Cybercrime Lawyer: Cyber Defence and Digital Criminal Law

Preparing for a cyber crisis is usually approached as a technical and regulatory exercise. It is also, and first of all, an exercise in building evidence.

The 72-hour framework. That notification is provided for by Article 33 GDPR. What is written in it may be examined by the CNIL and by the judicial authorities alike, and may engage the liability of the company or of its executives. The time limit runs from discovery, not from the attack.

Three decisions are taken in those hours, and they are prepared in advance. Who drafts the notification, on what template and with what reservations. Whether the individuals concerned must be informed individually (Article 34), which conditions the flow of complaints to come. And whether the company files a criminal complaint as a victim, unauthorised access to a system being an offence under Articles 323-1 et seq. of the French Criminal Code.

The composition of the crisis cell. A cell bringing together a chief information officer, a data protection officer and a communications director produces technical and regulatory documents without anyone assessing their criminal-law implications. The Article 33 notification is not a form: it is a legal act, and each of its formulations shapes what follows.

The scope of legal professional privilege. Article 66-5 of the Act of 31 December 1971 protects, in all matters and in advisory work as much as in litigation, a lawyer’s opinions, the correspondence exchanged with the client and the documents in the case file. The report of an incident-response provider does not benefit from it. Article 56-1-2 of the French Code of Criminal Procedure sets privilege aside for advisory work in relation to a limited list of offences, which covers tax fraud, corruption and terrorist financing, and which includes neither offences against automated data processing systems nor failure to secure personal data.

The crisis exercise. A simulation whose deliverable concerns not the responsiveness of the teams but the documents they produced, and what a criminal case file would make of them, reveals vulnerabilities that no compliance audit brings to light.

After a cyberattack or a data breach, the company is not the only one exposed. Three risks add up, and they do not fall on the same person.

The company first answers to the CNIL for failing to secure the data, and the fine is not the only outcome: the decision is published. It may then be prosecuted for the same facts, with a fine several times higher than the one an individual would face. The executive, finally, may be prosecuted personally for the same failure to secure the data, and it is the executive whom investigators interview: first as the representative of the company that was attacked, then, sometimes in the same proceedings, as a person suspected of having breached their obligations.

To that exposure are added the risks opened up by the ransom demand, fraudulent transfer orders and phishing campaigns, which fall under other prosecutions, and the notification made to the CNIL within 72 hours, which is a statement by the company against itself.

The firm builds both positions at the same time, that of the company as victim and that of the company and its executive under investigation, from the first hours through to the hearing. Read the analysis on the criminal liability of company directors.

The investigation. Filing a complaint opens a preliminary investigation, most often conducted with the assistance of specialised services. It involves computer searches, seizures of media and of data, requisitions addressed to operators and hosting providers and, in organised crime cases, special investigative techniques.

The interview of the executive. The executive, the chief information officer or the head of security may be interviewed in two capacities: as representatives of the company that is the victim of the attack, and as persons who may have failed in the obligation to secure the data. The framework of the interview, whether as a witness, under free-status questioning or in police custody, determines the rights available, and the shift from one framework to another may occur in the course of the same proceedings.

The expert report. Classification depends on technical findings: point of entry, chronology of the intrusion, scope of the exfiltrated data, attribution. The court-appointed IT expert report becomes the central document in the file, and the discussion of its conclusions a defence issue in its own right.

The court seised. Depending on the scale and the organisation of the acts, the case remains with the territorial prosecution office, moves up to a specialised interregional court (JIRS), or falls to the national organised crime prosecutor (procureur de la Republique anti-criminalite organisee, in office since 5 January 2026) for organised cybercrime of very great complexity, which is the statutory criterion. The forum determines the resources deployed and the procedural regime that applies.

The interaction of the two sets of proceedings. The CNIL sanction procedure and the criminal proceedings run in parallel, on the same facts and often on the same documents. What is conceded before one resurfaces before the other.

An email or social media account taken over, a transfer obtained by a fake bank adviser or a fake website, an identity used to open a loan or to post in your name, private photos or conversations brandished to demand money: these situations belong before the criminal courts, and they move fast.

The first hours matter. Before anything else, the evidence must be secured: dated screenshots, page addresses, complete emails with their headers, bank statements, transfer references, the identifiers of the accounts involved. Where needed, the firm has the content recorded by a commissaire de justice and asks the platforms to preserve the account data before it is deleted.

A complaint is drafted, not merely lodged. Filed at a police station, it often comes down to a few lines taken by an officer, and the investigation starts without direction. Drafted by the lawyer and addressed to the public prosecutor, it sets out the facts in order, quantifies what was lost, attaches the evidence and states what the investigation must obtain: identification of the person behind an account or an address, freezing of the funds where they arrived, requests to banks and platforms. That is the complaint the firm drafts, and it is most often what separates a case that is dropped from an investigation that succeeds.

If the complaint goes nowhere, it is not lost. After three months without a reply from the prosecutor, or as soon as the prosecutor has announced a decision not to prosecute, a complaint with civil-party application may be filed before an investigating judge, who must then investigate. And older facts can still be prosecuted: for an offence of this kind, the time limit is six years from the facts.

The firm acts at each of these stages, from the first hours as well as months after the facts, and through to the hearing where compensation is decided.

A fake profile, a disposable email address or a foreign number do not put the author out of reach. Platforms and operators keep connection and identification data that the courts can demand. Since 18 August 2026, a French prosecutor or judge can apply directly to the major platforms established in another EU country to obtain that data within the time limit set by the European regulation.

This is often what separates a complaint that is dropped from one that succeeds: knowing what to ask for, from whom, and within what time before deletion. The firm makes those requests in the complaint, then through requests for investigative acts to the investigating judge when the investigation stalls. See the analysis on identifying the author of an anonymous account.

A summons for a voluntary interview, police custody (garde à vue) or a search of the home with seizure of computers and phones opens proceedings whose first hours shape everything that follows. A person in police custody has the right to a lawyer from the start of the measure, and the right to remain silent. Both are exercised before any statement is made.

During a search, investigators may access the data stored on the devices present and, from them, the online accounts and services connected to them; they may copy that data and seize the devices. They may also ask for codes and means of access. The unlock code of a phone raises a separate question: refusing to hand it over may, under certain conditions, constitute an offence, and the decision is taken in police custody, with the lawyer. See the analysis on the phone unlock code.

In these cases, the evidence is technical: connection logs, addresses, analysis reports on the seized devices, expert reports. The firm addresses their scope from the investigation stage, asserts legitimate access and the shared use of a device or a connection, and challenges findings that the file does not support. It acts in police custody, during the investigation or judicial inquiry, and before the court.

• Screenshots, page addresses and complete emails, with their headers.
• Bank statements and the references of transfers or payments.
• The identifiers of the accounts concerned, yours and those of the suspected author.
• Your exchanges with the bank, the platform or the operator.
• The summons, the record or the notice received, if proceedings are already under way.

You do not need to have gathered everything before calling: from the first conversation, the firm tells you what is missing and how to obtain it.

Yes, and without delay. The complaint opens the investigation that makes it possible to identify the author and to have the data preserved before it is deleted. A complaint drafted by the lawyer and addressed to the public prosecutor, with the evidence and the investigative requests, carries more weight than a statement taken at a police station. The firm drafts it and follows it up.

Often, yes. Platforms and operators keep identification and connection data that the courts can demand, including from the major platforms established in another EU country since 18 August 2026. It still has to be requested, in time: that is what the firm does in the complaint, then through requests for investigative acts.

A complaint with civil-party application may be filed before an investigating judge, as soon as the prosecutor has announced a decision not to prosecute or after three months without a reply. The judge is then bound to investigate. The firm drafts that complaint and follows the judicial inquiry.

As early as possible for the evidence, which disappears fast. As for the prosecution itself, an offence of this kind may be prosecuted for six years from the facts. Older facts are therefore not lost.

Yes. In a voluntary interview as in police custody, you have the right to be assisted by a lawyer and the right to remain silent. What is said at that first interview weighs on everything that follows. The firm prepares the interview with you and attends it.

The question is decided case by case and with the lawyer. Refusing to hand over a decryption code may, under certain conditions, constitute an offence; in other cases, it cannot be held against you. The firm examines the situation before any answer is given.

Fees are set in a written agreement, provided before any work is undertaken, after a first conversation about the situation.

The law does not prohibit it, but the authorities advise against it, and for a business the payment is covered by insurance only if a complaint was filed within 72 hours of becoming aware of the attack. Paying exempts the company neither from notifying the CNIL nor from answering for any failure to secure the data. The decision is taken in the crisis unit, with the technical and legal elements, and the firm takes part in it.

An IP address identifies a subscription, not a person: a shared connection, a company network, a compromised device or an open Wi-Fi leave the same trace. Attribution requires other evidence, and an investigating court has already dismissed an intrusion attributed to a company’s IP address once the accused proved he was abroad that day. The firm raises these points from police custody onwards.

No. Where the policy includes legal protection cover, the insured chooses their lawyer freely, and the insurer can only suggest one. The policy does, however, set the ceiling on the fees it covers. The firm works with the insurer and the technical providers it appoints, while answering only to the company or executive it defends.

Investigators may access the data on the devices present and, from them, the online accounts and spaces linked to them, copy that data and seize the devices, which are placed under seal. They may require any person to provide the information needed to access protected data: not answering exposes you to a fine, and refusing to hand over a decryption key may be a separate offence. What is said and handed over during the search shapes what follows; the lawyer steps in from the police custody that often follows it.

Yes, on two counts: criminally, if the investigation shows it failed to apply the security measures it owed for the data it processed, and civilly, for the client’s compensation. The host, software vendor or outsourcer is often first heard as a witness, then placed under investigation. The firm assists providers from the first interview and argues, document by document, the allocation of responsibilities set by the contracts.