← All Articles CNIL · 2026 inspections 7 min read By the Sitetals Team Updated 6 September 2026

The CNIL's 2026 priority inspections: what they mean for a small business website

A thirty-person company in Lyon added a "Carrières" page to its website last year: a short form, a CV upload field, an "Apply" button. Since then, about a hundred applications have piled up in the manager's inbox and in a third-party recruitment tool. Nobody knows how long they will stay there or who can open them. A few kilometres away, a handball club runs a members' area for four hundred licence holders, half of them minors, with medical certificates on file and a public photo gallery. Those two sites are exactly the kind the CNIL's published inspection themes for 2026 point at.

Disclaimer: this article is provided for information only and does not constitute legal advice. The texts cited are those in force at the time of writing; for a specific situation, consult a qualified legal professional.

What the CNIL announced on 3 April 2026

Every year the French data protection authority publishes the themes on which part of its inspections will focus. The page published on 3 April 2026 names three: recruitment, the single electoral register, and sports federations. It also gives the scale. The CNIL carries out "several hundred inspections a year", triggered by complaints, earlier corrective measures, reports or current events, and "around 20%" of them fall under the annual priority themes. The rest are not thematic at all: a single complaint is enough to start one, on any subject.

2026 theme	What the CNIL says it will check	Who is concerned in practice
Recruitment	Whether recruiters comply with the GDPR on the main topics of its recruitment guide of January 2023: automated decision-making, information given to candidates, retention periods	"As a priority, large companies and recruitment agencies". The rules themselves apply to any business that recruits online.
Single electoral register (répertoire électoral unique)	How this file, "held by INSEE" and covering every voter in France, is used, and whether it is used for other purposes	The public bodies that use the file. A company or club website is not in scope.
Sports federations	"The relevance of the data collected, its retention period and the security in place", the sector having been "particularly targeted by recent cyberattacks"	Federations, and through them the clubs that feed their files. The CNIL notes that the Paris 2024 Games drove up club sign-ups, with health data and "a significant number of minors" involved.

The same page announces a fourth, European workstream. Under the fifth action of the coordinated enforcement framework (CEF), the CNIL and its European counterparts will check the transparency and completeness of the information given to data subjects. In plain terms: the quality of your privacy policy, the subject of our article on articles 13 and 14.

What an "inspection" actually looks like

The CNIL's page "Comment se passe un contrôle de la CNIL ?" describes four forms: on-site (a delegation visits the premises), online (agents look, from their own offices, at freely accessible data, which includes your public website), a hearing (the organisation is summoned to the Commission) and documentary (a letter with a questionnaire). Each ends with a written report, followed by a closure letter, a closure with observations, a formal notice, or sanction proceedings.

For a small business or club site, the most likely form is the online one, and what an agent sees is what a visitor sees. An application form with no information notice, a gallery of minors with no consent on file, a privacy policy that never mentions recruitment: all of it is readable from a browser. That is why the review below starts with the public pages.

Recruitment: follow one application through your site

Trace the path of a CV submitted on your careers page. Each step matches a rule of the GDPR and, in most cases, one of the nineteen fact sheets of the CNIL's recruitment guide. The CNIL also published a short version for small companies, "Recrutement et données personnelles dans les TPE/PME", from which the points below are taken.

The form. Only information that helps assess the candidate's ability to do the job belongs there. The CNIL lists the social security number, bank details and information about family members as excluded. A "marital status" field is one to remove.
The notice at the point of collection. Article 13 of the GDPR requires the information "at the time when personal data are obtained": the controller's identity, purpose and legal basis, recipients, retention period, the candidate's rights, the right to complain to the CNIL, and whether automated decision-making is used. On a website this means a paragraph under the form and a "Candidates" section in the privacy policy.
Retention. Article 5(1)(e) of the GDPR limits storage to what is necessary. For unsuccessful applications kept in a talent pool, the CNIL's guidance is a period that "in principle does not exceed two years" from the last contact. The CV sitting in the inbox since 2022 is past that point.
Who opens the applications. Only the people in charge of recruiting (managers, directors) access candidate data. A shared "contact@" mailbox read by the whole team does not meet that test.
The third-party recruitment tool. If applications pass through an external platform, that provider processes data on your behalf. Article 28 of the GDPR requires a written contract setting out the subject matter, duration, nature of the data and your instructions. Find it (often a data-processing annex to the service terms) and file it.
Automated screening. If the tool ranks or rejects candidates with no human involvement, Article 22 of the GDPR gives the candidate the right not to be subject to a decision based solely on automated processing. This is the first topic the CNIL names for 2026. For a small company the simple answer is a human read before any rejection.
The record of processing. The CNIL asks that recruitment files be entered in the record of processing activities. Article 30(5) of the GDPR exempts organisations with fewer than 250 employees unless the processing is not occasional, and recruiting every year is not occasional. The details are in our article on the record of processing.

One point of vocabulary. Large companies and recruitment agencies "as a priority" describes where the thematic inspections will go, not where the rules stop. An inspection prompted by a complaint from a rejected candidate depends on no theme at all.

The club or association: members, minors, photos, renewals

The 2026 theme names federations. But the CNIL's page on sports licences describes a chain: when a club fills in the licence application on the federation's website, the federation is the controller for its form, the club is the controller for its own membership form and acts as the federation's processor for the federal template; "a processing contract will have to be concluded between the federation and the club". A check on federations therefore leads to clubs. The CNIL's questions and answers on amateur sport give the club-side instructions.

The membership form. Members receive "all the information items provided for in articles 13 and 14 of the GDPR", placed on the membership form or in the club's booklet. For a minor, the information goes to the member and to the parent or legal representative.
The data collected. For a licence, the CNIL lists what is "adequate, relevant and limited to what is necessary": identity and contact details, age category, level, type of practice, fitness to take part, insurance. A members' area that asks for more collects too much, and that is the first point the CNIL says it will check.
The medical certificate. Handed over by the athlete, or by the legal representative for a minor, and passed on to the federation. It is health data: not for a shared folder open to every volunteer.
Photos. "Everyone has an exclusive and absolute right over their image." Before a photo goes on the club website, the CNIL asks the club to inform the athlete (or the legal representatives of a minor) of each intended use and to obtain prior authorisation. The public gallery of the under-13 team is the first place to look.
Renewal reminders. A former member's details may be kept "for a maximum of three years from the end of membership" for renewal campaigns, provided each message reminds the person that they can object simply and free of charge. After three years, without a positive and explicit reply, the data is deleted or archived.
Security. Article 32 of the GDPR requires measures "appropriate to the risk". For a members' area: individual passwords, access removed for volunteers who have left, an up-to-date website.

Who is not concerned

The single electoral register is "a file held by INSEE" used to manage electoral rolls, proxy votes and the mailing of election material. The inspections will look at how the file is used by those who have access to it. A company, a shop or an association has nothing to review on its website under this heading.

This month: the one-page review

Site element	Question to ask	Reference
Application form	Is an information notice visible before submission, stating the retention period?	GDPR, art. 13; CNIL guide, sheet 8
Inbox and recruitment tool	Have unsuccessful applications older than two years been deleted?	GDPR, art. 5(1)(e); CNIL, TPE/PME
External recruitment platform	Does the processing contract exist, and is it filed?	GDPR, art. 28
Automated CV screening	Does a person read before any rejection? Is the candidate told?	GDPR, art. 22; CNIL guide, sheet 13
Privacy policy	Does it have a candidates section, and a members section for a club?	GDPR, art. 12 to 14
Club photo gallery	Is there prior authorisation for each visible person, signed by the parents for minors?	CNIL, amateur sport
Members' area	Are the fields limited to the licence list? Are former members older than three years purged?	CNIL, sports licences; GDPR, art. 5(1)(e)
Record of processing	Are recruitment and membership management listed?	GDPR, art. 30

Checklist

The application form asks only for what helps assess suitability for the job.
A complete information notice sits with the form, stating the retention period and whether automated screening is used.
Unsuccessful applications are deleted no later than two years after the last contact, in the inbox as well as in the tool.
The list of people who can open applications is written down and short.
The processing contract with the recruitment platform has been located and filed.
For a club: the membership form carries the articles 13 and 14 notices of the GDPR, addressed to the parents of minors as well.
For a club: every published photo rests on prior authorisation; medical certificates are stored separately; the contract with the federation is signed.
The privacy policy describes these processing activities; the record lists them.

Check that your legal pages are present

The free Sitetals check reviews your home page and reports, among other things, whether a legal notice page or a privacy policy page is missing or unreachable, and which third-party services your site loads. It is a starting point for the review described above, not a replacement for it.

Run the free check

Also worth reading:

Sources: CNIL, "Les contrôles en 2026 : recrutement, répertoire électoral unique et fédérations sportives", 3 April 2026 · CNIL, "Comment se passe un contrôle de la CNIL ?" · CNIL, "Le guide du recrutement", 30 January 2023 · CNIL, "Recrutement et données personnelles dans les TPE/PME" · CNIL, "Licences sportives : les principales règles", 18 June 2024 · CNIL, "Sport amateur : questions-réponses", 4 August 2022 · Regulation (EU) 2016/679, articles 5, 12, 13, 22, 28, 30 and 32 · Sitetals methodology.

Sitetals editorial team