How do I report the loss of my data to the CNIL?
In case of accidental destruction or loss of personal data, such loss or destruction shall be notified, according to articles 33 and 34 of the General Data Protection Regulation ("GDPR"), by the data controller to:
The competent supervisory authority (the CNIL for France), where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons;
the data subjects without undue delay if the destruction or loss is likely to result in a high risk to the rights and freedoms of natural persons.
If you are not the data controller, the data controller shall be notified of the destruction or loss, without undue delay in order to be able to apply, if necessary, the aforesaid notices. https://www.cnil.fr/fr/les-violations-de-donnees-personnelles