Data security: protecting your organisation's data in 6 steps

Data security covers the measures that protect an organisation's information against loss, theft, alteration and disclosure, from collection to deletion. It is not just a firewall or an antivirus: it starts with knowing what data you hold, what it is worth and who should access it. Here is why the issue is pressing, what the rules require and a six-step method.

Data security aims at four properties, the same as the DICP security criteria: availability (data is accessible when needed), integrity (it has not been changed without authorisation), confidentiality (only authorised people see it) and traceability (you know who did what). It applies to all data: customer files, financial data, trade secrets, staff records.

Two related ideas are often confused:

• Personal data protection, in the GDPR sense, is broader in one respect: it also covers lawfulness, purpose, retention and individuals' rights. But it is narrower in another: it only concerns data that identifies a person. Security is one of its obligations (Article 32).
• Information system security protects devices, networks and applications. Data security depends on it, but starts from the information itself: where it sits, who handles it, where it flows, including at suppliers and in the cloud.

Breaches are rising. According to its 2025 annual report, published in May 2026, the CNIL, France's data protection authority, received 6,167 data breach notifications in 2025, up 9.5% year on year, half of them caused by hacking. Security failings account for about a third of its inspections and nearly 30% of its sanctions, and the authority plans to devote half of its inspections and enforcement in 2026 to data security. In companies, the 2025 barometer of CESIN, the French association of information security experts, shows that among organisations hit by a successful attack, more than half (52%) suffered data theft.

Fines are getting heavy. In January 2026, the CNIL issued two decisions that now serve as benchmarks:

• Free and Free Mobile, €42 million (€27 million for Free Mobile, €15 million for Free), as reported by IT-Connect. After an intrusion in October 2024 affecting data from 24 million contracts, including bank account numbers, the CNIL found that remote-work VPN authentication was not robust enough, detection of abnormal behaviour was ineffective, the email informing subscribers was incomplete and, at Free Mobile, former subscribers' data had been kept too long.
• France Travail, €5 million, according to the decision published by the CNIL. In early 2024, attackers took over advisers' accounts through social engineering and accessed data on people registered over the past 20 years with the French public employment service. The CNIL points to weak authentication, insufficient logging and overly broad access rights. Above all, it notes that most of the necessary measures had been identified in impact assessments but never put in place.

Healthcare is not spared either, as our article on a hospital cyberattack fined by the CNIL shows.

• GDPR. Article 32 requires measures "appropriate" to the risk and lists several: pseudonymisation and encryption, the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore access to data after an incident, and a process for regularly testing the effectiveness of the measures. Article 5 also limits retention, and Article 34 requires clearly informing people after a high-risk breach.
• NIS 2. For essential and important entities, Article 21 lists policies on cryptography and encryption, human resources security, access control policies, asset management and multi-factor authentication, among others.
• ISO 27002. The 2022 version of ISO/IEC 27002 has specific controls for classification of information, data masking, data leakage prevention, information deletion, backup and the use of cryptography.
• NIST CSF 2.0. The NIST Cybersecurity Framework places data security (category PR.DS) in the Protect function: data is managed consistent with the organisation's risk strategy to protect its confidentiality, integrity and availability.

For personal data, the practical reference is the CNIL's personal data security guide. Its 2024 edition has 25 factsheets in five parts, with new ones on the cloud, mobile apps, artificial intelligence, application programming interfaces (APIs) and managing security. The CNIL says it uses the guide itself to assess the security of the processing it inspects.

1. Inventory and classify your data

List your main data sets (customers, staff, finance, research, suppliers), where they are stored, who owns them and who they are shared with. The information system map and, for personal data, the record of processing activities are good starting points; shadow IT is the usual blind spot. Then classify each set by sensitivity, with three or four simple levels (public, internal, confidential, secret) defined in the security policy. The class decides the protection.

2. Collect less and delete what you no longer need

This is the most effective measure and the most often forgotten. Security expert Bruce Schneier put it in a now-classic 2016 essay: data is a "toxic asset", and there is no better security than deleting the data you do not need. GDPR requires this for personal data through its principles of minimisation and limited retention, and the Free Mobile case shows how a never-purged file of former customers makes a breach worse.

3. Control access

Each person only accesses the data needed for their job (least privilege), privileged accounts are separate and limited, and multi-factor authentication protects remote access and sensitive data. This is the core idea of the zero trust model. In the France Travail case, overly broad rights multiplied the volume of exposed data.

4. Encrypt and pseudonymise

Sensitive data is encrypted in transit and at rest, including on laptops, removable media and backups, with keys managed separately. When data must be used without revealing who it relates to (testing, statistics), pseudonymisation replaces identifiers with aliases. ENISA stresses that no single technique fits every case and that a robust process takes real expertise; pseudonymised data is still personal data.

5. Log and detect

Log access to sensitive data, keep the logs and watch for abnormal behaviour: bulk extraction, unusual logins, access to records unrelated to the job. Both January 2026 sanctions specifically criticise ineffective detection. An alert should trigger your incident management process, including notifying the supervisory authority within 72 hours when personal data is affected.

6. Back up and test restores

An offline backup, isolated from the network and regularly restored in tests, is the last line of defence against ransomware. ANSSI, the French national cyber security agency, has a guide on information system backups, and its IT hygiene guide in 42 measures remains the baseline for everything else. Backups are also a pillar of cyber resilience.

Data entrusted to third parties follows the same rules: third-party risk management checks that your providers and hosts apply adequate measures, and a qualified hosting option such as SecNumCloud makes sense for the most sensitive data.

• Measures identified but never applied. This is the most striking finding in the France Travail decision. A data protection impact assessment or a risk analysis protects nothing until its measures have an owner, a deadline and follow-up.
• Protecting everything at the same level. Without classification, you encrypt the sales brochure and forget the HR file on an open network share.
• Keeping data "just in case". Every file kept for no reason widens the scope of a breach and the size of a fine.
• Neglecting people. France Travail was targeted through social engineering: security awareness for teams handling sensitive data is part of the measures.
• Poor communication after a breach. Free was also fined because its email to subscribers did not clearly say what consequences to expect or how to protect themselves. Crisis communication is prepared before the incident.