Back to blog
CNILcomplianceguide

CNIL compliance audit: the complete guide for SMBs in 2026

Published on 2026-03-269 min readFlorian

CNIL is inspecting more SMBs than ever

In 2025, CNIL conducted over 300 formal inspections and processed 17,772 complaints. One-third of sanctions concerned inadequate security measures. SMBs are no longer exempt: CNIL now targets businesses of all sizes, particularly in healthcare, finance, and legal sectors.

What CNIL checks during an inspection

CNIL verifies GDPR compliance on several axes. Article 32 is the one directly concerning your application's technical security.

Processing records: have you documented what data you collect, why, and for how long?

Legal basis: do you have a legal foundation for each processing (consent, contract, legitimate interest)?

Article 32 technical measures: have you implemented security measures proportionate to the risks?

Data subject rights: can you respond to access, rectification, and deletion requests?

Breach notification: do you have a procedure to notify CNIL within 72h in case of a breach?

The Article 32 checklist for SMBs

Article 32 GDPR requires "appropriate technical and organizational measures." Concretely, for a web application:

  • Encryption in transit: TLS 1.2 minimum (1.3 recommended) on all exchanges
  • Encryption at rest: sensitive data encrypted in the database
  • Access control: each user only accesses their own data (RLS, auth middleware)
  • Strong authentication: hashed passwords (bcrypt/argon2), 2FA available
  • Logging: access logs for sensitive data, retained 6 months minimum
  • Pseudonymization: separate identifying data from business data where possible
  • Regular testing: documented security audits, at least annually
  • Backup and recovery: ability to restore data in case of incident
  • How to prepare your SMB for an inspection

    Step 1 — Inventory: list all personal data your application handles. Names, emails, addresses, health data, financial data.

    Step 2 — Technical audit: have your application audited by an expert. The audit report constitutes due diligence evidence in case of inspection.

    Step 3 — Remediation plan: fix identified flaws and document each correction.

    Step 4 — Procedures: write your breach notification procedure (72h) and your data subject rights response procedure.

    Step 5 — Training: train your team on security best practices.

    What the audit report should contain

    To be useful in front of CNIL, your audit report must include the scope analyzed, methodology used, vulnerabilities identified with their severity, personal data potentially exposed, prioritized remediation recommendations, and the audit date.

    Our view for SMBs

    Our Full Audit (€4,200) produces a CNIL-compliant report. It identifies security flaws, assesses the impact on personal data, and provides a prioritized remediation plan. It's your best proof of due diligence.

    Related articles

    Three adjacent analyses to keep exploring the same attack surface.

    Sources

    Written by Florian
    Reviewed on 2026-03-26

    Editorial analysis based on official vendor, project, and regulator documentation.

    Related services

    If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

    Need an external review of your HR SaaS?

    Share your product, stack, and client context. We will come back with the right review scope.

    Discuss your audit