A CNIL inspection does not necessarily lead to a sanction procedure. In 2025, the CNIL carried out 323 inspections and imposed 83 sanctions: nearly one in four inspections resulted in a sanction.
Above all, it is the substance of the case that determines the outcome of the inspection. However, certain mistakes made by the organisation under inspection can unnecessarily increase the risk of a sanction.
Below, we examine each of these common mistakes and outline the best practices for avoiding them.
1. Responding without all necessary information
When facing auditors, some employees feel compelled to provide an immediate answer even though they do not have a full grasp of the subject or all the necessary information. They then put forward assumptions that are subsequently recorded as facts.
For example, an employee might answer a question by describing their own way of doing things, without specifying that it is an individual practice. The auditors might then interpret this as reflecting the company's practices as a whole, even though internal procedures exist and are applied by other teams.
When verification is needed, it is preferable to state so rather than respond on the basis of incomplete information. At the end of the audit operations, the delegation usually draws up a list of additional items required, which must be submitted within the timeframe specified in the official report — typically eight or fifteen days.
The report is not intended to transcribe exchanges verbatim, nor to attribute each statement to a specific speaker. It outlines the inspection proceedings and the understanding the delegation gained from its discussions with the audited entity.
2. Volunteering information beyond the questions asked
Inspections are generally conducted by a small delegation, often comprising a legal expert and an IT systems auditor. This format encourages direct and informal discussions, where participants may sometimes go beyond the questions asked or spontaneously raise matters not addressed by the delegation.
For example, a manager might spontaneously explain that certain security measures have not yet been deployed due to insufficient budget or resources, whilst noting that a remediation project is planned. This explanation, intended to show awareness of the issue, may nonetheless be interpreted as an acknowledgement of an existing breach.
Statements collected during the inspection are not sufficient, on their own, to establish a breach. They do, however, guide the delegation's checks and help to interpret findings made in the organisation's systems, which are subsequently recorded in the report.
3. Providing unsolicited documents
Some companies spontaneously submit documents to the CNIL that have not been requested, such as internal audits, risk analyses, or legal opinions.
This approach often stems from a desire to demonstrate that certain areas of concern have been identified and are already the subject of an action plan.
It may, however, lead to the disclosure of issues that had not been identified during the inspection, or to the submission of documents covered by legal professional privilege.
Cooperating with the CNIL does not mean submitting more than what is requested.
4. Self-qualifying a situation as non-compliant
Statements such as:
“We have a data retention policy, but it is not being applied.”
are sometimes raised during inspections.
The organisation's role is to set out the facts. It has no interest in characterising the situation in legal terms itself, or in spontaneously admitting the existence of a breach.
5. Treating the case as closed once the inspection has ended
The departure of the inspection team does not mark the end of the case.
Several weeks — or even months — generally elapse between the inspection and the CNIL's decision on next steps. During this period, the inspection and sanctions departments analyse the report and documents submitted, assess potential breaches and formulate a proposal for follow-up action, on which the Chair of the CNIL rules.
This phase, often overlooked by audited entities, should not be considered as a mere waiting period.
The organisation can still usefully supplement the file by providing context for the findings made during the inspection: further details on how a processing activity operates, documents correcting a misunderstanding, or evidence that the scope of a practice is more limited than was initially understood.
This is also the time to inform the CNIL of any corrective measures initiated or implemented following the inspection. Without questioning any breaches identified, these steps may be taken into account when assessing the follow-up actions for the case.
6. Remedying a breach without notifying the CNIL
When a breach is identified, the priority is to remedy it as promptly as possible.
However, it is equally important to be able to demonstrate the measures implemented and to communicate them to the CNIL without delay. Failing to do so means they cannot be taken into account when assessing the outcome of the case.
Remediation does not erase past breaches, nor does it preclude a potential sanction. It is, however, a factor the CNIL may take into consideration when determining how to follow up on the inspection.
