The breach announced on August 14, 2026, at France's Direction générale des Finances publiques (DGFiP) exposed fiscal and cadastral data, including reference income, withholding rates, family quotient, property addresses, and SIREN numbers. While no credentials were compromised, the extraction of structured financial records poses a phishing risk. The Ministry of Economy and Finance notified CNIL and will contact affected individuals directly.
If you're managing privacy response for a public-sector agency, a regulated enterprise, or any organization holding structured financial or identity data, this incident clarifies the decision tree you'll face when your notification obligation triggers. The path you choose depends on three factors: breach scope, credential exposure, and your statutory notification timeline.
The Decision You're Facing
When you confirm unauthorized access to personal data, you must decide:
- Do you notify the supervisory authority immediately, or wait to complete your internal assessment?
- Do you notify affected individuals in parallel, or wait for the authority's guidance?
- Do you accept individual complaints, or ask data subjects to defer until your investigation concludes?
The DGFiP case demonstrates the third option: CNIL announced it had been notified and explicitly stated that individual complaints were unnecessary unless data subjects had specific evidence relevant to the investigation. This approach reflects a coordinated response between the data controller and the regulator, designed to prevent complaint duplication and efficiently channel investigative resources.
Key Factors That Affect Your Choice
Credential exposure. If login credentials were compromised, immediate individual notification is essential. Users must reset passwords and enable multi-factor authentication before attackers exploit access. The DGFiP breach did not involve credentials, which gave the Ministry room to sequence notifications without creating immediate account-takeover risk.
Data type and phishing potential. Fiscal data, such as reference income and property addresses, enables targeted phishing. Attackers can impersonate tax authorities with credible detail. This elevates the notification priority even when credentials are safe, because the extracted data itself becomes an attack vector.
Regulatory relationship and notification timing. Under GDPR Article 33, you have 72 hours to notify your supervisory authority. Individual notification under Article 34 is required when the breach is "likely to result in a high risk to the rights and freedoms of natural persons." If you notify CNIL within 72 hours and coordinate messaging, the regulator may publicly confirm receipt and guide individuals on next steps, reducing redundant complaints during your investigation window.
Investigation complexity. If the breach involves multiple systems, third-party processors, or unclear exfiltration scope, you need time to map what was accessed. Premature individual notification with incomplete facts can trigger panic and a flood of inquiries that slow your forensic work. The coordinated approach lets you complete the technical assessment while the regulator manages public communication.
Path A: Notify the Authority First, Coordinate Individual Outreach
Choose this path when:
- The breach does not involve credentials or immediate account-takeover risk.
- You can meet the 72-hour Article 33 deadline with preliminary findings.
- The regulator has capacity to issue public guidance and manage inbound complaints.
- You need 7-14 days to complete forensic analysis and determine full scope.
- The affected population is large enough that uncoordinated notification would overwhelm your support channels.
What this looks like in practice:
You file the Article 33 notification to CNIL within 72 hours, disclosing the data categories accessed, the likely number of affected individuals, and the measures you've taken to contain the breach. You coordinate with the regulator to issue a public statement confirming the notification and advising data subjects that individual outreach is coming. You complete your investigation, finalize the list of affected individuals, and send personalized notifications with specific guidance on phishing vigilance and monitoring steps.
The DGFiP response followed this path. CNIL confirmed receipt and told the public that individual complaints were unnecessary unless data subjects had specific evidence. The Ministry committed to individual notification after the investigation progressed.
Path B: Notify Individuals and the Authority in Parallel
Choose this path when:
- Credentials, payment details, or health data were accessed.
- The breach creates immediate fraud or identity-theft risk.
- You have a complete list of affected individuals within 72 hours.
- Your CRM and notification infrastructure can handle the volume without delay.
- Regulatory guidance is unclear or the authority has not established a public coordination process.
What this looks like in practice:
You notify CNIL within 72 hours and simultaneously send individual notifications to all affected data subjects. The notification includes the data categories accessed, the likely consequences, the measures you've taken, and the specific actions individuals should take (password reset, credit monitoring, phishing awareness). You establish a dedicated support channel to handle inquiries and log any evidence of misuse.
This path is mandatory when Article 34 applies, when the breach is likely to result in high risk and you cannot demonstrate that you've implemented safeguards (encryption, pseudonymization) that render the data unintelligible to unauthorized parties.
Path C: Delay Individual Notification Pending Technical Safeguards Assessment
Choose this path when:
- The accessed data was encrypted or pseudonymized.
- You can demonstrate that the safeguards make the data unintelligible to the attacker.
- The regulator agrees that individual notification is not required under Article 34(3)(a).
- You've documented the encryption method, key management, and access logs.
What this looks like in practice:
You notify CNIL within 72 hours and explain that the accessed data was protected by AES-256 encryption with keys stored in a separate, uncompromised environment. You provide evidence that the attacker did not access the decryption keys. CNIL reviews your safeguard documentation and agrees that individual notification is not required because the data remains unintelligible. You monitor for signs of key compromise and prepare contingency notifications in case the safeguard assessment changes.
This path is rare and requires strong technical evidence. If you cannot prove that the safeguard held, default to Path B.
Summary Matrix
| Factor | Path A (Authority First) | Path B (Parallel) | Path C (Safeguard Delay) |
|---|---|---|---|
| Credential exposure | No | Yes | No |
| Immediate fraud risk | Low to moderate | High | Negligible |
| Investigation timeline | 7-14 days needed | Complete within 72 hours | Safeguard verification pending |
| Regulatory coordination | Established | Limited or none | Strong technical review |
| Article 34 obligation | Deferred pending scope | Immediate | Exempted under 34(3)(a) |
| Individual notification timing | After investigation | Within 72 hours | Not required if safeguard holds |
The DGFiP breach demonstrates that Path A works when you have regulatory trust, no credential exposure, and a clear phishing-awareness message. If your breach involves login access or payment data, notify everyone immediately, and document every step under GDPR Article 5(2). CNIL may conduct on-site investigations to verify that your security measures met the state of the art, and any gap between your technical posture and your notification timeline becomes evidence in an enforcement proceeding.
