CNIL (France) - SAN-2026-010
CNIL fines EXTIA €300,000 for GDPR violations related to data erasure requests.
France's CNIL has fined consulting firm EXTIA €300,000 for failing to properly handle data erasure requests and inform data subjects of the outcomes. The company received numerous complaints regarding difficulties in exercising data subject rights, leading to an on-site inspection. The investigation revealed that a significant portion of erasure requests were not processed, data subjects were not informed of the outcomes, and responses were often delayed, violating Articles 12 and 17 of the GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CNIL?
Get an email when a new story names CNIL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFrench consulting firm EXTIA was fined €300,000 by CNIL for systematically failing to process data subject erasure requests and neglecting to inform individuals of outcomes, violating GDPR Articles 12 and 17. The root cause reflects a lack of mature internal processes and accountability for managing data subject rights, a critical operational obligation under GDPR. This matters because organizations handling personal data must treat rights requests as a formal, time-bound compliance workflow—not an ad hoc administrative task. Failure to do so exposes companies to significant regulatory penalties, reputational damage, and erosion of public trust in data handling practices.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.