What is the real question for a small business?

Practical question: if a vendor, employee, or compromised account exposes customer data tomorrow morning, does your company know how to respond without improvising? On October 1, 2026, the CNIL and Cybermalveillance.gouv.fr published a new guide to help organizations react to a data breach, with a very operational approach: actions from the day of discovery through day 30. The CNIL says the resource helps teams quickly identify the right reflexes and anticipate the risks.

The deeper shift is simple: incident response is no longer only a technical matter. It becomes a sequence of dated, traceable, repeatable decisions. For SMBs, this especially affects organizations handling customer, HR, invoicing, support, or prospecting data, and those relying on SaaS tools, accountants, payroll providers, or managed service partners. The ANSSI’s September 29, 2026 incident report on the DGFiP also shows that cyberattacks and delayed detection require a structured response capability, not just tools.

  • SMBs handling personal data or outsourced access are the first to care.
  • The key move is no longer “deal with it later” but document who acts immediately.
  • A breach becomes a governance issue, not just an IT issue.

What the announcement changes in business decision-making

Publication date: October 1, 2026. Context: Cybermois 2026, the European cybersecurity awareness month held in October. The CNIL–Cybermalveillance support does not create a new legal obligation by itself; it changes the reasonable way to prepare. In other words, do not confuse a practical resource with a new rule.

The decision now is whether you handle an incident ad hoc or according to a written scenario. The second option reduces hesitation on three points: identifying the breach, classifying the exposed data, and timing notifications and remediation. The CNIL notes that a personal data breach can range from unauthorized disclosure to unauthorized access; the definition matters because it drives risk analysis and the next steps.

In practice, the guide pushes leaders to settle three questions before the crisis hits: who can isolate an account, who contacts the vendor, and who approves external communication. Without that clarity, the business loses time exactly when customers want answers, not guesses.

  • Key decision: activate an incident runbook or keep improvising.
  • The guide helps sequence actions; it does not replace management judgment.
  • Evidence of action matters nearly as much as the action itself.

A simple method: the 3×3 plan for the first 30 days

Here is a simple method that works even without a full-time security lead. It uses 3 questions, 3 roles, and 3 forms of evidence.

1) Three questions: what happened? which data are affected? what is the risk to people and to the business? 2) Three roles: a business decision-maker, a technical lead, and a compliance/legal lead. 3) Three forms of evidence: an event log, an action list, and copies of messages sent. This mirrors the CNIL–Cybermalveillance approach, which is organized from day 0 through day 30.

Fictional numerical example: a 28-person SMB suffers a mailbox takeover on the sales team, exposing 1,200 prospect and customer contacts. On day 0, it cuts the session, resets access, and freezes evidence within 90 minutes. On day 1, it classifies the exposed data, identifies affected people, and drafts the internal notice. By day 3, it decides whether a notification is required. The direct cost is not the only issue: the real saving comes from reducing disorder, not from any magical productivity win.

  • Day 0: contain and document.
  • Day 1 to day 3: qualify and decide.
  • Day 7 to day 30: notify, fix, test, then archive.

Limits, uncertainties, and what to watch

Important limit: the CNIL–Cybermalveillance guide is a practical aid, not a substitute for a case-specific legal analysis. If your sector is regulated, if sensitive data are involved, or if subcontractors create gray areas, you need a case-by-case review. Public sources cannot tell you in advance which future breach will hit your company, or exactly which notifications will be required in a specific file.

Another uncertainty: the real scale of an incident depends as much on your digital hygiene as on the attack itself. CERT-FR continues to publish weekly bulletins showing that exploitable vulnerabilities and compromises remain common in late 2026; the message for SMBs is clear: do not wait for the “big incident” to get organized.

  • The guide does not replace your lawyer, DPO, or IT provider.
  • Notifications depend on the exact context.
  • The real emergency is cutting decision delay.

A 7-day action checklist

Day 1 — Owner: CEO. Observable result: a one-page escalation map exists and names 3 reachable people.

Day 2 — Owner: IT lead or vendor. Observable result: the list of critical access rights is exported and dated.

Day 3 — Owner: GDPR lead/DPO. Observable result: an incident log template is ready, with time, action, author, and attached evidence.

  • Day 4 — Owner: leadership. Observable result: a short internal message template is approved.
  • Day 5 — Owner: customer-facing team. Observable result: a short customer FAQ is ready.
  • Day 6 — Owner: IT vendor. Observable result: the account reset procedure is tested on a non-critical account.
  • Day 7 — Owner: leadership. Observable result: a 20-minute exercise was run and one weak point was recorded in the minutes.