Background information

• Date of final decision: 22 December2025
• National case
• Controller: NEXPUBLICA FRANCE
• Legal Reference: Article 32 (Security of processing)
• Decision: Administrative fine
• Key words: Administrative fine, Data security, Data breach

Summary of the Decision

Origin of the case

NEXPUBLICA FRANCE has developed a user relationship management software named PCRM which is used in the field of social action, in particular by departmental houses for the disabled (MDPH). In November 2022, the CNIL was notified of a data breach by NEXPUBLICA FRANCE customers for being able to access documents concerning third parties. The CNIL then carried out investigations which revealed insufficient technical and organizational measures to secure personal data of the PCRM software.

Key Findings

• Breach of the obligation to secure personal data (Article 32 of the GDPR)
  NEXPUBLICA FRANCE did not comply with the requirements provided for by the article 32 of the GDPR for the implementation of its PCRM, given the widespread weakness of the information system and the negligence it showed in allowing structural security problems to persist.

Decision

On the basis of these investigations, the restricted committee – the CNIL body responsible for imposing sanctions – considered that the company had failed to comply with the article 32 of the GDPR.
The restricted committee therefore issued a fine of €1.7 million and decided to make its decision public. This decision took into account the company’s financial capacity, its failure to comply with basic security principles, the number of people affected and the sensitivity of the data processed (in particular, revealing a disability).

For further information:

• [FR]: https://www.cnil.fr/fr/securite-des-donnees-sanction-de-1-700-000-euros-lencontre-de-la-societe-nexpublica-france
• [EN]: https://www.cnil.fr/en/data-security-nexpublica-france-fined-eur1700000