Friday, 9 p.m.
A mid-sized company finds out on a Friday evening that its servers are encrypted. On Monday morning its CIO wonders who to call first, and the question comes late: at 9 p.m. on Monday the 72 hours for the complaint have run out, and with them any insurance indemnity, restoration costs and business interruption included. The weekend counts.
The first hour
17Cyber, launched on December 17, 2024, by the police, the gendarmerie and Cybermalveillance.gouv.fr, answers 24 hours a day: an online diagnosis, a call with a police officer or gendarme if the attack is serious, and a referral to a vetted or certified incident response provider (press release of December 16, 2024).
In the same hour, pull out the insurance policy if there is one, and write down, off the affected network, its assistance number and its claims notice period. A policy saved on the encrypted server can no longer be read.
Then open the breach register. Article 33(5) of the GDPR requires every controller to keep one, even when it does not notify, and the CNIL can ask to see it.
Before hour 72: the police complaint
The law of January 24, 2023 (known as LOPMI) created Article L. 12-10-1 of the Insurance Code, in force since April 24, 2023. It makes any insurance indemnity for an attack on an automated data processing system conditional on a complaint filed no later than 72 hours after the victim becomes aware of the attack. It applies to legal entities and to individuals acting in a professional capacity; private individuals are outside it. The rule is a matter of public policy, so no policy wording can set it aside (Lexology).
Four points get lost in the summaries.
- The rule covers any indemnity. The bill spoke of ransom; the debates replaced it with general wording. Restoration, business interruption and ransom all fall away if the complaint is missing.
- The clock starts when the attack becomes known, not at the intrusion, which may be weeks old. The bill said 48 hours; amendments moved it to 72 to match the CNIL deadline. The law does not define awareness: some brokers place it at firm confirmation of the attack, a market reading the statute leaves open.
- An online pre-complaint is not enough. A complaint has to be filed.
- The complaint is necessary, never sufficient. It allows the insurer to pay what the policy covers; it says nothing about what the policy covers.
Before hour 72: the CNIL, if personal data is affected
Article 33 of the GDPR gives the controller 72 hours after becoming aware of a breach to notify the CNIL, through its online service (CNIL, notifying a breach). If the investigation is not finished, the notification can go in phases; after the deadline, it has to give the reasons for the delay. A breach "unlikely to result in a risk" to individuals still goes in the register, though not to the CNIL.
The individuals affected are told "without undue delay" when the risk is high (Article 34). The text allows three exceptions: encrypted data whose keys stayed secure, later measures that remove the risk, and disproportionate effort, in which case a public notice replaces individual letters. The CNIL can order the notice.
The two clocks do not necessarily start at the same minute. One runs from awareness of the attack, the other from awareness of a personal data breach, and the investigation can put hours between them.
The insurer: the notice period in the policy
The claim notice follows the period set in the policy. The law only forbids setting it below five business days, or two for theft (Article L. 113-2, 4°, of the Insurance Code). The assistance line in the policy is often reachable much earlier: it is the number written down in the first hour. Your broker or your insurer confirms the exact period.
Late notice forfeits cover only if a clause provides for it and the insurer proves the delay caused it harm (same article, last paragraph). The Second Civil Chamber of the Cour de cassation required checking that the policy actually provided for forfeiture (July 4, 2019, No. 18-18.444), then held unenforceable a clause demanding notice in under five business days (January 21, 2021, No. 19-13.347).
Sector regimes
An operator of vital importance (OIV) reports incidents affecting its critical systems to ANSSI "without delay" (Article L. 1332-6-2 of the Defense Code). An operator of essential services or a digital service provider does the same under the law of February 26, 2018, the NIS 1 regime still in force in France (ANSSI, regulatory notifications).
NIS 2 does not yet apply in France. Directive (EU) 2022/2555 provides for an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report one month later (Article 23(4)). As of October 11, 2026, the "Resilience" bill transposing it had not passed: its October 7 sitting in the National Assembly had been pulled from the agenda the day before, and on July 8, 2026, the Commission referred France, Ireland, Spain and the Netherlands to the Court of Justice for failure to transpose. Those deadlines will apply once the law is published.
A bank, an insurer or an asset manager falls under DORA: initial notification to the ACPR or the AMF within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it, an intermediate report 72 hours after the initial notification, and a final report one month after the last intermediate report (Article 19 of Regulation (EU) 2022/2554; Article 5 of Delegated Regulation (EU) 2025/301). A trucking company is not in scope.
Before any payment
Paying a ransom to a group on a sanctions list is prohibited from the first euro, however urgent the situation. That case has its own page: is it illegal to pay a ransomware demand to a sanctioned group?
From hour zero to day 30
- Hour 0: 17Cyber; the policy, its assistance number and its notice period written down off the network; the breach register opened.
- Without delay: an OIV, an operator of essential services or a digital service provider reports to ANSSI.
- 4 hours after classification, 24 hours at the latest: a financial entity files its initial DORA notification.
- 24 hours: a NIS 2 entity sends its early warning, once the French law is published.
- Before any payment: the ransom recipient screened against sanctions lists.
- 72 hours at the latest: the police complaint filed; the CNIL notified if personal data is affected; the NIS 2 notification, once it applies.
- 72 hours after the initial notification: the DORA intermediate report.
- Within the policy's notice period, never under five business days: the claim notice.
- Without undue delay: notice to the individuals affected, if the risk is high.
- Day 30: the NIS 2 final report, one month after the notification; the DORA one, one month after the last intermediate report.
This page sets out the legal deadlines and does not say what a policy covers. For a specific case: a broker registered with ORIAS, a lawyer, and Cybermalveillance.gouv.fr.