Loi n° 2022-59, notification des violations de données

Loi n° 2022-59, arts. 83 et 86 (notification des violations de données à caractère personnel)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

Notify the HAPDP of a personal data breach without delay after becoming aware of it, and justify to the HAPDP any notification made outside that timeframe.
Notify the affected person of a personal data breach as soon as possible when it is likely to create a high risk to their rights and freedoms; you need not notify the person where it is reasonable to believe the breach creates no such risk.
As a data processor, notify the controller of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it.

What it reaches

Obligation class

Breach notice, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 83 requires the controller to notify the HAPDP of a personal data breach without delay after becoming aware of it, and to justify to the HAPDP any notification made outside that timeframe. The controller must also notify the affected person as soon as possible when the breach is likely to create a high risk to their rights and freedoms, and is excused from notifying the person only where it is reasonable to believe the breach creates no such risk.

Article 86 requires a data processor to notify the controller of a personal data breach as soon as possible and, at the latest, within 72 hours of becoming aware of it.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
operates_essential_service

Read the law

Loi n 2022-59 du 16 decembre 2022, version consolidee, Haute Autorite de Protection des Donnees a Caractere Personnel

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app