CNIL Complaint 2026: How to File One

Targeted advertising that reappears after a deletion request, a former employer that keeps an HR file well beyond what is necessary, an online shop that refuses to delete an account, a neighbour's CCTV pointed at a private terrace: all these situations call for the same reflex, referring the matter to the CNIL. It remains to be seen whether the complaint is admissible, how to word it so that it succeeds, and what the authority can really obtain. This guide sets out the procedure for filing a CNIL complaint in 2026, the documents to gather, the time limits to expect and the practical outcomes, for individuals and professionals alike faced with questionable data processing.

What a CNIL complaint covers and who can file one

The Commission nationale de l'informatique et des libertés (CNIL) is the independent administrative authority responsible for ensuring compliance with personal data regulation in France. Its existence and missions rest on Law No. 78-17 of 6 January 1978 on information technology, files and freedoms, known as the Informatique et Libertés law, substantially amended to fit with Regulation (EU) 2016/679 of 27 April 2016, the GDPR (General Data Protection Regulation). The missions and powers of this authority are presented in our guide to the definition and role of the CNIL.

The right to refer a matter to the authority is set out in black and white in the European regulation.

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority (...) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. (Article 77 of the GDPR)

In the vocabulary of the GDPR, the term is "complaint" (réclamation); in French usage and on the CNIL website, the term is "plainte". Both terms designate the same step. Any individual may file a CNIL complaint where he or she considers that an organisation has disregarded his or her rights over his or her own data. This covers individuals generally, but also an employee in relation to an employer, a customer in relation to a trader, and an internet user in relation to a platform.

Businesses may also be the source of a report

A company does not lodge a "complaint" in the strict sense for its own data, because personal data protection concerns individuals. However, a manager, an employee or a customer may refer a company to the CNIL. A professional may also alert the CNIL to the practices of a competitor or a partner, for example mass commercial canvassing carried out from files acquired without a legal basis. This aspect is directly relevant to business litigation: a well-documented CNIL complaint can feed a parallel commercial dispute, whether for unfair competition or for contractual breach by a data processor.

Checking that the situation falls within the CNIL's remit

Before filing a CNIL complaint, you must make sure the problem falls within its scope. The CNIL acts only on the processing of personal data, that is, any information relating to an identified or identifiable individual: name, address, email, telephone number, location data, online identifier, image, health data, and so on.

The following typically fall within its remit:

• an organisation's refusal to respond to a request for access, rectification or erasure (rights provided for in Articles 15 to 17 of the GDPR);
• receipt of unsolicited commercial canvassing by email, text message or telephone despite an objection;
• publication of a photo or video without consent;
• CCTV filming the public highway or a neighbour's property;
• retention of data well beyond the necessary period;
• failure to provide information on the use of the data collected by a website.

Conversely, some disputes do not fall within the CNIL's remit. Pure defamation, insult or an invasion of privacy without structured data processing are matters for the ordinary courts. A dispute over the editorial content of a press article largely falls outside its competence, given the balance with freedom of expression. A strictly contractual dispute with no "data" dimension is a matter for the competent court. Identifying the right forum avoids losing months on an unsuitable route.

The preliminary step, often mandatory: exercising your rights with the organisation

In the great majority of cases, the CNIL expects the person to have first exercised his or her rights directly with the organisation concerned, known as the data controller. In practical terms, a written request (email or letter) must be sent to the data protection officer (DPO, délégué à la protection des données) or to customer services, specifying what is being claimed: access to the data, correction, erasure, or objection to its use.

The GDPR requires the data controller to respond within one month of receiving the request, a period that may be extended by two months where the case is complex (Article 12 of the GDPR). It is only where there is no satisfactory response, or no response at all, that the CNIL complaint takes on its full meaning. Keeping a time-stamped copy of this preliminary step is decisive: it is the first item in the file.

Gathering the documents before filing a CNIL complaint

A CNIL complaint succeeds only if it is supported. The authority receives a considerable volume of complaints each year, and a vague file rarely produces a result. The rule is simple: everything that can be proved must be attached.

The standard file includes the complainant's identity, the precise identification of the organisation concerned (company name, address, website), a clear and chronological account of the facts, and all supporting documents. These supporting documents include:

• a copy of the request sent to the data controller and proof that it was sent;
• the response received, or a note that there was no response, with the deadline that has passed;
• dated screenshots (canvassing emails, a web page, an account message);
• emails exchanged, keeping the technical headers where possible;
• for CCTV, photographs showing the orientation of the cameras.

The quality of the chronology counts as much as the documents. An account stating "on 3 January 2026, erasure request sent by email; no response by 4 February 2026; further reminder on 10 February, left unanswered" is far more usable than a confused narrative. The CNIL must be able to reconstruct the breach without having to rebuild the file.

The filing procedure in 2026, step by step

The online service, the main route

In 2026, the preferred channel remains the online complaint service accessible from the official website cnil.fr. The online service guides the complainant through a form structured by theme (advertising, right of access, erasure of data on the internet, CCTV, human resources, and so on). This initial sorting directs the complaint to the right investigating department and speeds up its handling.

The form asks the complainant to classify the nature of the problem, identify the organisation, describe the facts and upload the supporting documents. It is strongly advisable to draft the account offline beforehand and then copy it, in order to avoid an interrupted session and lost text. On completion of the submission, an electronic acknowledgement of receipt confirms registration of the CNIL complaint and provides a reference to keep for any follow-up.

The postal route

A complaint may also be sent by letter to the CNIL, at its address in Paris. This route remains useful for people who are not comfortable with digital procedures or who have only paper documents. The letter must contain the same elements as the online form: identity, organisation concerned, dated facts, copies of the documents. Sending it by registered post with acknowledgement of receipt gives the filing a certain date.

The special case of delisting

Where an internet user wishes to have a result associated with his or her name removed from a search engine, the "right to delisting", the first step is taken directly with the search engine using its dedicated form, on the basis of the right to erasure in Article 17 of the GDPR. The CNIL acts only if the search engine refuses, as an appeal authority. This two-stage logic applies to most rights: action with the organisation first, CNIL complaint second. The steps for obtaining the deletion of your data and online traces are detailed in our article on the right to be forgotten.

What happens after filing

The investigation

Once the complaint is registered, an investigating department examines it. The authority may, depending on the case, contact the organisation concerned to ask for explanations, require the situation to be regularised, or remind it of its obligations. A significant share of complaints is settled at this stage, through spontaneous compliance by the data controller once alerted to the CNIL's involvement. For the complainant, the practical result often lies there: the data is erased, the canvassing stops, access is granted.

The complainant is informed of the action taken on his or her complaint. It is worth being realistic about timing. Handling may take several weeks to several months depending on the complexity of the case and the volume of complaints pending. A well-documented complaint shortens this period by avoiding exchanges of requests for further information.

The power of inspection and sanction

Where breaches are serious, repeated or affect a large number of people, the CNIL may launch an inspection, on documents, online, by hearing or on site. At the end of it, the CNIL's restricted committee (formation restreinte), its sanctioning body, may issue a reprimand, an order to comply backed by a penalty payment, or an administrative fine. The obligations that weigh on businesses to prevent these sanctions are set out in our article on data protection in business.

The GDPR sets the ceiling for these fines at a deterrent level: up to €20 million or 4% of worldwide annual turnover for the most serious breaches, whichever is higher (Article 83 of the GDPR). For the record, these sanctions are aimed at the organisation at fault and are not intended to compensate the complainant directly. The CNIL complaint is a regulatory instrument, not an individual compensation procedure.

What a CNIL complaint does not remedy

This is an essential distinction, often poorly understood. The CNIL puts an end to a breach and may sanction the organisation, but it does not award damages. To obtain compensation for harm (damage to reputation, non-material harm, financial loss), the matter must be brought before a court. Article 82 of the GDPR indeed gives a right to compensation before the civil courts to any person who has suffered damage as a result of an infringement of the regulation.

The two routes are not mutually exclusive: a published and reasoned CNIL sanction decision constitutes solid evidence in a later compensation action. This is precisely the interplay that a lawyer practising in business litigation works on when a client suffers damage linked to a misappropriation of files or a data leak.

Practical illustrations

Imagine an employee of a small or medium-sized company of about thirty people who discovers, after leaving, that her former employer has kept the whole of her professional mailbox and continues to access it. She first sends an erasure request to the company's DPO by email, citing Article 17 of the GDPR. Having received no response within a month, she files a CNIL complaint attaching her request, proof that it was sent and the chronology. The CNIL questions the employer, who regularises the situation. No sanction is imposed, but the complainant's objective, putting an end to the access, is achieved.

In another case, a consumer receives advertising text messages every week from a retail brand despite several unsubscribe requests. He keeps dated screenshots of the messages and of his requests that had no effect. His CNIL complaint, filed under the canvassing theme, may, if the brand reoffends with many customers, trigger an inspection and a sanction on the basis of the rules on consent to electronic canvassing.

A third situation, frequent in property law: a co-owner installs a camera whose field of view covers the shared landing and a neighbour's door. The neighbour who is filmed first sends a written request to reposition it. Without result, he refers the matter to the CNIL, attaching photographs showing the angle of the camera. The CNIL then recalls the rule: a private camera may film only the strictly private space of its owner, never the common parts or another person's property without a legal basis.

Practical tips to maximise the effectiveness of a complaint

Precision takes priority over volume. A complaint focused on a clearly identified breach, supported by three probative documents, is worth more than a fifty-page file that drowns the essential fact. The right relied on must be named: right of access, right of erasure, right to object to canvassing, failure to inform. This legal vocabulary allows the investigating department to classify the situation immediately.

Proof of the preliminary step is the pivot of the file. Without it, the CNIL will frequently send the complainant back to exercise his or her rights with the organisation first. Systematically keeping acknowledgements of receipt, time-stamping screenshots and retaining email headers is a documentary discipline that makes the difference.

Finally, where financial or reputational harm is at stake, or where the organisation disputes the facts, involving a lawyer is justified. The CNIL complaint can then form part of a broader strategy combining a report to the authority, a formal notice and, where appropriate, an action for compensation before the court.

Conclusion

The CNIL complaint is a powerful but poorly understood tool. Powerful, because it confronts the organisation with an authority holding a heavy power of sanction, and its intervention is often enough to unblock a situation. Poorly understood, because it does not compensate and because it almost always presupposes having first exercised one's rights directly with the data controller. In 2026, the logic remains the same: act first with the organisation, document rigorously, then refer the matter to the CNIL if the response is missing or unsatisfactory.

The winning reflex comes down to one sentence: before filing a CNIL complaint, build a dated file, attach proof of your preliminary request and identify precisely the right that has been disregarded. If quantifiable damage is at stake, do not stop at the complaint: have a lawyer assess whether an action for compensation on the basis of Article 82 of the GDPR is worthwhile, because the CNIL's decision may support your claim before the court.

Frequently asked questions

Does it cost anything to file a CNIL complaint?

No. Referring a matter to the CNIL is entirely free, whether the complaint is filed through the online service on cnil.fr or by post. No fees are required at any stage of the investigation. Only the use of a lawyer, for example to combine the complaint with an action for compensation, generates fees.

Must I contact the company before referring the matter to the CNIL?

In almost all cases, yes. The CNIL expects the person to have first exercised his or her rights with the data controller, who has one month to respond under Article 12 of the GDPR, extendable by two months where the case is complex. The complaint comes into play where there is no response or an unsatisfactory one. Keeping proof of this preliminary step largely determines the admissibility of the file.

How long does the CNIL take to handle a complaint?

The time taken ranges from a few weeks to several months depending on the complexity of the case and the volume of complaints pending. A significant share of complaints is settled quickly by the organisation coming into compliance once contacted by the authority. A complete, dated and supported file from the outset significantly reduces this time by avoiding requests for further information.

Can the CNIL pay me damages?

No. The CNIL puts an end to the breach and may sanction the organisation by a reprimand, an order or an administrative fine, but it never compensates the complainant. To obtain compensation for harm, the civil court must be seized on the basis of Article 82 of the GDPR. A CNIL sanction decision is nonetheless useful evidence in that action.

Can a company file a CNIL complaint against a competitor?

Personal data protection concerns individuals, so a company does not "lodge a complaint" for its own data. However, a manager, an employee or a customer may report to the CNIL the practices of a company, for example canvassing derived from files acquired without a legal basis. This report may feed a parallel business dispute, in particular for unfair competition.

What is the maximum amount of a fine imposed by the CNIL?

For the most serious breaches, the GDPR sets the ceiling at €20 million or 4% of the organisation's worldwide annual turnover, whichever is higher (Article 83 of the GDPR). This fine is aimed at the organisation at fault and goes to the State budget; it does not go to the complainant. Less serious breaches are subject to a lower ceiling, set at €10 million or 2% of turnover.

Can a CNIL complaint be filed anonymously?

No, a complaint requires the complainant to be identified, because the CNIL must be able to verify that the person is actually concerned by the processing complained of and to inform him or her of the outcome. It is, however, possible to report facts without being personally concerned, but such a report does not confer the same follow-up rights as a complaint. The complainant's identity is not systematically disclosed to the organisation concerned during the investigation.