Aurélie Laffargue:
Turning rules
into practice.

QUESTION 01 / SYSWARDEN

Aurélie, could you introduce yourself and explain what led you to create SEASY CONSULTING?

Aurélie Laffargue

I am Aurélie Laffargue, a legal professional, consultant and trainer, and the founder of SEASY CONSULTING.

My career has taken me through law firms, a judicial officers' practice, and then in-house roles combining human resources, legal affairs and personal data protection, including work as a Data Protection Officer.

Those experiences led me to look at the law from two complementary angles: the requirements that must be met, and the realities of the people who have to apply them. A rule can be perfectly understood on paper and still be very difficult to put into practice when a team lacks time, resources or practical guidance.

That connection is what I wanted to place at the heart of SEASY CONSULTING: bringing law, professional practice and training closer together so that organisations can make informed decisions and adopt practices suited to their risks.

Data protection, cybersecurity and artificial intelligence illustrate this need particularly well. A digital tool is never just a technical matter. Using it also raises questions about confidentiality, responsibility, how work is organised and the skills people need. The CNIL also reminds us that collecting and using personal data through an AI system remains subject to the GDPR.

My approach therefore starts with real situations: the data we handle, the tools we use, the decisions we make and the difficulties we encounter. Training should help teams understand, but above all, know how to act.

QUESTION 02 / SYSWARDEN

In the France Travail case, why do known requirements still struggle to become everyday practice?

Aurélie Laffargue

The France Travail case shows precisely that the problem is not always a lack of awareness of the risk, but a failure to implement the measures already identified.

On 22 January 2026, the CNIL fined France Travail €5 million for an infringement of Article 32 of the GDPR. It identified, in particular, authentication that was not robust enough, insufficient logging to detect abnormal behaviour, and access permissions that were too broad. Above all, it found that most of the appropriate security measures had already been identified in the data protection impact assessments, without actually being implemented.

In my view, three difficulties can help explain that gap.

First, data protection is sometimes treated as a documentation exercise. A policy, an impact assessment or a procedure is written, and the subject is then considered settled. Yet Articles 24 and 32 of the GDPR require an ongoing approach: implementing appropriate measures, being able to demonstrate compliance, reviewing measures when necessary and regularly testing their effectiveness.

Second, operational responsibilities may not be clearly enough defined. Who has to reduce access rights? Who checks that the logs are usable? Who decides the remediation schedule? A recommendation without a named owner, a deadline and a check risks remaining an intention.

Finally, some organisations expect the DPO to carry a subject alone when it also depends on decisions by management, IT teams, business functions and procurement. The DPO informs, advises and monitors compliance. They must be involved in good time and have the resources they need. But appointing a DPO does not transfer the controller's obligations to them.

I would nevertheless draw an essential distinction: suffering a cyberattack does not, on its own, mean that the GDPR has been breached. Article 32 requires security appropriate to the risks, not a guarantee that a system can never be compromised. In this case, the CNIL expressly describes it as an obligation to take appropriate measures, rather than a guarantee of a particular outcome. What matters is whether the measures are relevant, implemented and effective in light of the risks.

My approach is therefore to turn each requirement into a verifiable action: an owner, resources, a deadline, a check and a record of what was actually done.

Editorial reference: the CNIL's account of the France Travail decision, published on 29 January 2026.

QUESTION 03 / SYSWARDEN

How can a company verify a supplier's security commitments, and what responsibilities does it retain if data leaks?

Aurélie Laffargue

Outsourcing data processing does not mean outsourcing all responsibility.

The first step is to identify the roles correctly. A supplier is a processor under the GDPR when it processes personal data on the company's behalf. Depending on what it actually does and the decisions it makes, it may also be the controller for a separate processing activity or, in some situations, a joint controller. The wording of the contract alone does not settle the question.

Where the supplier is a processor, Article 28 of the GDPR requires the company to use only providers offering sufficient guarantees. It also requires a contract governing the processing, including security, assistance, the use of further processors, the return or deletion of data, and audit arrangements.

To verify those commitments, I recommend a three-stage approach.

Before entrusting the data

Examine the safeguards that actually relate to the service: access controls, authentication, encryption where appropriate, backups and restoration, vulnerability management, incident detection, where processing takes place, and the use of other providers.

Certification can be useful evidence, but it does not replace that analysis. In particular, check its scope and whether it is current. Does it cover the service being used and the operations performed on the data? The GDPR treats certain certification mechanisms as elements that help demonstrate compliance, not as a transfer of responsibility.

In the contract

Commitments must be precise enough to be checked. A general statement such as "the supplier guarantees data security" is not enough, by itself, to organise meaningful oversight.

I recommend specifying the information to be provided, audit arrangements, crisis contacts, the assistance expected and an appropriate contractual notification deadline. On that last point, the processor must notify the controller of a breach without undue delay after becoming aware of it. The 72-hour period is not the processor's statutory deadline for alerting its client.

During the service

Ask for concrete evidence proportionate to the risks: control results, audit summaries, evidence of restoration tests, remediation tracking and information about changes in subprocessors. Article 28 expressly requires the information needed to demonstrate compliance to be made available, and audits, including inspections, to be allowed.

If a leak occurs, the company acting as controller retains its obligations to assess and document it and, where the relevant conditions are met, notify the supervisory authority and inform the people affected. The supplier must assist it and also has security obligations of its own.

When it comes to compensation, automatic assertions should be avoided. Article 82 sets out the conditions governing the liability of controllers and processors, as well as the possibility of exemption when an actor proves that it is not in any way responsible for the event giving rise to the damage. Where several actors are responsible for the same damage, each may be required to compensate the victim in full, then seek recovery from the others according to their respective shares of responsibility.

Finally, a company's liability and the personal liability of its director are separate questions. A leak at a supplier is not, by itself, enough to establish the director's personal liability.

Editorial reference: GDPR Articles 28, 32, 33 and 82.

QUESTION 04 / SYSWARDEN

A data leak is discovered on a Friday evening. How should the first decisions and notifications be organised?

Aurélie Laffargue

The first reflex should be to activate a crisis response structure, not to wait until Monday or until the investigation is over.

I recommend moving forward on three fronts at the same time: containing the incident, establishing the facts and assessing the consequences for people.

Assign clear roles

The technical teams take charge of the investigation and containment measures: securing access, preserving logs and useful evidence, determining the affected scope and limiting the spread.

The DPO, where one has been appointed, helps assess the nature of the incident and the risks to people, and advises on notification and communication obligations. They must be involved in good time without being put in a role that would compromise the independence of their duties.

Management provides resources, organises decision-making and ensures that the organisation fulfils its obligations. A crisis log preserves the known facts, uncertainties, measures taken and reasons for decisions. This structure gives practical effect to the GDPR's security and documentation obligations and the DPO's duties.

Distinguish the two notification thresholds

Notification to the competent supervisory authority, the CNIL in French cases within its jurisdiction, is required unless the breach is unlikely to result in a risk to people's rights and freedoms. It must be made without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. If that period is exceeded, the reasons for the delay must be explained.

The threshold for communicating with the people affected is different. Communication is required when the breach is likely to result in a high risk, subject to the exceptions in Article 34. It must then take place without undue delay. There is no general 72-hour deadline for that communication.

The weekend does not pause the 72-hour period. Becoming aware of a breach on Friday at 6 p.m. therefore puts the 72-hour mark at Monday at 6 p.m. That does not mean an organisation may routinely wait until then: the law requires action without undue delay.

Do not wait for every detail

Article 33 allows information to be provided in phases. The company can submit an initial notification with the information available, identify what remains to be established, then add further information without undue delay. The CNIL's procedure expressly provides for this possibility.

The assessment must focus on people. What data was exposed? Is it intelligible? Who can access it? Could it facilitate fraud, identity theft, discrimination or a breach of confidentiality? The number of people affected matters, but it is not enough on its own to determine the level of risk.

When people must be informed, the message must be clear, useful and practical: the nature of the breach, its likely consequences, the measures taken or proposed, and the contact details of the DPO or another contact point. A public announcement cannot freely replace individual notification. Article 34 sets conditions for this option, including where individual communication would involve disproportionate effort.

Finally, every breach must be documented, even when it does not lead to notification. A decision not to notify must therefore be explainable and reviewed if new facts emerge.

Editorial references: the CNIL's breach notification procedure and GDPR Articles 33 and 34.

QUESTION 05 / SYSWARDEN

What remedies are available to individuals, and what obstacles should they bear in mind?

Aurélie Laffargue

Three objectives need to be distinguished: obtaining information, having a suspected infringement examined, and obtaining compensation. They do not necessarily involve the same steps.

Obtain information from the organisation

A person can contact the organisation concerned or its DPO to find out whether their data is affected, which categories of data are involved and what measures have been taken. The CNIL explains that it cannot itself confirm to each person whether their data appears in a compromised file. That request must be addressed to the organisation concerned.

The right of access also allows people to find out what data is being processed and obtain a copy. The response must be provided without undue delay and, in principle, within one month. An extension of two further months is possible depending on the complexity or number of requests, provided the person is informed and the reasons are explained within the first month. This period must not be confused with the obligation to promptly inform people of a breach presenting a high risk.

It is also important not to promise unrestricted access to the technical incident report. The right of access concerns personal data and the information specified in the GDPR, not a general entitlement to every internal document.

Complain to the CNIL or file a criminal complaint

A complaint to the CNIL can report unlawful processing or difficulty exercising one's rights. The CNIL can investigate, impose corrective measures and issue penalties. It cannot, however, award damages to victims. The fines it imposes are paid into the state budget.

Where a criminal offence is suspected, a criminal complaint can also be filed. This serves a different purpose from a complaint to the regulator and does not, by itself, guarantee compensation.

Seek compensation through the courts

Article 82 of the GDPR allows compensation for material or non-material damage resulting from an infringement of the Regulation. Three conditions are necessary: an infringement of the GDPR, actual damage and a causal link between the two. The existence of a leak alone therefore does not automatically create an entitlement to compensation.

However, no minimum threshold of seriousness may be required for non-material damage. The Court of Justice of the European Union has also recognised that fear of misuse of personal data can, in itself, constitute non-material damage. The individual must still establish the reality of the personal harm claimed and its link to the infringement.

In France, a claim generally falls within the jurisdiction of the judicial court when the liability of a company or private individual is involved. Where an administration or public body is involved, it generally falls within the jurisdiction of the administrative court, with specific rules, including those concerning a prior claim for compensation. Jurisdiction and procedure must be checked for the particular situation.

There are also possibilities for representation by certain organisations. Since the reform introduced by the law of 30 April 2025, the unified group action regime includes personal data protection, subject to the conditions laid down in the legislation. It is not a procedure that any informal group may initiate freely: it is brought by persons or organisations legally authorised to do so.

The main practical obstacle often remains proving the harm and what caused it, particularly when several leaks may have contributed to fraud. It is therefore important to keep the organisation's notification, correspondence, fraudulent messages, evidence of losses or expenses, and material establishing the personal consequences. The CNIL expressly recommends preserving that evidence.

Editorial references: the CNIL on compensation after a data breach, the right of access and the French law of 30 April 2025.

QUESTION 06 / SYSWARDEN

An employee copies a customer file into an online AI tool. How would you handle the situation and measure whether training works?

Aurélie Laffargue

I would start by treating the situation as a question of working practices and organisation, without immediately assuming its legal classification or reducing the analysis to the employee's fault.

First, we need to understand what happened: which file was uploaded, what data it contained, which tool and account were used, for what purpose, with which settings, and what possibilities the provider has to retain, reuse or access the information.

Using AI does not make the GDPR disappear. If the file contains personal data, the purpose and lawfulness of the processing, the security safeguards and the roles of the parties must be examined. If the provider acts as a processor, Article 28 applies. That role should not be assumed without examining how the service actually works.

Address any resulting incident

If the circumstances reveal an unauthorised disclosure of, or access to, personal data, the breach must be assessed and documented, and the analysis under Articles 33 and 34 applied. But not every unapproved use of AI automatically requires notification to the CNIL. That decision depends on whether a personal data breach has occurred and on the risk to people.

I would suggest, among other steps, suspending the use concerned, preserving material useful to the analysis and checking the provider's deletion options. Deleting something in the interface should not, without verification, be treated as proof that every copy or every use has disappeared.

Work with management on the rules for use

Management must give teams practical guidance: which tools are authorised, for which tasks, with what data, which approvals are needed, and how to raise the alarm if a mistake occurs.

A blanket ban does not always address the business need. I would therefore look for a proportionate solution: working with fictitious data, reducing the data transmitted to what is strictly necessary, or using an environment whose safeguards have been assessed.

I would also make clear that removing names is not necessarily enough to anonymise a file. People may still be identifiable through other information or cross-referencing. Pseudonymisation is a protective measure, not an automatic exemption from the GDPR.

Build training around the actual task

In training, I would return to the original need: what was the employee trying to do more quickly? Starting with that task, participants would work with a fictitious file to learn how to:

• Identify personal data and confidential information.
• Choose an authorised tool.
• Limit the information transmitted.
• Understand the tool's settings and limitations.
• Check the results.
• Report a mistake promptly.

This approach aligns with Article 4 of the EU AI Act, in the consolidated version consulted. Providers and deployers must take measures to support the development of AI literacy among their staff and others using systems on their behalf, taking account of their knowledge and the context of use. The text specifies that this obligation does not require guaranteeing a particular level of literacy for every individual.

Check whether practices change

I would not limit evaluation to a satisfaction questionnaire. I would suggest a practical exercise before and after training, followed by a later review, for example after thirty or sixty days.

The aim would be to assess observable behaviours. Do participants recognise the data they should not transmit? Can they identify an authorised tool? Do they minimise data correctly? Do they know how to raise the alarm and explain their decision?

I would complement those exercises with proportionate monitoring of tool approvals, recurring mistakes and incident reports. An initial increase in reports can actually indicate a better understanding of risk rather than worsening practices.

Training does not replace technical measures or internal organisation. It must work alongside them to make good practices possible and lasting. The GDPR provides for both technical and organisational measures, instructions for people with access to data, and regular assessment of the effectiveness of security measures.

Editorial reference: the European Commission on AI literacy and Article 4. References checked on 13 October 2026.