CNIL, web filtering and GDPR: when law meets technology

OP-ED · 9 OCTOBER 2025

With Gaëlle Tilloy, lawyer, and Jérôme Beaufils, CEO of SASETY · Lire en français

An interview with Gaëlle TILLOY, attorney at the Paris Bar specialising in new technologies and personal data, and Jérôme BEAUFILS, CEO of SASETY, SASE managed services operator and strategic partner of Cato Networks.

On 28 July 2025, the French data protection authority (Commission Nationale de l'Informatique et des Libertés, CNIL) published a draft recommendation on web filtering, submitted for public consultation.

The CNIL wants to issue recommendations so that increasingly complex cybersecurity products comply with data regulations.

This draft goes beyond simple technical advice: it stresses that cybersecurity technologies involve data processing and should be designed with the GDPR in mind.

Securing an information system now requires fully integrating GDPR requirements: minimising collection, limiting data retention, securing access and guaranteeing confidentiality.

To understand the stakes and the concrete answers, Gaëlle Tilloy and Jérôme Beaufils share a joint interview.

“A draft that sets a new standard”

What does this CNIL draft change for companies?

Gaëlle Tilloy:

“Until now, web filtering was seen above all as an IT security tool: blocking malicious sites, controlling the use of resources, ensuring traceability of access. The CNIL reminds us that these systems necessarily involve processing personal data. An IP address, a URL visited, the time of access… once correlated, this data can identify an individual.

From then on, the GDPR principles fully apply:

Minimisation: collect only the essentials (IP, domain, timestamp, category, action).
Limited retention period.
Security: encryption, multi-factor authentication, control of access to logs.
Accountability: providers must be unable to identify end users.

This forces employers to rethink their practices, or risk non-compliance.”

“A constraint, and also a protective framework”

Won't these requirements complicate the daily work of CIOs and CISOs?

Gaëlle Tilloy:

“It is true that this adds a layer of complexity, especially for CIOs who already manage hybrid environments with multiple security products. But it is also a protective framework.

We know that disputes over excessive employee monitoring or poor log management are on the rise. With this draft recommendation, the CNIL provides a clear framework to avoid these pitfalls.

In reality, this is about strengthening security by design. Companies must make sure their filtering tools leave no room for abuse, for example using browsing logs to monitor employees improperly.”

“Cato Networks builds compliance into the technology”

In practice, how does a technology like Cato Networks help meet these obligations?

Jérôme Beaufils:

“The advantage of Cato Networks is that it designed its SASE Cloud platform as a global service, unifying networking and security. Web filtering functions are built in natively and already designed for compliance.

A few examples:

Logs: by default they are limited to the essential fields (IP, domain, timestamp). Nothing excessive.
Retention period: configurable, with a recommended limit of six months to match the CNIL's prescriptions.
TLS inspection: selective, with dynamic allow lists. Banking or medical traffic can be left encrypted, which reduces the risk of processing sensitive data.
Access security: every administrator must use multi-factor authentication, and RBAC roles allow rights to be assigned on a least-privilege basis.
Anonymisation: in SaaS mode, user identifiers are irreversibly hashed. Even Cato cannot trace them back to the end user.

This is compliance built into the design of the product from the start, rather than an afterthought.”

“Cybersecurity compliant by default”

And on the operational security side, what additional guarantees are there?

Jérôme Beaufils:

“Cato applies strong encryption to all traffic and logs. Logs can be exported to a corporate SIEM, always in a standardised, filtered format.

The architecture itself is a guarantee of security: more than 85 points of presence worldwide, ensuring filtering takes place as close as possible to the user, with minimal latency and native high availability.

This frees CISOs and CIOs from having to choose between security and performance: both are guaranteed.”

“SASETY turns technology into operational compliance”

What role does SASETY play in this set-up?

Jérôme Beaufils:

“Our added value is to translate these technological capabilities into compliance that can be operated and audited. We work on several levels:

Initial audit: identify which data flows are collected, check their proportionality, align with Article 32 of the GDPR.
Filtering policies: define rules adapted to each business function, since an HR department has different needs from an IT team or a subcontractor.
Compliant logging: set the retention period, enable anonymisation, configure allow lists to limit TLS inspection.
Operational security: mandatory MFA, strict role management, confidentiality clauses signed by administrators.
Continuous monitoring: we monitor traffic, detect anomalies and produce compliance reports that the DPO or management can use directly in the event of a CNIL inspection.

In short, we make sure the company can demonstrate at any time that its cybersecurity is compliant by default.”

“Constraint or opportunity?”

Ultimately, is this a constraint or an opportunity for companies?

Gaëlle Tilloy:

“Both. It is a constraint because practices will need to be adapted, some architectures reviewed and perhaps new tools invested in. But it is also a great opportunity to show digital maturity. A company that applies these recommendations strengthens the trust of its employees, clients and partners. In a context where data is a strategic asset, this trust becomes a competitive advantage.”