Notifications to the CNIL of personal data breaches

The General Data Protection Regulation (GDPR) has made it mandatory **notification to the CNIL of any personal data breach causing a risk to the rights and freedoms of data subjects**. A data breach is _“a security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of personal data transmitted, stored or otherwise processed, or unauthorised access to such data”_. This notification to the CNIL must be made within 72 hours, by the body responsible for processing or by its representative. To learn more about data breaches and the follow-up given by the CNIL to notifications: https://www.cnil.fr/fr/notifier-une-violation-de-donnees-personnelles ** Warning 1:** The data published are those transmitted to the CNIL as part of the notifications (excluding those received within three months prior to the production of the data sets for reasons of confidentiality of files being processed or recently processed). They may not reflect the Commission’s assessment of the situation described. ** Warning 2:** Each notification in the dataset corresponds to a specific case, which may have led to several subsequent exchanges with the organisation concerned or its representative.