shows that your legal department may have ticked the Article 33 boxes flawlessly while leaving an Article 34 risk open.
Four measures to align your process
Map your data by level of risk in the event of a breach. For each type of data you process, set a risk threshold: email address alone, phone number, IBAN, health data, identity data with a document. This table will be the input of your Article 33 and Article 34 processes.
Write templates by risk category. One template for breaches at moderate risk, another for breaches at high risk. Each must include: a precise description of what was exposed, probable risks depending on the type of data, recommended immediate actions, the DPO's contact details, and a follow-up horizon.
Structure communication over time. A single notification on D0 is not sufficient for high-risk breaches. A reminder on D+7 about the actions still available, and an update on D+30 about the measures taken on the organisation's side: this sequence reduces individual complaints and documents your good faith before the CNIL.
Test your templates against the CNIL guide. Re-read your current notifications and ask yourself: if you were the recipient of this message, would you know what to do in the following 30 days? If the answer is uncertain, the template needs revising.
Notification is not a formality
The rise from 30% to 45% in one year is not a publicity effect. It reflects the growing load of notification obligations as GDPR, NIS2 and the Cyber Resilience Act multiply the triggers. The people who receive your next breach notification have already been through this process elsewhere. They will compare.
To understand how the CRA, NIS2 and GDPR fit together in notifying authorities, read our analysis of the three notification regimes triggered by a single incident.