France

société EXTIA

300,000 €

GDPR enforcement action by French Data Protection Authority (CNIL) on 2026-21-07.

Rank · Sector

#60

of 636 in Industry and Commerce

Rank · France

#41

of 76

Rank · All fines

#327

of 3,197

Case details

Authority: French Data Protection Authority (CNIL)
Date: 2026-21-07
Controller / Processor: société EXTIA
Sector: Industry and Commerce
Quoted Articles: Art. 12 (3) GDPR, Art. 17 (1) GDPR
Type of violation: Insufficient fulfilment of data subjects rights

Summary

The French DPA has imposed a fine of EUR 300,000 on société EXTIA. The controller offers consultancy services in IT and engineering, recruiting consultants and deploying them to work on different client projects. In 2024 the French DPA received complaints from data subjects stating that their requests for erasure were not being met. Subsequent inspections revealed that over 75 % of data subject requests had been handled inadequately. In twelve cases the data subjects' requests were never processed by the controller. In 166 cases data subjects were not informed about the processing of their requests and in a further 27 cases data subjects were informed about the handling of their requests too late. In some cases the authority found that handling the requests was not possible due to the inability to identify the relevant data subjects.

Open original source Links to the regulator's original publication or another source.