A data breach is not limited to the theft of credentials. The European regulatory framework now overlays several legal regimes (GDPR, DSA) that create distinct obligations for data controllers and online platforms. For the affected individuals, this overlay opens up often underutilized levers for action.
Interaction between GDPR and DSA: two cumulative regimes in the event of a breach on a platform
When a data breach occurs on a large platform, the GDPR requires notification to the CNIL and, in the case of a high risk, direct information to the individuals. The Digital Services Act (DSA) adds obligations specific to online platforms, particularly regarding transparency and the management of systemic risks.
These two regimes are cumulative; they do not replace one another. A platform that notifies a breach under the GDPR remains bound by its DSA obligations regarding the moderation of content resulting from the breach, such as the dissemination of stolen databases on its own services.
We observe that most individuals only invoke the GDPR in their complaints to the CNIL. Explicitly mentioning the DSA in a complaint signals to the authority that the platform has also failed in its due diligence obligations. Several resources document this dual requirement, such as Mindtrap’s practical guides which detail the available remedies depending on the type of platform involved.
CNIL Sanctions in 2026: What the Amounts Reveal About Control Doctrine
The CNIL does not only sanction technical failures. In its report published on September 9, 2026, the authority imposed a fine of 27 million euros against a mobile phone operator on January 8, 2026. The violations included data security, but also the failure to inform the victims.
The message is clear: a company that suffers a breach and delays in notifying the affected individuals exposes itself to a separate sanction for this sole delay. For an individual, this means that the absence of notification constitutes a valid grievance before the CNIL.
Health Data: A Higher Level of Legal Risk
On September 3, 2026, the CNIL sanctioned a private hospital with a fine of 500,000 euros for a health data breach. Medical data benefits from enhanced protection under Article 9 of the GDPR. Their disclosure can lead to discrimination in insurance, employment, or credit, far beyond the classic phishing risk.
We recommend that individuals whose health data has leaked systematically document any refusals or changes in contractual terms that occurred after the breach. These elements constitute evidence of harm in the context of a compensation action.
Rights of Victims of Data Breaches: Often Ignored Concrete Levers
Public articles focus on changing passwords and vigilance against phishing. These measures are necessary, but they only cover a fraction of the available actions.
- Enhanced right of access (Article 15 GDPR): request from the data controller the exact list of categories of compromised data, the recipients to whom they have been communicated, and the precise date of detection of the breach. This right obliges the organization to provide a documented response within one month.
- CNIL complaint with dual basis: simultaneously invoke the security breach (Article 32 GDPR) and the failure to notify individuals (Article 34 GDPR). Mention the DSA if the breach concerns an online platform subject to this regulation.
- Action for compensation for harm: the GDPR opens a right to compensation for material or moral damage (Article 82). Documenting attempts at fraud received after the breach, administrative steps taken, and time spent securing accounts constitutes an actionable file before the civil judge.
- Active monitoring of IBAN: in the event of a leak of a banking identifier, contact your bank to activate a whitelist of authorized creditors for SEPA direct debits. Dispute any unrecognized debit within 13 months.
Account Security After a Breach: Beyond the Password
Changing a compromised password is not enough if the same identifier (email address) is used as an authentication pivot across multiple services. The reuse of identifiers remains the primary vector for exploitation after a breach.
A password manager generates unique identifiers for each service, but the crucial layer of protection remains multi-factor authentication (MFA). Prefer a TOTP app or a physical FIDO2 key over SMS, which is documented to be intercepted through SIM swapping.
Monitoring Exposed Data on the Web
Several services allow you to check if an email address appears in a compromised database. These tools do not replace the mandatory notification by the data controller, but they fill a blind spot: some breaches are never notified to the victims, either due to negligence or because the organization disputes the qualification of a breach.
Setting up alerts on your main identifiers allows you to react before receiving an official notification, if it ever arrives.
The European legal framework offers victims of data breaches more extensive remedies than mere digital hygiene measures. Documenting the timeline of the breach, invoking the correct legal grounds, and leveraging the GDPR-DSA complementarity transforms a defensive posture into a real lever for action against failing organizations.
