[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu9guiXh6tTMdwuw6V33v6rhpMh9oRBEPyyFjSVK9rK0":3},{"assets":4,"aiSystems":5,"attachments":6,"tags":7,"dataRetentionRules":20,"creatorUser":172,"creatorUserId":25,"updatedBy":173,"updatedById":25,"publishedBy":27,"publishedById":27,"areaOwnerId":27,"owners":174,"customFields":175,"area":176,"entity":180,"mergedFrom":27,"workflowStep":181,"accountables":187,"responsibles":188,"informedOwners":189,"securityMeasures":190,"personCategories":389,"id":36,"source":54,"label":37,"state":186,"versionDescription":27,"processingType":43,"parentId":27,"areaId":42,"mergeType":27,"readonly":28,"editable":185,"workflowStepId":182,"dateDeployment":27,"dateCreation":41,"dateArchived":27,"datePublication":27,"archived":28,"dateUpdate":40,"reviewDate":27,"nextReviewDate":27,"ref":27,"processingState":27,"description":38,"descriptionHtml":417,"subjectRightProcessDescription":27,"rightOfInformation":418,"rightOfAccess":419,"rightOfRectification":419,"rightOfErasure":419,"rightOfRestriction":419,"rightOfOpposition":419,"rightOfDataPortability":419,"advanceDirectives":419,"advanceDirectivesDescription":27,"rightOfInformationDescription":420,"rightOfAccessDescription":27,"rightOfRectificationDescription":27,"rightOfErasureDescription":27,"rightOfRestrictionDescription":27,"rightOfOppositionDescription":27,"rightOfDataPortabilityDescription":27,"stakeHolders":421,"assessmentScoring":28,"automaticDecision":28,"systematicMonitoring":28,"specialCategoryData":28,"largeScaleCollection":28,"crossReferencing":28,"vulnerablePeople":185,"isDPIARequired":28,"dpiaDate":27,"dpiaExemption":28,"dpiaExemptionJustification":27,"innovativeUse":28,"exclusionBenefitRightContract":28,"recipients":422,"dataControllers":478,"purposes":479,"progression":502,"quality":503,"sensitivity":504,"visible":185,"workspaceId":39,"nbReferences":30,"referenceId":27},[],[],[],[8,13,16],{"id":9,"label":10,"type":11,"color":12},"99e6f156-5bd7-4bc1-94c7-7f416665cf20","Organisme : Privé","DataProcessing","#64748B",{"id":14,"label":15,"type":11,"color":12},"5494cd34-13e6-4954-81cd-000195723eb0","Organisme : Public",{"id":17,"label":18,"type":11,"color":19},"a680bc18-6adc-4655-ba78-cbc42b58e390","Fonction : Ressources humaines","#B45309",[21,89,130],{"customFields":22,"tags":23,"creator":24,"readonly":28,"purposes":31,"dataProcessings":34,"dataFields":44,"asset":27,"subjectCategories":79,"id":80,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":81,"description":27,"dateCreation":82,"dateUpdate":83,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":84,"baseActiveLegalBasis":85,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":84,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":86,"destructionLegalBasis":27,"dataSetSource":87,"sourceDescription":88,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},1602,"bc4946f8-1de1-4b70-bb67-62a0ce536160",null,false,"#4DE034",0,[32,33],"3411b675-c4be-4007-b56c-b7cca1a71994","479150d9-da67-4627-bb01-2e996e37ac7d",[35],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},"1a723fa1-4d1f-463d-36c8-08df38010b74","Gestion des procédures disciplinaires","Ce modèle de traitement est relatif à la gestion des procédures disciplinaires à l'égard des salariés ou des agents : convocation, entretien préalable, prononcé et notification de la sanction, traitement des recours et des contentieux, puis gestion de l'historique des sanctions jusqu'à leur effacement.",68,"2026-11-03T07:45:26.5901934","2026-11-03T07:45:25.5094653",354,"Default",[45,55,61,67,73],{"id":46,"customFields":47,"ref":27,"archivingPolicy":27,"required":28,"label":48,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":51,"dateUpdate":27,"creator":52,"workflowStepId":53,"workflowStep":27,"source":54},"e0e27b14-9d1c-4212-027d-08df38010ba5",{},"Nom, prénom et fonction du salarié convoqué","Current","ProfessionalLife","2026-11-03T07:45:17.5627793",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},83450,"Api",{"id":56,"customFields":57,"ref":27,"archivingPolicy":27,"required":28,"label":58,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":59,"dateUpdate":27,"creator":60,"workflowStepId":53,"workflowStep":27,"source":54},"b4e9a793-8934-41b7-027e-08df38010ba5",{},"Date de connaissance des faits par l'employeur","2026-11-03T07:45:17.8829522",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":62,"customFields":63,"ref":27,"archivingPolicy":27,"required":28,"label":64,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":65,"dateUpdate":27,"creator":66,"workflowStepId":53,"workflowStep":27,"source":54},"b6112dee-d9eb-4d3e-027f-08df38010ba5",{},"Description des faits reprochés et pièces versées au dossier","2026-11-03T07:45:18.2165055",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":68,"customFields":69,"ref":27,"archivingPolicy":27,"required":28,"label":70,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":71,"dateUpdate":27,"creator":72,"workflowStepId":53,"workflowStep":27,"source":54},"fec1b010-8f77-4ff9-0280-08df38010ba5",{},"Date, lieu et compte rendu de l'entretien préalable","2026-11-03T07:45:18.5576149",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":74,"customFields":75,"ref":27,"archivingPolicy":27,"required":28,"label":76,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":77,"dateUpdate":27,"creator":78,"workflowStepId":53,"workflowStep":27,"source":54},"77f58845-c7a0-48fe-0281-08df38010ba5",{},"Identité de la personne qui assiste le salarié","2026-11-03T07:45:18.8761419",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"2486ae53-9cb1-498b-df11-08df38010b98","Convocation et entretien préalable","2026-11-03T07:45:22.4238933","2026-11-03T07:45:23.3875152","","Article L1332-4 du code du travail (délai de deux mois pour engager les poursuites) : il fixe un délai pour agir, pas une durée de conservation.","À l'issue de la durée de conservation, les données sont supprimées de manière sécurisée ou anonymisées de façon irréversible.","Direct","Durée indicative, non imposée par un texte : fixée par le responsable de traitement selon la finalité (art. 5.1.e du RGPD). Aucune source officielle retrouvée. Le référentiel CNIL de 2026 ne prévoit pas de ligne pour les dossiers de sanction hors contentieux.",{"customFields":90,"tags":91,"creator":92,"readonly":28,"purposes":93,"dataProcessings":95,"dataFields":97,"asset":27,"subjectCategories":122,"id":123,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":124,"description":27,"dateCreation":125,"dateUpdate":126,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":127,"baseActiveLegalBasis":128,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":84,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":86,"destructionLegalBasis":27,"dataSetSource":87,"sourceDescription":129,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[33,94],"3efcde4a-c6e1-4e92-92b0-321a6c31fbeb",[96],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[98,104,110,116],{"id":99,"customFields":100,"ref":27,"archivingPolicy":27,"required":28,"label":101,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":102,"dateUpdate":27,"creator":103,"workflowStepId":53,"workflowStep":27,"source":54},"46f8e50d-4291-4530-0282-08df38010ba5",{},"Nature de la sanction (avertissement, mise à pied, mutation, rétrogradation, licenciement)","2026-11-03T07:45:19.1922832",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":105,"customFields":106,"ref":27,"archivingPolicy":27,"required":28,"label":107,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":108,"dateUpdate":27,"creator":109,"workflowStepId":53,"workflowStep":27,"source":54},"9d3f6cd2-5c7f-491c-0283-08df38010ba5",{},"Motifs de la sanction","2026-11-03T07:45:19.4794788",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":111,"customFields":112,"ref":27,"archivingPolicy":27,"required":28,"label":113,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":114,"dateUpdate":27,"creator":115,"workflowStepId":53,"workflowStep":27,"source":54},"f16c86bb-4aac-4f69-0284-08df38010ba5",{},"Date de notification de la sanction","2026-11-03T07:45:19.8020868",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":117,"customFields":118,"ref":27,"archivingPolicy":27,"required":28,"label":119,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":120,"dateUpdate":27,"creator":121,"workflowStepId":53,"workflowStep":27,"source":54},"bedee587-b73c-4a73-0285-08df38010ba5",{},"Mention d'une éventuelle amnistie ou date d'effacement","2026-11-03T07:45:20.0600001",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"17ab809b-02e9-49f5-df12-08df38010b98","Sanction notifiée","2026-11-03T07:45:23.7833447","2026-11-03T07:45:24.5241226","Durée pendant laquelle la sanction peut être invoquée à l'appui d'une nouvelle sanction : trois ans à compter de l'engagement des nouvelles poursuites au plus (art. L1332-5). À fixer par l'employeur.","Article L1332-5 du code du travail : une sanction de plus de trois ans ne peut plus être invoquée à l'appui d'une nouvelle sanction. Ce texte limite l'usage de la sanction, il ne fixe pas de durée de conservation.","Durée indicative, non imposée par un texte : fixée par le responsable de traitement selon la finalité (art. 5.1.e du RGPD). Aucune source officielle retrouvée. Le délai de trois ans de l'article L1332-5 est une limite d'utilisation de la sanction et non une obligation d'effacement.",{"customFields":131,"tags":132,"creator":133,"readonly":28,"purposes":134,"dataProcessings":136,"dataFields":138,"asset":27,"subjectCategories":163,"id":164,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":165,"description":27,"dateCreation":166,"dateUpdate":167,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":168,"baseActiveLegalBasis":169,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":170,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":86,"destructionLegalBasis":27,"dataSetSource":87,"sourceDescription":171,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[135],"662474fb-0ae7-40c3-b787-b5b0ee915020",[137],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[139,145,151,157],{"id":140,"customFields":141,"ref":27,"archivingPolicy":27,"required":28,"label":142,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":143,"dateUpdate":27,"creator":144,"workflowStepId":53,"workflowStep":27,"source":54},"f1bbc81d-9866-4e04-0286-08df38010ba5",{},"Courrier de contestation ou de recours du salarié","2026-11-03T07:45:20.4226224",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":146,"customFields":147,"ref":27,"archivingPolicy":27,"required":28,"label":148,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":149,"dateUpdate":27,"creator":150,"workflowStepId":53,"workflowStep":27,"source":54},"9576c5e3-950e-448e-0287-08df38010ba5",{},"Références de la procédure (juridiction, numéro de dossier)","2026-11-03T07:45:20.7209625",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":152,"customFields":153,"ref":27,"archivingPolicy":27,"required":28,"label":154,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":155,"dateUpdate":27,"creator":156,"workflowStepId":53,"workflowStep":27,"source":54},"3b999a53-88e3-457c-0288-08df38010ba5",{},"Pièces et échanges avec le conseil de l'employeur","2026-11-03T07:45:21.0276209",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":158,"customFields":159,"ref":27,"archivingPolicy":27,"required":28,"label":160,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":161,"dateUpdate":27,"creator":162,"workflowStepId":53,"workflowStep":27,"source":54},"cde8e275-6bcf-4a03-0289-08df38010ba5",{},"Décision rendue et voies de recours exercées","2026-11-03T07:45:21.5821221",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"a23cde6d-3cfd-410e-df13-08df38010b98","Recours et contentieux disciplinaire","2026-11-03T07:45:24.8710367","2026-11-03T07:45:25.2736386","À compter du début du contentieux et le temps du litige","Droits de la défense (article 6 de la CEDH), selon le référentiel CNIL de 2026 (ligne « Gestion des dossiers juridiques », classée obligation).","Jusqu'à épuisement des voies de recours","Durée fixée par le référentiel CNIL « durées de conservation, gestion des ressources humaines » (publié le 2 avril 2026, mis à jour le 20 mai 2026), rubrique Gestion du contentieux et du précontentieux : le temps du litige en base active, puis jusqu'à épuisement des voies de recours. Pas de nombre de mois fixe.",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],{},{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":177,"parentId":27,"ref":27,"label":178,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":179,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},"Entity","Entité","FR",{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":177,"parentId":27,"ref":27,"label":178,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":179,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},{"id":182,"label":183,"color":184,"order":30,"itemLimit":27,"type":11,"finalStep":28,"initialStep":185,"authorizedRole":27,"authorizedRoleId":27,"descriptionHtml":27,"mappedState":186},9439,"A compléter","#CCCCCC",true,"Draft",[],[],[],[191,205,217,228,241,252,263,273,283,294,305,315,325,336,347,358,368,378],{"date":192,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":194,"id":195,"ref":27,"label":196,"type":197,"description":198,"relatedRisk":27,"moreDetailsUrl":199,"dateCreation":200,"dateUpdate":27,"tags":201,"attachments":202,"creatorUser":203,"workflowStepId":204,"workflowStep":27},"2026-11-03T11:38:08.1040914Z","Done",{},"beba9da4-69b2-451b-69b0-08df38010b92","Pilotage de la sécurité des données","Organizational","L’intégration de la protection des données personnelles dans les processus de décision de l’organisme permet d’en assurer la prise en compte dans la durée et aux moments clés d’arbitrages des budgets et des projets. Les précautions élémentaires Impliquer la direction et formaliser des objectifs généraux en matière de sécurité et de protection des données personnelles, validés par la direction de l’organisme.","https://www.cnil.fr/fr/securite-piloter-la-securite-des-donnees","2026-11-02T20:57:37.2709862",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},90384,{"date":206,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":207,"id":208,"ref":27,"label":209,"type":197,"description":210,"relatedRisk":27,"moreDetailsUrl":211,"dateCreation":212,"dateUpdate":213,"tags":214,"attachments":215,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040948Z",{},"cde1cad2-4195-4ffe-9406-08dd823909d1","Cadre d'usage des utilisateurs","La charte doit rappeler les règles de protection des données et les sanctions possibles, définir son champ d’application (interventions informatiques, moyens d’authentification) et énoncer les règles de sécurité : signaler toute tentative d’intrusion, garder ses identifiants secrets, ne pas installer ni modifier de logiciels sans autorisation, verrouiller son poste en cas d’absence, n’accéder qu’aux informations utiles et respecter la procédure pour copier des données sur supports amovibles. Elle précise aussi les conditions d’usage des équipements informatiques et télécoms (poste de travail, matériels nomades, stockage, réseaux, appareils personnels, Internet, messagerie, téléphonie), les modalités d’administration du système (filtrage, traçabilité, gestion des postes) ainsi que les responsabilités et sanctions en cas de manquement.","https://www.cnil.fr/fr/securite-definir-un-cadre-pour-les-utilisateurs","2025-04-25T07:14:13.031896","2026-11-02T20:57:14.658541",[],[],90385,{"date":218,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":219,"id":220,"ref":27,"label":221,"type":197,"description":222,"relatedRisk":27,"moreDetailsUrl":223,"dateCreation":224,"dateUpdate":225,"tags":226,"attachments":227,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040955Z",{},"d77a94b8-cd42-409c-a02e-323ffad3924a","Sensibilisation et formation des utilisateurs","Les erreurs humaines et les attaques par ingénierie sociale sont à l’origine d’un nombre important d’incidents de sécurité. Les solutions techniques ne sont pas suffisantes pour assurer la protection des données personnelles détenues par un organisme.","https://www.cnil.fr/fr/securite-impliquer-et-former-les-utilisateurs","2019-01-01T00:00:00","2026-11-02T20:57:16.1776695",[],[],{"date":229,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":230,"id":231,"ref":27,"label":232,"type":233,"description":234,"relatedRisk":235,"moreDetailsUrl":236,"dateCreation":237,"dateUpdate":238,"tags":239,"attachments":240,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040962Z",{},"6c2ddc74-6750-4e76-bdad-317c6c0305ce","Authentification des utilisateurs","Technical","Avant toute utilisation des moyens informatiques, un utilisateur doit être doté d’un identifiant qui lui est propre et doit s’authentifier afin de permettre de contrôler son identité et ses accès aux données dont il a besoin. Les mécanismes permettant de réaliser l’authentification des personnes sont catégorisés selon qu’ils font intervenir :","Accès non autorisé, mots de passe partagés.","https://www.cnil.fr/fr/securite-authentifier-les-utilisateurs","2021-10-19T15:35:32.3166158","2026-11-02T20:57:18.0371731",[],[],{"date":242,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":243,"id":244,"ref":27,"label":245,"type":197,"description":246,"relatedRisk":27,"moreDetailsUrl":247,"dateCreation":248,"dateUpdate":249,"tags":250,"attachments":251,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040967Z",{},"f54ac346-ee7b-45de-9cc0-39506032df7e","Gestion des habilitations","Respecter le principe de moindre privilège, à travers la gestion des profils d’habilitation, permet de limiter les conséquences d’une usurpation de comptes ou d’une erreur de manipulation.","https://www.cnil.fr/fr/securite-gerer-les-habilitations","2021-10-19T15:35:32.1054015","2026-11-02T20:57:19.3398542",[],[],{"date":253,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":254,"id":255,"ref":27,"label":256,"type":233,"description":257,"relatedRisk":27,"moreDetailsUrl":258,"dateCreation":259,"dateUpdate":260,"tags":261,"attachments":262,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040974Z",{},"f748340f-fe32-47c4-983c-135130915929","Sécurité des postes de travail","Les risques d’intrusion dans les systèmes informatiques sont multiples et les postes de travail constituent un des principaux points d’entrée.","https://www.cnil.fr/fr/securite-securiser-les-postes-de-travail","2021-12-15T14:06:35.2861825","2026-11-02T20:57:20.9746731",[],[],{"date":264,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":265,"id":266,"ref":27,"label":267,"type":233,"description":268,"relatedRisk":27,"moreDetailsUrl":269,"dateCreation":224,"dateUpdate":270,"tags":271,"attachments":272,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040979Z",{},"ac192187-f8f9-42aa-9111-814f4a321407","Protection du réseau informatique","Le réseau interne interconnecte l’ensemble des composants des systèmes d’information d’un organisme et dispose souvent de points de connexion avec l’extérieur. Il s’agit tout autant d’un point d’entrée que d’un support de propagation des attaques. Il est donc primordial de sécuriser le réseau interne.","https://www.cnil.fr/fr/securite-proteger-le-reseau-informatique","2026-11-02T20:57:22.9977424",[],[],{"date":274,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":275,"id":276,"ref":27,"label":277,"type":233,"description":278,"relatedRisk":27,"moreDetailsUrl":279,"dateCreation":224,"dateUpdate":280,"tags":281,"attachments":282,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040986Z",{},"ed9bf5c2-97d3-4505-9b42-adabf6e7bd1d","Sécurité des serveurs","La sécurité des serveurs doit être une priorité car ils centralisent un grand nombre de données et hébergent les services permettant d’y accéder et de les manipuler. Les précautions élémentaires Désinstaller ou désactiver les services et interfaces inutiles. Limiter l’accès aux outils et interfaces d’administration aux seules personnes habilitées. Utiliser des comptes de moindres privilèges pour les opérations courantes.","https://www.cnil.fr/fr/securite-securiser-les-serveurs","2026-11-02T20:57:24.1598199",[],[],{"date":284,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":285,"id":286,"ref":27,"label":287,"type":288,"description":289,"relatedRisk":27,"moreDetailsUrl":290,"dateCreation":224,"dateUpdate":291,"tags":292,"attachments":293,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1040991Z",{},"56e975ff-1611-4612-b85c-c7efcdd47c2c","Protection des locaux","Physical","L’accès aux locaux doit être contrôlé pour éviter ou ralentir un accès direct, non autorisé, que ce soit aux fichiers papier ou aux matériels informatiques, notamment aux serveurs. Les locaux doivent également être protégés contre les autres types de menaces (ex. : incendie, inondation). Les précautions élémentaires Restreindre les accès aux locaux au moyen de portes verrouillées. Installer des alarmes anti-intrusion et les vérifier périodiquement leur bon fonctionnement périodiquement.","https://www.cnil.fr/fr/securite-proteger-les-locaux","2026-11-02T20:57:28.139351",[],[],{"date":295,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":296,"id":297,"ref":27,"label":298,"type":197,"description":299,"relatedRisk":27,"moreDetailsUrl":300,"dateCreation":301,"dateUpdate":27,"tags":302,"attachments":303,"creatorUser":304,"workflowStepId":204,"workflowStep":27},"2026-11-03T11:38:08.1041005Z",{},"637227f2-e809-4991-69b1-08df38010b92","Encadrement de la maintenance et de la fin de vie des matériels et logiciels","Les opérations de support doivent être encadrées pour maitriser l’accès aux données par les prestataires. Les données doivent être préalablement effacées des matériels destinés à être mis au rebut.","https://www.cnil.fr/fr/securite-encadrer-la-maintenance-et-la-fin-de-vie-des-materiels-et-logiciels","2026-11-02T20:57:38.8686714",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":306,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":307,"id":308,"ref":27,"label":309,"type":233,"description":310,"relatedRisk":27,"moreDetailsUrl":311,"dateCreation":224,"dateUpdate":312,"tags":313,"attachments":314,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1041011Z",{},"c8b527e2-07bc-4677-8c00-d222be26d357","Traçabilité des opérations","Afin de pouvoir identifier un accès frauduleux ou une utilisation abusive de données personnelles, ou de déterminer l’origine d’un incident, il convient d’enregistrer certaines des actions effectuées sur les systèmes informatiques. Les traces alors collectées sont également des éléments de preuve utiles pour la démonstration de la conformité.","https://www.cnil.fr/fr/securite-tracer-les-operations","2026-11-02T20:57:33.4681365",[],[],{"date":316,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":317,"id":318,"ref":27,"label":319,"type":233,"description":320,"relatedRisk":27,"moreDetailsUrl":321,"dateCreation":224,"dateUpdate":322,"tags":323,"attachments":324,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1041016Z",{},"cae348c2-e9f2-4e49-8d60-ab56e438d5a4","Sauvegarde","Des copies de sauvegarde doivent être réalisées et testées régulièrement pour être disponibles en cas de besoin. Les précautions élémentaires S’agissant de la sauvegarde des données","https://www.cnil.fr/fr/securite-sauvegarder","2026-11-02T20:57:34.7827534",[],[],{"date":326,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":327,"id":328,"ref":27,"label":329,"type":233,"description":330,"relatedRisk":27,"moreDetailsUrl":331,"dateCreation":332,"dateUpdate":27,"tags":333,"attachments":334,"creatorUser":335,"workflowStepId":204,"workflowStep":27},"2026-11-03T11:38:08.104102Z",{},"6eddff0a-1378-4160-69b2-08df38010b92","Continuité et reprise d'activité","Pour limiter le temps d’indisponibilité du système, il faut anticiper les incidents les plus courants. Assurer la continuité d’activité consiste à prévoir des moyens de continuer de fonctionner, en général de manière dégradée, malgré des dysfonctionnements. La reprise d’activité, quant à elle, englobe toutes les actions nécessaires pour relancer un système arrêté.","https://www.cnil.fr/fr/securite-prevoir-la-continuite-et-la-reprise-dactivite","2026-11-02T20:57:39.8112993",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":337,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":338,"id":339,"ref":27,"label":340,"type":197,"description":341,"relatedRisk":27,"moreDetailsUrl":342,"dateCreation":343,"dateUpdate":27,"tags":344,"attachments":345,"creatorUser":346,"workflowStepId":204,"workflowStep":27},"2026-11-03T11:38:08.1041025Z",{},"10c6151c-c44c-46df-69b3-08df38010b92","Gestion des incidents et des violations","Il convient d’être préparé à l’éventualité d’un incident pour intervenir à temps et de manière appropriée, en intégrant l’objectif de limiter les effets pour les personnes dont les données sont concernées. Le responsable de traitement peut être amené à notifier la CNIL ou informer les personnes concernées de l’incident en fonction du risque pour celles-ci.","https://www.cnil.fr/fr/securite-gerer-les-incidents-et-les-violations","2026-11-02T20:57:40.7676498",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":348,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":349,"id":350,"ref":27,"label":351,"type":197,"description":352,"relatedRisk":27,"moreDetailsUrl":353,"dateCreation":354,"dateUpdate":27,"tags":355,"attachments":356,"creatorUser":357,"workflowStepId":204,"workflowStep":27},"2026-11-03T11:38:08.1041031Z",{},"e064565b-514e-4755-69b4-08df38010b92","Analyse de risques","En parallèle de la mise en conformité aux précautions élémentaires présentées dans ce guide, il est pertinent, voire obligatoire selon la criticité des traitements, de réaliser des analyses de risques relative à la protection des données. Ces analyses permettent de décider des mesures de sécurité complémentaires, adaptées au contexte, permettant de limiter l’impact sur les personnes concernées par le traitement.","https://www.cnil.fr/fr/securite-analyse-de-risques","2026-11-02T20:57:42.2940193",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":359,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":360,"id":361,"ref":27,"label":362,"type":197,"description":363,"relatedRisk":27,"moreDetailsUrl":364,"dateCreation":224,"dateUpdate":365,"tags":366,"attachments":367,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1041036Z",{},"47c52bcb-a6e9-487b-a958-f027b20dbd87","Encadrement de la sous-traitance","Les traitements de données réalisés par un sous-traitant pour le compte du responsable de traitement doivent bénéficier de garanties suffisantes, notamment en matière de sécurité.","https://www.cnil.fr/fr/securite-gerer-la-sous-traitance","2026-11-02T20:57:31.4211019",[],[],{"date":369,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":370,"id":371,"ref":27,"label":372,"type":197,"description":373,"relatedRisk":27,"moreDetailsUrl":374,"dateCreation":224,"dateUpdate":375,"tags":376,"attachments":377,"creatorUser":27,"workflowStepId":216,"workflowStep":27},"2026-11-03T11:38:08.1041041Z",{},"49230bff-1cd3-46bd-85f5-e43809136dc9","Sécurité des échanges avec l'extérieur","Sans mesure complémentaire, les canaux de transmission de données grand public (ex. : messagerie électronique, messagerie instantanée, plateforme de dépôt de fichiers) constituent rarement un moyen de communication sûr pour transmettre des données personnelles. Une simple erreur d’inattention peut conduire des personnes non habilitées à prendre connaissance de données personnelles, ce qui porte atteinte au droit à la vie privée des personnes concernées.","https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-lexterieur","2026-11-02T20:57:29.3610605",[],[],{"date":379,"state":193,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":380,"id":381,"ref":27,"label":382,"type":197,"description":383,"relatedRisk":27,"moreDetailsUrl":384,"dateCreation":385,"dateUpdate":27,"tags":386,"attachments":387,"creatorUser":388,"workflowStepId":204,"workflowStep":27},"2026-11-03T11:38:08.1041047Z",{},"eba73701-684c-4de3-69ba-08df38010b92","RGS : référentiel général de sécurité des autorités administratives","Appliquer le référentiel général de sécurité (RGS) de l'ANSSI : homologation de sécurité des systèmes d'information des autorités administratives (ordonnance n° 2005-1516).","https://cyber.gouv.fr/le-referentiel-general-de-securite-rgs","2026-11-02T20:57:48.3845718",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[390,399,407],{"subjectCategory":391,"displayName":393,"id":397,"subjectCategoryId":392,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":398},{"id":392,"label":393,"ref":27,"dateCreation":394,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":395,"workflowStep":27,"dataRetentionRules":396},"8b9dd7e2-2eb8-4ef5-2689-08dac757bbf1","Employés","2022-11-15T22:21:35.8123871",97319,[],"f4800804-3633-433b-e6dc-08df38010be0",[],{"subjectCategory":400,"displayName":402,"id":405,"subjectCategoryId":401,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":406},{"id":401,"label":402,"ref":27,"dateCreation":403,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":395,"workflowStep":27,"dataRetentionRules":404},"ff2c96d4-9d2f-48ed-269b-08dac757bbf1","Anciens employés","2022-11-15T22:22:12.9429016",[],"9f7afa0f-6b37-4701-e6dd-08df38010be0",[],{"subjectCategory":408,"displayName":410,"id":415,"subjectCategoryId":409,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":416},{"id":409,"label":410,"ref":27,"dateCreation":411,"dateUpdate":27,"creatorUserId":412,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":413,"workflowStep":27,"dataRetentionRules":414},"7d85fa91-044f-4401-aeaa-13c871be6f94","Collaborateurs et leurs contacts","2025-09-16T08:58:17.3453198",31,97318,[],"a0225ae1-d27d-4c8a-e6de-08df38010be0",[],"\u003Cblockquote>\u003Cp>\u003Cstrong>Modèle à adapter\u003C/strong>\u003C/p>\u003Cp>Modèle de traitement fourni à titre indicatif, à adapter à votre organisation. Les finalités, les données, les durées de conservation, les destinataires, les mesures de sécurité et l'analyse d'impact y sont des valeurs de départ, établies à partir des textes et référentiels cités ci-dessous. \u003Cstrong>Ce modèle ne constitue pas un avis juridique\u003C/strong> : faites-le valider par votre DPO ou votre conseil.\u003C/p>\u003C/blockquote>\u003Cblockquote>\u003Cp>\u003Cstrong>Point d'attention\u003C/strong> : Le référentiel CNIL de 2026 sur les durées ne contient aucune ligne propre aux sanctions disciplinaires (il ne traite que le contentieux disciplinaire) : les durées de conservation des dossiers de sanction sont donc laissées au choix de l'employeur. Les articles du code du travail ont été lus sur un site miroir non officiel (Légifrance inaccessible).\u003C/p>\u003C/blockquote>\u003Ch3>Sources\u003C/h3>\u003Cp>\u003Cem>Classement selon le guide pratique CNIL « Les durées de conservation ».\u003C/em>\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Texte légal ou réglementaire (antérieure au RGPD)\u003C/strong> : \u003Ca href=\"https://travail-industrie.com/code-du-travail/l1332-4\">Code du travail, articles L1332-2, L1332-4 et L1332-5 (lus sur le site miroir non officiel travail-industrie.com)\u003C/a>. L1332-4 : aucun fait fautif ne peut donner lieu à lui seul à l'engagement de poursuites au-delà de deux mois à compter de la connaissance des faits par l'employeur (réserve des poursuites pénales). L1332-5 : une sanction antérieure de plus de trois ans ne peut être invoquée à l'appui d'une nouvelle sanction. L1332-2 (page voisine du même site) : convocation, assistance, délai de deux jours ouvrables à un mois entre l'entretien et la sanction. Ces articles ne fixent aucune durée de conservation des données.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL (durée obligatoire)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/default/files/2026-04/referentiel_durees_de_conservation_gestion_des_ressources_humaines.pdf\">CNIL, Les durées de conservation des données personnelles : gestion des ressources humaines (2 avril 2026, mise à jour du 20 mai 2026)\u003C/a>. Seule ligne pertinente : gestion du contentieux disciplinaire et prud'homal (le temps du litige, puis jusqu'à épuisement des voies de recours, droits de la défense). Aucune durée spécifique pour les sanctions elles-mêmes, ni pour l'amnistie. Mentionne aussi qu'une procédure disciplinaire peut justifier d'extraire des images de vidéosurveillance ou des traces de connexion pour les conserver séparément.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/cnil/files/2023-09/referentiel_gestion_des_ressources_humaines.pdf\">CNIL, Référentiel relatif aux traitements de données personnelles mis en œuvre aux fins de gestion du personnel (2023)\u003C/a>. Liste des données du suivi de carrière : les sanctions disciplinaires peuvent y figurer, à l'exclusion de celles consécutives à des faits amnistiés. Bases légales envisageables (exécution du contrat, intérêt légitime). Rappel que les AIPD se décident au regard des critères du CEPD.\u003C/li>\u003C/ul>","Automatic","ManualOrOnDemand","Les personnes sont informées au moment de la collecte (art. 13 du RGPD) ou, en cas de collecte indirecte, au plus tard dans un délai d'un mois (art. 14).",[],[423,431,437,444,459,465,471],{"purposes":424,"dataRetentionRules":27,"parentId":27,"children":425,"displayName":426,"label":426,"transfers":427,"recipientType":428,"type":429,"jobTitle":27,"id":430,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Service des ressources humaines",[],"InternalService","Recipient","a8b750a4-441f-49ea-a0ee-08df38010bcb",{"purposes":432,"dataRetentionRules":27,"parentId":27,"children":433,"displayName":434,"label":434,"transfers":435,"recipientType":428,"type":429,"jobTitle":27,"id":436,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Hiérarchie directe et direction (personnes habilitées)",[],"a8851624-25c8-42ae-a0ef-08df38010bcb",{"purposes":438,"dataRetentionRules":27,"parentId":27,"children":439,"displayName":440,"label":440,"transfers":441,"recipientType":442,"type":429,"jobTitle":27,"id":443,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Personne choisie par le salarié pour l'assister lors de l'entretien",[],"AuthorizedThirdParty","fd07d64b-dbef-4f37-a0f0-08df38010bcb",{"purposes":445,"dataRetentionRules":27,"parentId":27,"children":446,"displayName":447,"label":448,"transfers":449,"recipientType":450,"type":429,"jobTitle":27,"id":451,"actorId":452,"actor":453,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Sous-traitant à préciser","Conseil juridique ou avocat de l'employeur",[],"Vendor","68075d10-a70b-4a86-a0f1-08df38010bcb","1af96d46-eb9e-45f3-64bc-08df38010bd1",{"label":447,"id":452,"ref":27,"dateCreation":454,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":455,"actorType":456,"description":457,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":458,"areaId":27,"source":54},"2026-11-02T20:57:51.2801474","New","Morale","Acteur générique des modèles de traitement : à remplacer par le prestataire retenu (sous-traitant au sens de l'article 28 du RGPD).",76516,{"purposes":460,"dataRetentionRules":27,"parentId":27,"children":461,"displayName":462,"label":462,"transfers":463,"recipientType":442,"type":429,"jobTitle":27,"id":464,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Juridictions compétentes (conseil de prud'hommes, tribunal administratif)",[],"feb35782-f19a-418f-a0f2-08df38010bcb",{"purposes":466,"dataRetentionRules":27,"parentId":27,"children":467,"displayName":468,"label":468,"transfers":469,"recipientType":442,"type":429,"jobTitle":27,"id":470,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Inspection du travail (cas d'un salarié protégé)",[],"d608020a-4a68-4938-a0f3-08df38010bcb",{"purposes":472,"dataRetentionRules":27,"parentId":27,"children":473,"displayName":474,"label":474,"transfers":475,"recipientType":476,"type":429,"jobTitle":27,"id":477,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Salarié concerné (accès à son dossier)",[],"DataSubject","cc564c68-8b16-4104-a0f4-08df38010bcb",[],[480,486,492,498],{"id":481,"key":32,"label":482,"description":483,"legalBasis":484,"legalBasisText":485,"legalBasisDescription":27,"readonly":28},"c72ac040-7296-4216-10a9-08df38010b80","Instruction des faits et convocation à l'entretien préalable","Recueillir les éléments relatifs aux faits reprochés, vérifier le respect du délai de deux mois à compter de la connaissance des faits (art. L1332-4 du code du travail) et convoquer le salarié en précisant l'objet de la convocation (art. L1332-2). Base retenue : respect d'une obligation légale de procédure.","LegalCommitment","Obligation légale",{"id":487,"key":33,"label":488,"description":489,"legalBasis":490,"legalBasisText":491,"legalBasisDescription":27,"readonly":28},"b1486574-af6e-4b92-10aa-08df38010b80","Entretien préalable, prononcé et notification de la sanction","Conduire l'entretien où l'employeur indique le motif de la sanction envisagée et recueille les explications du salarié, puis notifier par écrit une sanction motivée, au plus tôt deux jours ouvrables et au plus tard un mois après l'entretien (art. L1332-2). Base retenue : exécution du contrat de travail dont le pouvoir disciplinaire est un attribut.","Contract","Contrat ou mesures précontractuelles",{"id":493,"key":135,"label":494,"description":495,"legalBasis":496,"legalBasisText":497,"legalBasisDescription":27,"readonly":28},"1b77f1bd-dbaa-406b-10ab-08df38010b80","Gestion des recours et du contentieux disciplinaire","Conserver les pièces nécessaires pour répondre à un recours interne ou à un contentieux (conseil de prud'hommes, tribunal administratif pour les agents publics). Le référentiel CNIL de 2026 prévoit une conservation pour la durée du litige, puis jusqu'à épuisement des voies de recours (droits de la défense, art. 6 de la CEDH). Base retenue : intérêt légitime de l'organisme à défendre ses droits.","LegitimateInterest","Intérêts légitimes du responsable du traitement ou d'un tiers",{"id":499,"key":94,"label":500,"description":501,"legalBasis":496,"legalBasisText":497,"legalBasisDescription":27,"readonly":28},"a51badab-a0d0-453b-10ac-08df38010b80","Suivi de l'historique des sanctions et effacement","Savoir quelles sanctions peuvent encore être invoquées à l'appui d'une nouvelle sanction (celles de plus de trois ans ne le peuvent plus, art. L1332-5) et effacer ou archiver les sanctions anciennes ou amnistiées. Le référentiel CNIL RH de 2023 exclut du dossier de carrière les sanctions consécutives à des faits amnistiés. Base retenue : intérêt légitime de l'organisme.",86,67,5]