France · Independent authority
The CNIL in figures
In 2025, the CNIL adopted 426 deliberations (6% fewer than in 2024), including 10 sanctions. Over the last five years, 66 sanctions appear among its deliberations.
- Deliberations in 2025426−6% over one year
- Sanctions in 2025108 in 2024
- Opinions in 20254611% of the deliberations of the year
- Deliberations since 197926,683from 1979 to 2025
Deliberations year by year
The CNIL (Commission nationale de l'informatique et des libertés) is the independent administrative authority in charge of overseeing the protection of personal data. Its deliberations are acts of very different kinds: authorisations, opinions on draft legislation, reference frameworks and recommendations, formal notices and sanctions. The chart groups them into five categories and follows their number year by year; the yearly total depends largely on the prior formalities required of organisations, which have changed over time.
The CNIL adopted 426 deliberations in 2025, that is 6% fewer than in 2024. 2017 has the largest number of deliberations (3,884); since 2019, the yearly total has not exceeded 513. In 2025, authorisations account for 81% of the deliberations of the year and opinions for 11%.
- Authorisations
- Opinions
- Sanctions
- Formal notices
- Other deliberations
| Period | Total | Authorisations | Opinions | Sanctions | Formal notices | Other deliberations |
|---|---|---|---|---|---|---|
| 2021-2025 | 2,238 | 1,732 | 268 | 66 | 29 | 143 |
| 2016-2020 | 8,820 | 8,090 | 329 | 42 | 50 | 309 |
| 2011-2015 | 10,273 | 9,778 | 228 | 36 | 43 | 188 |
| 2006-2010 | 2,944 | 2,695 | 152 | 28 | 0 | 69 |
| 2001-2005 | 471 | 224 | 171 | 24 | 0 | 52 |
| 1996-2000 | 274 | 10 | 228 | 3 | 0 | 33 |
| 1991-1995 | 554 | 11 | 504 | 14 | 0 | 25 |
| 1986-1990 | 557 | 1 | 515 | 19 | 0 | 22 |
| 1979-1985 | 552 | 1 | 473 | 9 | 0 | 69 |
Number of deliberations published per year. Formal notices do not appear among the deliberations after 2023.
See also France Constitutional Council Competition Authority
Types of deliberation
Each deliberation belongs to a type. Authorisations (transfers of data outside the European Union, health research, evaluation of care and prevention practices, other cases) answer a request from an organisation; opinions concern draft legislation; reference frameworks, model rules and recommendations explain how to comply with the rules; formal notices and sanctions belong to enforcement. The table compares these types over periods of five years.
From 2021 to 2025, the CNIL adopted 2,238 deliberations, against 8,820 from 2016 to 2020. Research authorisations account for 69%, opinions for 12% and other authorisations for 9%. Since 1979, 26,683 deliberations have been adopted, including 11,135 data transfer authorisations and 6,446 research authorisations.
- Research authorisations
- Opinions
- Other authorisations
- Sanctions
- Internal organisation
- Formal notices
- Reference frameworks and model rules
- Recommendations and guidelines
- Certifications and labels
- Evaluation authorisations
- Other deliberations
| Type | 2021 | 2022 | 2023 | 2024 | 2025 | Total | Share |
|---|---|---|---|---|---|---|---|
| Research authorisations | 334 | 284 | 273 | 341 | 308 | 1,540 | 69% |
| Opinions | 65 | 56 | 61 | 40 | 46 | 268 | 12% |
| Other authorisations | 28 | 35 | 53 | 38 | 37 | 191 | 9% |
| Sanctions | 14 | 16 | 18 | 8 | 10 | 66 | 3% |
| Internal organisation | 11 | 11 | 10 | 15 | 13 | 60 | 3% |
| Formal notices | 4 | 24 | 1 | 0 | 0 | 29 | 1% |
| Reference frameworks and model rules | 7 | 9 | 5 | 0 | 1 | 22 | 1% |
| Recommendations and guidelines | 3 | 2 | 2 | 4 | 8 | 19 | 1% |
| Certifications and labels | 3 | 0 | 0 | 0 | 1 | 4 | <1% |
| Evaluation authorisations | 0 | 1 | 0 | 0 | 0 | 1 | <1% |
| Other deliberations | 3 | 21 | 3 | 9 | 2 | 38 | 2% |
“Other deliberations” groups closing decisions and deliberations with no stated type.
See also France Conseil d'État
Sanctions and formal notices
A formal notice calls on an organisation to comply within a set time; a sanction is imposed by the CNIL's restricted committee at the end of an adversarial procedure. The chart follows, year by year, the number of sanctions and formal notices that appear among the published deliberations; the table adds the share of sanctions in all the deliberations of the year.
In 2025, 10 sanctions appear among the CNIL's deliberations (8 in 2024). From 2021 to 2025, the deliberations include 66 sanctions, between 8 and 18 a year; the number was 42 from 2016 to 2020. Over these five years, sanctions account for 2.9% of the deliberations. 122 formal notices appear among the deliberations, from 2011 to 2023; no formal notice appears after 2023. Since 1984, the deliberations include 241 sanctions in all.
- Sanctions
- Formal notices
| Year | Sanctions | Formal notices | Deliberations (total) | Share of sanctions |
|---|---|---|---|---|
| 2025 | 10 | 0 | 426 | 2.3% |
| 2024 | 8 | 0 | 455 | 1.8% |
| 2023 | 18 | 1 | 426 | 4.2% |
| 2022 | 16 | 24 | 459 | 3.5% |
| 2021 | 14 | 4 | 472 | 3.0% |
| 2020 | 12 | 4 | 513 | 2.3% |
| 2019 | 5 | 6 | 490 | 1.0% |
| 2018 | 9 | 26 | 973 | 0.9% |
| 2017 | 8 | 6 | 3,884 | 0.2% |
| 2016 | 8 | 8 | 2,960 | 0.3% |
| 2015 | 4 | 24 | 2,227 | 0.2% |
| 2014 | 11 | 9 | 1,911 | 0.6% |
| 2013 | 8 | 6 | 2,338 | 0.3% |
| 2012 | 8 | 2 | 1,997 | 0.4% |
| 2011 | 5 | 2 | 1,800 | 0.3% |
| 2010 | 4 | 0 | 1,400 | 0.3% |
Sanctions and formal notices counted when they appear among the deliberations. Share of sanctions computed for years with at least 200 deliberations.
See also Conseil d'État France
Authorisations
Three main families of authorisations appear in the deliberations: transfers of personal data outside the European Union, health research and the evaluation of care and prevention practices; other authorisations cover more varied cases. Their number depends on the rules in force in each period, in particular the General Data Protection Regulation (GDPR), applicable since 25 May 2018.
In 2025, the CNIL adopted 345 authorisations, that is 9% fewer than in 2024. They include 308 research authorisations. The yearly number of authorisations averages 2,525 from 2013 to 2017 and 366 from 2019 to 2025. No data transfer authorisation appears after 2018.
- Research authorisations
- Data transfer authorisations
- Evaluation authorisations
- Other authorisations
| Period | Total | Research authorisations | Data transfer authorisations | Evaluation authorisations | Other authorisations |
|---|---|---|---|---|---|
| 2021-2025 | 1,732 | 1,540 | 0 | 1 | 191 |
| 2016-2020 | 8,090 | 1,802 | 5,070 | 595 | 623 |
| 2011-2015 | 9,778 | 2,681 | 5,007 | 644 | 1,446 |
| 2006-2010 | 2,695 | 423 | 1,058 | 128 | 1,086 |
| 2001-2005 | 224 | 0 | 0 | 0 | 224 |
| 1996-2000 | 10 | 0 | 0 | 0 | 10 |
| 1991-1995 | 11 | 0 | 0 | 0 | 11 |
| 1986-1990 | 1 | 0 | 0 | 0 | 1 |
| 1979-1985 | 1 | 0 | 0 | 0 | 1 |
Number of authorisation deliberations published per year and type.
See also France Conseil d'État
Before and after the GDPR
The General Data Protection Regulation (GDPR) has applied since 25 May 2018. It reduced the prior formalities that organisations had to complete with the CNIL, strengthened their accountability and raised the ceiling on sanctions. The table and the chart compare the yearly average of deliberations before and after it applied; 2018, a transition year, is counted in neither period.
The CNIL adopted an average of 2,664 deliberations a year from 2013 to 2017 and 463 a year from 2019 to 2025. Authorisations account for 95% of the deliberations of the first period and 79% of the second. The average number of sanctions a year goes from 7.8 to 11.9.
- 2013-2017
- 2019-2025
- Authorisations
- Opinions
- Sanctions
- Formal notices
- Other deliberations
| Category | Yearly average, 2013-2017 | Yearly average, 2019-2025 |
|---|---|---|
| Authorisations | 2,525 | 366 |
| Opinions | 65.6 | 52.6 |
| Sanctions | 7.8 | 11.9 |
| Formal notices | 10.6 | 5.6 |
| Other deliberations | 54.8 | 26.9 |
| Total | 2,664 | 463 |
2018, the year the regulation came into application, is left out of both periods.
See also France Constitutional Council
Understanding these figures
The restricted committee and its sanctions
The CNIL's sanctions are imposed by its restricted committee, separate from the collegiate body that adopts the other deliberations. It can issue a reprimand, an order to bring the processing into compliance, a limitation or ban on the processing, or an administrative fine. The General Data Protection Regulation (GDPR) caps the fine at EUR 20 million or 4% of annual worldwide turnover, whichever is higher. From 2021 to 2025, 66 sanctions appear among the CNIL's deliberations, between 8 and 18 a year; since 1984, 241 sanctions.
Formal notice or sanction
A formal notice, issued by the president of the CNIL, asks an organisation to comply within a set time; it is not a sanction in itself, and the procedure may stop if the organisation complies. A sanction is a separate decision, taken after an adversarial procedure. Both acts are counted only when they appear among the published deliberations. Among the deliberations, 122 formal notices appear from 2011 to 2023 and 241 sanctions from 1984 to 2025.
Challenging a sanction before the Conseil d'État
The CNIL's sanctions can be challenged before the Conseil d'État, which rules at first and last instance and can uphold, reduce or annul the sanction. The sanctions counted here are those the CNIL imposed, before any appeal.
The turning point of 2018: the GDPR
The GDPR has applied since 25 May 2018. It replaced most prior declarations and authorisations with greater accountability for organisations, which must document their compliance. Processing of health data for research purposes remains subject to authorisation when it does not follow a reference methodology. The CNIL adopted an average of 2,664 deliberations a year from 2013 to 2017 and 463 a year from 2019 to 2025.
What these figures count
Each published deliberation counts as one: an authorisation, an opinion on a draft text, a reference framework or model rule, a recommendation, a certification, a formal notice, a sanction or an act of internal organisation. These figures do not measure all of the CNIL's work: complaints received, on-site inspections and advice given to organisations do not appear among the deliberations. No statistic on this page can predict the outcome of a particular procedure.
Frequently asked questions
How many sanctions does the CNIL impose each year?
In 2025, 10 sanctions appear among the CNIL's deliberations (8 in 2024). From 2021 to 2025, 66 sanctions appear among them, between 8 and 18 a year.
What is the difference between a formal notice and a sanction?
A formal notice calls on an organisation to comply within a set time; a sanction is a separate decision, imposed by the restricted committee after an adversarial procedure. Among the deliberations, 122 formal notices appear from 2011 to 2023 and 241 sanctions since 1984.
What are the CNIL's most frequent deliberations?
From 2021 to 2025, of 2,238 deliberations, research authorisations account for 69%, opinions for 12% and other authorisations for 9%.
Has the number of deliberations changed since the GDPR?
The CNIL adopted an average of 2,664 deliberations a year from 2013 to 2017 and 463 a year from 2019 to 2025. The regulation has applied since 25 May 2018.