Local authorities: the CNIL intensifies its GDPR controls in 2025 – What you need to know

The role of the CNIL and its official publications

The National Commission for Information Technology and Liberties (CNIL) is the independent administrative authority responsible for ensuring respect for rights and freedoms in matters of personal data. It supports, regulates, controls and sanctions public and private actors within the framework of the General Data Protection Regulation (GDPR).

Each year, the CNIL publishes several major documents:

• The annual report, which takes stock of control actions, sanctions, regulatory and technological developments;
• The control program, published in the form of a press release, which sets the priority control themes for the year;
• The multi-year strategic plan, which sets out the main medium-term orientations;
• Press releases relating to sanctions, recommendations, tools and practical guides for data controllers.

These publications constitute references for public actors, in particular local authorities, which are regularly targeted by controls.

Two major publications for communities to know in 2025

Two documents published by the CNIL at the beginning of 2025 should attract the attention of local authorities:

1. The 2025–2028 strategic plan, published in January 2025, defines four priority areas: cybersecurity, artificial intelligence, protection of minors, and everyday digital uses.
   https://www.cnil.fr/sites/cnil/files/2025-01/plan_strategique_cnil_2025-2028.pdf
2. The 2025* control program announced in March 2025 via a press release, indicates that the cybersecurity of local authorities is one of the control priorities of the year:
   “In 2025, the CNIL will focus on data collected through mobile applications, the cybersecurity of local authorities as well as data processing by the prison administration. »
   https://www.cnil.fr/fr/les-controles-de-la-cnil-en-2025

The six fundamental principles of the GDPR

For the record, Article 5 of the GDPR sets out six fundamental principles that any data controller must respect:

1. Legality, loyalty and transparency;
2. Limitation of purposes;
3. Data minimization;
4. Accuracy;
5. Retention limitation;
6. Integrity and confidentiality (security).

The sixth principle is particularly crucial for communities: it requires guaranteeing the security of personal data by implementing technical and organizational measures adapted to the risks. Article 32 of the GDPR specifies that these measures must ensure an appropriate level of security, including against loss, destruction or unauthorized access to data.

Examples of Technical Measures:

• Securing workstations: Installation of antivirus, firewalls, and regular updating of systems to prevent fraudulent access.
• Access management: Implementation of strong authentication, complex and individual passwords, and access rights limited to the needs of agents.
• Data encryption: Use of encryption techniques for sensitive data, particularly during storage or transmission.
• Regular backups: Carrying out frequent backups of data to prevent loss in the event of an incident.

Examples of Organizational Measures:

• Awareness raising and training: Organization of training sessions for agents on good practices in data protection.
• Authorization management: Clear definition of responsibilities and access rights for each agent, based on their missions.
• Internal procedures: Development of security policies, business continuity plans and incident management procedures.
• Supervision of subcontractors: Verification that service providers comply with GDPR requirements, particularly in terms of data security.

The implementation of these measures allows communities to comply with the requirements of the GDPR, protect the data of citizens and strengthen confidence in digital public services.

The strategic role of the Data Protection Officer (DPO)

Also for the record, the appointment of a Data Protection Officer is mandatory for public authorities, including local authorities (article 37 GDPR).

The DPO is responsible for:

• Inform and advise the community on its GDPR obligations;
• Monitor compliance with the regulations internally;
• Cooperate with the CNIL and act as a point of contact;
• Carry out impact analyzes and alert in the event of high risk.

The absence of a DPO constitutes a formal breach. In 2024, the CNIL sanctioned the municipality of Kourou with a fine of €5,000 followed by a penalty of €150/day. https://www.cnil.fr/fr/la-cnil-sanctionne-la-commune-de-kourou-pour-non-designation-dun-dpo

The Data Protection Officer (DPO) plays a key role in the definition, deployment and monitoring of technical and organizational security measures within a local authority. As a point of contact between the community and the CNIL, it ensures that data processing complies with the requirements of the GDPR, in particular those of Article 32 relating to data security. Concretely, the DPO supports services in identifying risks, implementing appropriate measures (encryption, logging, management of authorizations, etc.) and drafting internal procedures (incident management plan, contractual clauses with subcontractors, IT charters). It also raises agent awareness of good practices and actively participates in the response in the event of a data breach: analysis of the incident, evaluation of the consequences, documentation, and notification to the CNIL if necessary. Without a DPO, a community is exposed to incomplete data security governance and increased legal risks, particularly in the event of an audit.

How LEGALPROTECH-AVOCATS supports communities

LEGALPROTECH-AVOCATS has been working with public entities for several years to guarantee their GDPR compliance.

Our legal practice:

• Outsourced DPO: we assume the role of Data Protection Officer on your behalf;
• GDPR auditor: compliance audit, operational recommendations, processing mapping;
• GDPR trainer: tailor-made, practical and contextualized training for agents, referents and elected officials;
• CNIL assistance: preparation for controls, responses to injunctions, support in the event of sanctions, and management of personal data breach notifications.

Testimonial

“In an island environment, GDPR compliance raises very specific challenges. Between the multiplicity of remote sites, the sometimes limited access to digital resources and the diversity of agents’ missions, guaranteeing coherent and secure governance of personal data remains a real challenge. It is at the same time a legal responsibility, an operational imperative and an ethical requirement towards our citizens.

For us, it was essential to benefit from support which understands the reality of overseas communities and which can provide pragmatic solutions adapted to our territory. Since January 2025, LEGALPROTECH-AVOCATS has carried out this mission with legal practice and pedagogy that have been able to engage our teams. Their concrete approach, far from purely theoretical audits, allows us to move forward calmly and establish a real culture of data protection within our services. »

Florus NESTAR
Director General of Services of the Departmental Council of Guadeloupe