Why is the CNIL writing to you, and what does it mean?
When a complaint is lodged with it, the CNIL is required to handle it and to inform the complainant of the progress and outcome of the proceedings, unless it can show that the complaint is manifestly unfounded or excessive. The letter sent to the company is part of this investigation: it does not mean that a breach has necessarily been established at this stage.
Nor does it mark the opening of sanction proceedings: these require the appointment of a rapporteur and referral to the restricted committee, or to its chair under the simplified procedure (Articles 22 and 22-1 of the French Data Protection Act).
Do you have to respond, and within what time limit?
The response deadline is stated in the CNIL’s letter. In practice, it is generally between 15 days and one month. Where this deadline cannot be met, it is advisable to request an extension before it expires, stating the reasons for the request and the date by which a response can be provided.
The company is required to cooperate with the CNIL and to respond to its requests for information. A failure to cooperate may constitute a sanctionable breach. In 2023, failure to cooperate was the main breach found under the simplified procedure: 15 organisations were sanctioned for failing to respond to the CNIL’s requests. Since January 2026, 4 of the 8 simplified sanctions relating to complainants’ rights have also involved a failure to cooperate.
How should you prepare your response to the CNIL’s letter?
As long as no inspection has been initiated, the CNIL relies essentially on the complaint and on the company’s response to decide what action to take. Preparing this response calls for three precautions.
1. Do not call the complainant personally into question
The response concerns the processing, not the complainant or their intentions. The complainant’s motives are not, in themselves, sufficient to call into question the exercise of their rights. As a rule, the complainant’s identity is not disclosed to the company, unless it is essential to the handling of the complaint.
2. Check the facts with the operational teams
Before responding, the company should establish what actually happened with the teams concerned: customer service, human resources, marketing, IT teams or, where applicable, the service provider. An inaccurate response, later contradicted by an inspection, costs the company its credibility for the rest of the case.
3. Identify and correct any structural failures
The checks may reveal a failure that is structural rather than isolated. Where a breach is identified, the measures needed to remedy it should be taken without waiting for the CNIL’s position. Remedying a breach does not erase a past breach. However, the corrective measures and the company’s cooperation are taken into account by the CNIL when it decides what action to take on the complaint.
What can the outcome of the complaint be?
The CNIL has broad discretion in deciding what action to take on a complaint. It takes into account, in particular, the seriousness of the facts, the evidence supporting them and their context (number of people concerned, sensitivity of the data, etc.).
In light of the information gathered, the CNIL may, among other things:
- close the complaint, where appropriate with observations addressed to the company;
- remind the company of its legal obligations or serve it with a formal notice;
- carry out an on-site, documentary, hearing-based or online inspection;
- initiate sanction proceedings, under the ordinary or the simplified procedure.
The simplified procedure is reserved for cases that raise no particular legal difficulty. The fine may not exceed €20,000, or €100,000 where the company’s worldwide annual turnover for the previous financial year exceeds €50 million, and the decision is not made public. Under the ordinary procedure, the restricted committee may decide to make its decision public.
In its last two reviews of the simplified sanction procedure, the CNIL states that 14 of the 16 sanctions imposed between May and October 2025, and then 19 of the 23 sanctions imposed since January 2026, originated from complaints. They concern in particular video surveillance, direct marketing, cookies, failure to comply with rights of access or erasure, and failure to cooperate with the CNIL.
How does Odoné support you with a CNIL complaint?
The firm supports companies at every stage of the CNIL’s investigation of a complaint:
- Analysis of the complaint and the associated risks: review of the grievances, assessment of the legal risks and of the possible outcomes of the proceedings.
- Defining a response strategy: preparation of a reasoned and documented response that takes account of the specific issues at stake.
- Follow-up of the investigation: support in exchanges with the CNIL and with any further requests.
