News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

CNIL (France) - SAN-2025-015

Data Breaches Controllers Processors Processing Personal Data Human Resources Processing Agreement Supervisory Authorities
Jan 12, 2026
Summary

The data protection authority (DPA) has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. The DPA has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. Summary in English. Summary in English. Facts. A software company...

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review

Full text

The data protection authority (DPA) has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. The data protection authority has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related to people with disabilities, which resulted in a large-scale data breach. Summary in English. Summary in English. Facts. A software consultancy firm (the data processor) provided software to a government agency (the data controller) for the processing of files related to people with disabilities. A software consultancy firm (the data processor) provided software to a government agency (the data controller) for the processing of files related to people with disabilities. This software allowed users (data subjects) to upload their files and track their progress through an online portal. This software allowed users (data subjects) to upload their files and track their progress through an online portal. --- This content has been automatically translated using machine translation. The original version is available in the source language. --- This content was automatically translated using machine translation. The original version is available in the source language.

Similar Content