[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$floaV6Y8-MnGc0FaPgBtffKtf-X09ryB8Ky4G5RwhVpo":3},{"assets":4,"aiSystems":5,"attachments":6,"tags":7,"dataRetentionRules":20,"creatorUser":205,"creatorUserId":25,"updatedBy":206,"updatedById":25,"publishedBy":27,"publishedById":27,"areaOwnerId":27,"owners":207,"customFields":208,"area":209,"entity":213,"mergedFrom":27,"workflowStep":214,"accountables":220,"responsibles":221,"informedOwners":222,"securityMeasures":223,"personCategories":453,"id":36,"source":54,"label":37,"state":219,"versionDescription":27,"processingType":43,"parentId":27,"areaId":42,"mergeType":27,"readonly":28,"editable":218,"workflowStepId":215,"dateDeployment":27,"dateCreation":41,"dateArchived":27,"datePublication":27,"archived":28,"dateUpdate":40,"reviewDate":27,"nextReviewDate":27,"ref":27,"processingState":27,"description":38,"descriptionHtml":499,"subjectRightProcessDescription":27,"rightOfInformation":500,"rightOfAccess":501,"rightOfRectification":501,"rightOfErasure":501,"rightOfRestriction":501,"rightOfOpposition":501,"rightOfDataPortability":501,"advanceDirectives":501,"advanceDirectivesDescription":27,"rightOfInformationDescription":502,"rightOfAccessDescription":27,"rightOfRectificationDescription":27,"rightOfErasureDescription":27,"rightOfRestrictionDescription":27,"rightOfOppositionDescription":27,"rightOfDataPortabilityDescription":27,"stakeHolders":503,"assessmentScoring":28,"automaticDecision":28,"systematicMonitoring":28,"specialCategoryData":218,"largeScaleCollection":27,"crossReferencing":27,"vulnerablePeople":218,"isDPIARequired":218,"dpiaDate":27,"dpiaExemption":28,"dpiaExemptionJustification":27,"innovativeUse":28,"exclusionBenefitRightContract":28,"recipients":504,"dataControllers":561,"purposes":562,"progression":588,"quality":589,"sensitivity":590,"visible":218,"workspaceId":39,"nbReferences":30,"referenceId":27},[],[],[],[8,13,16],{"id":9,"label":10,"type":11,"color":12},"99e6f156-5bd7-4bc1-94c7-7f416665cf20","Organisme : Privé","DataProcessing","#64748B",{"id":14,"label":15,"type":11,"color":12},"5494cd34-13e6-4954-81cd-000195723eb0","Organisme : Public",{"id":17,"label":18,"type":11,"color":19},"198417c0-f026-4dea-b2d5-7ce0203d5f80","Secteur : Social et médico-social","#0E7490",[21,87,125,154,176],{"customFields":22,"tags":23,"creator":24,"readonly":28,"purposes":31,"dataProcessings":34,"dataFields":44,"asset":27,"subjectCategories":75,"id":76,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":77,"description":27,"dateCreation":78,"dateUpdate":79,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":80,"baseActiveLegalBasis":81,"baseActiveRetentionDuration":82,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":83,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":86,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},1602,"bc4946f8-1de1-4b70-bb67-62a0ce536160",null,false,"#4DE034",0,[32,33],"f77715fc-7161-4eff-b14c-4b6b8725c087","49708e57-07f4-4f57-b879-72a629f3ee93",[35],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},"912f5309-65ac-44d1-36ca-08df38010b74","Gestion des résidents d'un EHPAD","Ce modèle de traitement est relatif à l'admission, à l'accueil et à l'accompagnement des résidents d'un établissement d'hébergement pour personnes âgées dépendantes (EHPAD) : dossier administratif, dossier de soins, projet personnalisé, personnes de confiance et facturation.",68,"2026-11-03T07:46:14.376219","2026-11-03T07:46:13.3831671",354,"Default",[45,55,62,69],{"id":46,"customFields":47,"ref":27,"archivingPolicy":27,"required":28,"label":48,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":51,"dateUpdate":27,"creator":52,"workflowStepId":53,"workflowStep":27,"source":54},"a7ec9837-c99e-4c12-029a-08df38010ba5",{},"Nom, prénoms, date et lieu de naissance, coordonnées","Current","CivilStatus","2026-11-03T07:46:08.1310962",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},83450,"Api",{"id":56,"customFields":57,"ref":27,"archivingPolicy":27,"required":28,"label":58,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":60,"dateUpdate":27,"creator":61,"workflowStepId":53,"workflowStep":27,"source":54},"b41a0b37-5eaa-42a2-029b-08df38010ba5",{},"Numéro de sécurité sociale (NIR) et régime d'assurance maladie","NIR","2026-11-03T07:46:08.3100458",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":63,"customFields":64,"ref":27,"archivingPolicy":27,"required":28,"label":65,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":66,"dataType":27,"dateCreation":67,"dateUpdate":27,"creator":68,"workflowStepId":53,"workflowStep":27,"source":54},"94d4f15c-771b-4a90-029c-08df38010ba5",{},"Contrat de séjour, date d'entrée et de sortie, chambre","PersonalLife","2026-11-03T07:46:08.4694721",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":70,"customFields":71,"ref":27,"archivingPolicy":27,"required":28,"label":72,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":66,"dataType":27,"dateCreation":73,"dateUpdate":27,"creator":74,"workflowStepId":53,"workflowStep":27,"source":54},"a81bf83e-779a-4a01-029d-08df38010ba5",{},"Mesure de protection juridique et identité du représentant légal","2026-11-03T07:46:08.6433096",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"db02980e-270c-4229-df18-08df38010b98","Dossier administratif et contrat de séjour","2026-11-03T07:46:10.4519243","2026-11-03T07:46:10.8321335","Recommandation CNIL : 2 ans à compter du dernier contact avec la personne accompagnée (hors dossier médical), sauf texte contraire. En cas de décès, archivage pour répondre aux obligations du Code de la santé publique.","Référentiel CNIL sur les durées de conservation dans le secteur social et médico-social (v1.0 du 14 septembre 2023) : 2 ans à compter du dernier contact.",1051200,"Archivage intermédiaire possible dans certains cas (obligation légale, preuve en cas de contentieux dans la limite de la prescription), avec une justification écrite du responsable de traitement.","À l'issue de la durée de conservation, les données sont supprimées de manière sécurisée ou anonymisées de façon irréversible.","Direct","Durée recommandée par la CNIL (référentiels 2023 et 2021), non obligatoire. Un établissement public peut relever du Code du patrimoine (archives publiques).",{"customFields":88,"tags":89,"creator":90,"readonly":28,"purposes":91,"dataProcessings":93,"dataFields":95,"asset":27,"subjectCategories":115,"id":116,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":117,"description":27,"dateCreation":118,"dateUpdate":119,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":120,"baseActiveLegalBasis":121,"baseActiveRetentionDuration":122,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":123,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":124,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[92],"bc00eddf-3689-4235-8d30-2452a2a15807",[94],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[96,103,109],{"id":97,"customFields":98,"ref":27,"archivingPolicy":27,"required":28,"label":99,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":101,"dateUpdate":27,"creator":102,"workflowStepId":53,"workflowStep":27,"source":54},"4b90d278-82c7-4408-029e-08df38010ba5",{},"Antécédents, pathologies, traitements et allergies","HealthData","2026-11-03T07:46:08.8622362",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":104,"customFields":105,"ref":27,"archivingPolicy":27,"required":28,"label":106,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":107,"dateUpdate":27,"creator":108,"workflowStepId":53,"workflowStep":27,"source":54},"c5c80476-1a06-4c14-029f-08df38010ba5",{},"Degré d'autonomie (grille de dépendance) et évaluations gériatriques","2026-11-03T07:46:09.0559808",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":110,"customFields":111,"ref":27,"archivingPolicy":27,"required":28,"label":112,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":113,"dateUpdate":27,"creator":114,"workflowStepId":53,"workflowStep":27,"source":54},"7303dfbe-cd68-468f-02a0-08df38010ba5",{},"Observations et transmissions de l'équipe soignante","2026-11-03T07:46:09.2610062",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"44e91645-7e17-4889-df19-08df38010b98","Dossier de soins et dossier médical du résident","2026-11-03T07:46:11.0319669","2026-11-03T07:46:11.6201363","Le temps de la prise en charge, puis 20 ans à compter du dernier séjour ; si le résident décède moins de 10 ans après son dernier passage, 10 ans à compter du décès (durées du dossier médical rappelées par le référentiel CNIL de 2023).","Article R. 1112-7 du code de la santé publique, tel que cité par le référentiel CNIL de 2023 (texte de loi non ouvert).",10512000,"","Durée reprise du référentiel CNIL de 2023, qui cite l'article R. 1112-7 du CSP (dispositions visant les établissements de santé) : son application exacte à un EHPAD est à confirmer par le responsable de traitement.",{"customFields":126,"tags":127,"creator":128,"readonly":28,"purposes":129,"dataProcessings":131,"dataFields":133,"asset":27,"subjectCategories":146,"id":147,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":148,"description":27,"dateCreation":149,"dateUpdate":150,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":151,"baseActiveLegalBasis":152,"baseActiveRetentionDuration":82,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":123,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":153,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[130],"155ab783-4a08-43a9-953b-35651f4aecd8",[132],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[134,140],{"id":135,"customFields":136,"ref":27,"archivingPolicy":27,"required":28,"label":137,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":66,"dataType":27,"dateCreation":138,"dateUpdate":27,"creator":139,"workflowStepId":53,"workflowStep":27,"source":54},"c7883a6d-92d7-43fd-02a1-08df38010ba5",{},"Habitudes de vie, souhaits et attentes du résident","2026-11-03T07:46:09.4607428",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":141,"customFields":142,"ref":27,"archivingPolicy":27,"required":28,"label":143,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":144,"dateUpdate":27,"creator":145,"workflowStepId":53,"workflowStep":27,"source":54},"14c0d25c-bc97-42fe-02a2-08df38010ba5",{},"Objectifs d'accompagnement et bilans de suivi","2026-11-03T07:46:09.6314579",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"297f152a-3e01-4e2c-df1a-08df38010b98","Projet personnalisé d'accompagnement","2026-11-03T07:46:11.7718532","2026-11-03T07:46:12.1597738","Recommandation CNIL : 2 ans à compter du dernier contact avec la personne accompagnée.","Référentiel CNIL sur les durées de conservation dans le secteur social et médico-social (2023).","Durée recommandée par la CNIL pour l'accompagnement social et médico-social hors dossier médical ; non obligatoire.",{"customFields":155,"tags":156,"creator":157,"readonly":28,"purposes":158,"dataProcessings":160,"dataFields":162,"asset":27,"subjectCategories":169,"id":170,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":171,"description":27,"dateCreation":172,"dateUpdate":173,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":174,"baseActiveLegalBasis":123,"baseActiveRetentionDuration":82,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":123,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":175,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[159],"8a0d0572-516b-4448-a3b0-6ad1b08b016a",[161],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[163],{"id":164,"customFields":165,"ref":27,"archivingPolicy":27,"required":28,"label":166,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":167,"dateUpdate":27,"creator":168,"workflowStepId":53,"workflowStep":27,"source":54},"097c5c22-5f13-47ae-02a3-08df38010ba5",{},"Nom, lien avec le résident et coordonnées de la personne de confiance ou à prévenir","2026-11-03T07:46:09.8764257",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"4249bbf5-bd96-48d1-df1b-08df38010b98","Personnes de confiance et proches","2026-11-03T07:46:12.3201372","2026-11-03T07:46:12.7035476","Durée du séjour, puis durée du dossier administratif (2 ans, recommandation CNIL).","Alignée par prudence sur la durée du dossier administratif (2 ans, recommandation CNIL) ; le référentiel CNIL ne fixe pas de durée propre aux personnes de confiance.",{"customFields":177,"tags":178,"creator":179,"readonly":28,"purposes":180,"dataProcessings":181,"dataFields":183,"asset":27,"subjectCategories":197,"id":198,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":199,"description":27,"dateCreation":200,"dateUpdate":201,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":123,"baseActiveLegalBasis":202,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":203,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":204,"assetId":27,"source":54},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[33],[182],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[184,191],{"id":185,"customFields":186,"ref":27,"archivingPolicy":27,"required":28,"label":187,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":188,"dataType":27,"dateCreation":189,"dateUpdate":27,"creator":190,"workflowStepId":53,"workflowStep":27,"source":54},"5f53c0b4-8056-44c1-02a4-08df38010ba5",{},"Factures, tarifs hébergement et dépendance, reste à charge","EconomicFinancialData","2026-11-03T07:46:10.0693845",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":192,"customFields":193,"ref":27,"archivingPolicy":27,"required":28,"label":194,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":188,"dataType":27,"dateCreation":195,"dateUpdate":27,"creator":196,"workflowStepId":53,"workflowStep":27,"source":54},"d8bdd095-b077-478a-02a5-08df38010ba5",{},"Décisions d'aide APA et d'aide sociale à l'hébergement","2026-11-03T07:46:10.2572474",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"172ca1fa-9bb8-42dd-df1c-08df38010b98","Facturation et aides financières","2026-11-03T07:46:12.8851309","2026-11-03T07:46:13.2106082","Le référentiel CNIL de 2023 évoque l'archivage intermédiaire pour répondre à des obligations comptables, sociales ou fiscales, sans en fixer la durée. Pour l'APA et l'ASH, il cite 6 ans après la cessation du droit (art. R. 232-46 du CASF), durée visant les départements.","Pièces comptables conservées selon les obligations comptables et fiscales (durée non vérifiée dans cette recherche).","Durée indicative, non imposée par un texte retrouvé pour l'établissement : fixée par le responsable de traitement selon la finalité (art. 5.1.e du RGPD) et ses obligations comptables. Aucune source officielle retrouvée sur la durée applicable à l'EHPAD.",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],{},{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":210,"parentId":27,"ref":27,"label":211,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":212,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},"Entity","Entité","FR",{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":210,"parentId":27,"ref":27,"label":211,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":212,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},{"id":215,"label":216,"color":217,"order":30,"itemLimit":27,"type":11,"finalStep":28,"initialStep":218,"authorizedRole":27,"authorizedRoleId":27,"descriptionHtml":27,"mappedState":219},9439,"A compléter","#CCCCCC",true,"Draft",[],[],[],[224,238,250,261,274,285,296,306,316,327,338,348,358,369,380,391,401,412,422,432,442],{"date":225,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":227,"id":228,"ref":27,"label":229,"type":230,"description":231,"relatedRisk":27,"moreDetailsUrl":232,"dateCreation":233,"dateUpdate":27,"tags":234,"attachments":235,"creatorUser":236,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.4372022Z","Done",{},"beba9da4-69b2-451b-69b0-08df38010b92","Pilotage de la sécurité des données","Organizational","L’intégration de la protection des données personnelles dans les processus de décision de l’organisme permet d’en assurer la prise en compte dans la durée et aux moments clés d’arbitrages des budgets et des projets. Les précautions élémentaires Impliquer la direction et formaliser des objectifs généraux en matière de sécurité et de protection des données personnelles, validés par la direction de l’organisme.","https://www.cnil.fr/fr/securite-piloter-la-securite-des-donnees","2026-11-02T20:57:37.2709862",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},90384,{"date":239,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":240,"id":241,"ref":27,"label":242,"type":230,"description":243,"relatedRisk":27,"moreDetailsUrl":244,"dateCreation":245,"dateUpdate":246,"tags":247,"attachments":248,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372058Z",{},"cde1cad2-4195-4ffe-9406-08dd823909d1","Cadre d'usage des utilisateurs","La charte doit rappeler les règles de protection des données et les sanctions possibles, définir son champ d’application (interventions informatiques, moyens d’authentification) et énoncer les règles de sécurité : signaler toute tentative d’intrusion, garder ses identifiants secrets, ne pas installer ni modifier de logiciels sans autorisation, verrouiller son poste en cas d’absence, n’accéder qu’aux informations utiles et respecter la procédure pour copier des données sur supports amovibles. Elle précise aussi les conditions d’usage des équipements informatiques et télécoms (poste de travail, matériels nomades, stockage, réseaux, appareils personnels, Internet, messagerie, téléphonie), les modalités d’administration du système (filtrage, traçabilité, gestion des postes) ainsi que les responsabilités et sanctions en cas de manquement.","https://www.cnil.fr/fr/securite-definir-un-cadre-pour-les-utilisateurs","2025-04-25T07:14:13.031896","2026-11-02T20:57:14.658541",[],[],90385,{"date":251,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":252,"id":253,"ref":27,"label":254,"type":230,"description":255,"relatedRisk":27,"moreDetailsUrl":256,"dateCreation":257,"dateUpdate":258,"tags":259,"attachments":260,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372064Z",{},"d77a94b8-cd42-409c-a02e-323ffad3924a","Sensibilisation et formation des utilisateurs","Les erreurs humaines et les attaques par ingénierie sociale sont à l’origine d’un nombre important d’incidents de sécurité. Les solutions techniques ne sont pas suffisantes pour assurer la protection des données personnelles détenues par un organisme.","https://www.cnil.fr/fr/securite-impliquer-et-former-les-utilisateurs","2019-01-01T00:00:00","2026-11-02T20:57:16.1776695",[],[],{"date":262,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":263,"id":264,"ref":27,"label":265,"type":266,"description":267,"relatedRisk":268,"moreDetailsUrl":269,"dateCreation":270,"dateUpdate":271,"tags":272,"attachments":273,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.437207Z",{},"6c2ddc74-6750-4e76-bdad-317c6c0305ce","Authentification des utilisateurs","Technical","Avant toute utilisation des moyens informatiques, un utilisateur doit être doté d’un identifiant qui lui est propre et doit s’authentifier afin de permettre de contrôler son identité et ses accès aux données dont il a besoin. Les mécanismes permettant de réaliser l’authentification des personnes sont catégorisés selon qu’ils font intervenir :","Accès non autorisé, mots de passe partagés.","https://www.cnil.fr/fr/securite-authentifier-les-utilisateurs","2021-10-19T15:35:32.3166158","2026-11-02T20:57:18.0371731",[],[],{"date":275,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":276,"id":277,"ref":27,"label":278,"type":230,"description":279,"relatedRisk":27,"moreDetailsUrl":280,"dateCreation":281,"dateUpdate":282,"tags":283,"attachments":284,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372074Z",{},"f54ac346-ee7b-45de-9cc0-39506032df7e","Gestion des habilitations","Respecter le principe de moindre privilège, à travers la gestion des profils d’habilitation, permet de limiter les conséquences d’une usurpation de comptes ou d’une erreur de manipulation.","https://www.cnil.fr/fr/securite-gerer-les-habilitations","2021-10-19T15:35:32.1054015","2026-11-02T20:57:19.3398542",[],[],{"date":286,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":287,"id":288,"ref":27,"label":289,"type":266,"description":290,"relatedRisk":27,"moreDetailsUrl":291,"dateCreation":292,"dateUpdate":293,"tags":294,"attachments":295,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372087Z",{},"f748340f-fe32-47c4-983c-135130915929","Sécurité des postes de travail","Les risques d’intrusion dans les systèmes informatiques sont multiples et les postes de travail constituent un des principaux points d’entrée.","https://www.cnil.fr/fr/securite-securiser-les-postes-de-travail","2021-12-15T14:06:35.2861825","2026-11-02T20:57:20.9746731",[],[],{"date":297,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":298,"id":299,"ref":27,"label":300,"type":266,"description":301,"relatedRisk":27,"moreDetailsUrl":302,"dateCreation":257,"dateUpdate":303,"tags":304,"attachments":305,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372094Z",{},"ac192187-f8f9-42aa-9111-814f4a321407","Protection du réseau informatique","Le réseau interne interconnecte l’ensemble des composants des systèmes d’information d’un organisme et dispose souvent de points de connexion avec l’extérieur. Il s’agit tout autant d’un point d’entrée que d’un support de propagation des attaques. Il est donc primordial de sécuriser le réseau interne.","https://www.cnil.fr/fr/securite-proteger-le-reseau-informatique","2026-11-02T20:57:22.9977424",[],[],{"date":307,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":308,"id":309,"ref":27,"label":310,"type":266,"description":311,"relatedRisk":27,"moreDetailsUrl":312,"dateCreation":257,"dateUpdate":313,"tags":314,"attachments":315,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372098Z",{},"ed9bf5c2-97d3-4505-9b42-adabf6e7bd1d","Sécurité des serveurs","La sécurité des serveurs doit être une priorité car ils centralisent un grand nombre de données et hébergent les services permettant d’y accéder et de les manipuler. Les précautions élémentaires Désinstaller ou désactiver les services et interfaces inutiles. Limiter l’accès aux outils et interfaces d’administration aux seules personnes habilitées. Utiliser des comptes de moindres privilèges pour les opérations courantes.","https://www.cnil.fr/fr/securite-securiser-les-serveurs","2026-11-02T20:57:24.1598199",[],[],{"date":317,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":318,"id":319,"ref":27,"label":320,"type":321,"description":322,"relatedRisk":27,"moreDetailsUrl":323,"dateCreation":257,"dateUpdate":324,"tags":325,"attachments":326,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372103Z",{},"56e975ff-1611-4612-b85c-c7efcdd47c2c","Protection des locaux","Physical","L’accès aux locaux doit être contrôlé pour éviter ou ralentir un accès direct, non autorisé, que ce soit aux fichiers papier ou aux matériels informatiques, notamment aux serveurs. Les locaux doivent également être protégés contre les autres types de menaces (ex. : incendie, inondation). Les précautions élémentaires Restreindre les accès aux locaux au moyen de portes verrouillées. Installer des alarmes anti-intrusion et les vérifier périodiquement leur bon fonctionnement périodiquement.","https://www.cnil.fr/fr/securite-proteger-les-locaux","2026-11-02T20:57:28.139351",[],[],{"date":328,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":329,"id":330,"ref":27,"label":331,"type":230,"description":332,"relatedRisk":27,"moreDetailsUrl":333,"dateCreation":334,"dateUpdate":27,"tags":335,"attachments":336,"creatorUser":337,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.4372112Z",{},"637227f2-e809-4991-69b1-08df38010b92","Encadrement de la maintenance et de la fin de vie des matériels et logiciels","Les opérations de support doivent être encadrées pour maitriser l’accès aux données par les prestataires. Les données doivent être préalablement effacées des matériels destinés à être mis au rebut.","https://www.cnil.fr/fr/securite-encadrer-la-maintenance-et-la-fin-de-vie-des-materiels-et-logiciels","2026-11-02T20:57:38.8686714",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":339,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":340,"id":341,"ref":27,"label":342,"type":266,"description":343,"relatedRisk":27,"moreDetailsUrl":344,"dateCreation":257,"dateUpdate":345,"tags":346,"attachments":347,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372117Z",{},"c8b527e2-07bc-4677-8c00-d222be26d357","Traçabilité des opérations","Afin de pouvoir identifier un accès frauduleux ou une utilisation abusive de données personnelles, ou de déterminer l’origine d’un incident, il convient d’enregistrer certaines des actions effectuées sur les systèmes informatiques. Les traces alors collectées sont également des éléments de preuve utiles pour la démonstration de la conformité.","https://www.cnil.fr/fr/securite-tracer-les-operations","2026-11-02T20:57:33.4681365",[],[],{"date":349,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":350,"id":351,"ref":27,"label":352,"type":266,"description":353,"relatedRisk":27,"moreDetailsUrl":354,"dateCreation":257,"dateUpdate":355,"tags":356,"attachments":357,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372122Z",{},"cae348c2-e9f2-4e49-8d60-ab56e438d5a4","Sauvegarde","Des copies de sauvegarde doivent être réalisées et testées régulièrement pour être disponibles en cas de besoin. Les précautions élémentaires S’agissant de la sauvegarde des données","https://www.cnil.fr/fr/securite-sauvegarder","2026-11-02T20:57:34.7827534",[],[],{"date":359,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":360,"id":361,"ref":27,"label":362,"type":266,"description":363,"relatedRisk":27,"moreDetailsUrl":364,"dateCreation":365,"dateUpdate":27,"tags":366,"attachments":367,"creatorUser":368,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.437213Z",{},"6eddff0a-1378-4160-69b2-08df38010b92","Continuité et reprise d'activité","Pour limiter le temps d’indisponibilité du système, il faut anticiper les incidents les plus courants. Assurer la continuité d’activité consiste à prévoir des moyens de continuer de fonctionner, en général de manière dégradée, malgré des dysfonctionnements. La reprise d’activité, quant à elle, englobe toutes les actions nécessaires pour relancer un système arrêté.","https://www.cnil.fr/fr/securite-prevoir-la-continuite-et-la-reprise-dactivite","2026-11-02T20:57:39.8112993",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":370,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":371,"id":372,"ref":27,"label":373,"type":230,"description":374,"relatedRisk":27,"moreDetailsUrl":375,"dateCreation":376,"dateUpdate":27,"tags":377,"attachments":378,"creatorUser":379,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.4372136Z",{},"10c6151c-c44c-46df-69b3-08df38010b92","Gestion des incidents et des violations","Il convient d’être préparé à l’éventualité d’un incident pour intervenir à temps et de manière appropriée, en intégrant l’objectif de limiter les effets pour les personnes dont les données sont concernées. Le responsable de traitement peut être amené à notifier la CNIL ou informer les personnes concernées de l’incident en fonction du risque pour celles-ci.","https://www.cnil.fr/fr/securite-gerer-les-incidents-et-les-violations","2026-11-02T20:57:40.7676498",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":381,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":382,"id":383,"ref":27,"label":384,"type":230,"description":385,"relatedRisk":27,"moreDetailsUrl":386,"dateCreation":387,"dateUpdate":27,"tags":388,"attachments":389,"creatorUser":390,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.4372142Z",{},"e064565b-514e-4755-69b4-08df38010b92","Analyse de risques","En parallèle de la mise en conformité aux précautions élémentaires présentées dans ce guide, il est pertinent, voire obligatoire selon la criticité des traitements, de réaliser des analyses de risques relative à la protection des données. Ces analyses permettent de décider des mesures de sécurité complémentaires, adaptées au contexte, permettant de limiter l’impact sur les personnes concernées par le traitement.","https://www.cnil.fr/fr/securite-analyse-de-risques","2026-11-02T20:57:42.2940193",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":392,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":393,"id":394,"ref":27,"label":395,"type":266,"description":396,"relatedRisk":27,"moreDetailsUrl":397,"dateCreation":257,"dateUpdate":398,"tags":399,"attachments":400,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372146Z",{},"eaf489b5-7441-4bb3-8aee-0b894f6ade51","Chiffrement, hachage et signature","Moyens mis en œuvre pour assurer la confidentialité des données conservées (en base de données, dans des fichiers plats, dans les sauvegardes, etc.) ainsi que les modalités de gestion des clés de chiffrement (création, conservation, modification en cas de suspections de compromission, etc.).\n\nDétaillez les moyens de chiffrement employés pour les flux de données (VPN, TLS, etc.) intégrés dans le traitement.","https://www.cnil.fr/fr/securite-chiffrement-hachage-signature","2026-11-02T20:57:36.4902402",[],[],{"date":402,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":403,"id":404,"ref":27,"label":405,"type":230,"description":406,"relatedRisk":27,"moreDetailsUrl":407,"dateCreation":408,"dateUpdate":27,"tags":409,"attachments":410,"creatorUser":411,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.4372151Z",{},"c74c6dac-044c-4c94-69b5-08df38010b92","Sécurité du cloud (informatique en nuage)","Le recours à l’informatique en nuage (cloud) est perçu comme un moyen plus rapide et flexible de déployer des nouveaux services. Cependant, les risques spécifiques liés au recours au cloud doivent être pris en compte lors de la mise en œuvre d’un traitement de données. Le fournisseur du service cloud doit présenter des garanties suffisantes pour assurer la mise en œuvre de mesures de sécurité.","https://www.cnil.fr/fr/securite-cloud-informatique-en-nuage","2026-11-02T20:57:43.1387689",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":413,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":414,"id":415,"ref":27,"label":416,"type":230,"description":417,"relatedRisk":27,"moreDetailsUrl":418,"dateCreation":257,"dateUpdate":419,"tags":420,"attachments":421,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372156Z",{},"47c52bcb-a6e9-487b-a958-f027b20dbd87","Encadrement de la sous-traitance","Les traitements de données réalisés par un sous-traitant pour le compte du responsable de traitement doivent bénéficier de garanties suffisantes, notamment en matière de sécurité.","https://www.cnil.fr/fr/securite-gerer-la-sous-traitance","2026-11-02T20:57:31.4211019",[],[],{"date":423,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":424,"id":425,"ref":27,"label":426,"type":230,"description":427,"relatedRisk":27,"moreDetailsUrl":428,"dateCreation":257,"dateUpdate":429,"tags":430,"attachments":431,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372161Z",{},"49230bff-1cd3-46bd-85f5-e43809136dc9","Sécurité des échanges avec l'extérieur","Sans mesure complémentaire, les canaux de transmission de données grand public (ex. : messagerie électronique, messagerie instantanée, plateforme de dépôt de fichiers) constituent rarement un moyen de communication sûr pour transmettre des données personnelles. Une simple erreur d’inattention peut conduire des personnes non habilitées à prendre connaissance de données personnelles, ce qui porte atteinte au droit à la vie privée des personnes concernées.","https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-lexterieur","2026-11-02T20:57:29.3610605",[],[],{"date":433,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":434,"id":435,"ref":27,"label":436,"type":266,"description":437,"relatedRisk":438,"moreDetailsUrl":123,"dateCreation":439,"dateUpdate":27,"tags":440,"attachments":441,"creatorUser":27,"workflowStepId":249,"workflowStep":27},"2026-11-03T11:40:02.4372165Z",{},"e71c1bfd-bbe5-4443-aa6b-e45b07a6f1c4","Hébergeur de données de santé agréé au sens de l’art L.1111-8 du code de la santé publique","Utiliser des hébergeurs de données de santé certifiés pour stocker les informations médicales.","Compromission des données de santé, non-conformité réglementaire.","2022-03-31T08:26:29.0136244",[],[],{"date":443,"state":226,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":444,"id":445,"ref":27,"label":446,"type":230,"description":447,"relatedRisk":27,"moreDetailsUrl":448,"dateCreation":449,"dateUpdate":27,"tags":450,"attachments":451,"creatorUser":452,"workflowStepId":237,"workflowStep":27},"2026-11-03T11:40:02.4372171Z",{},"eba73701-684c-4de3-69ba-08df38010b92","RGS : référentiel général de sécurité des autorités administratives","Appliquer le référentiel général de sécurité (RGS) de l'ANSSI : homologation de sécurité des systèmes d'information des autorités administratives (ordonnance n° 2005-1516).","https://cyber.gouv.fr/le-referentiel-general-de-securite-rgs","2026-11-02T20:57:48.3845718",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[454,464,473,482,491],{"subjectCategory":455,"displayName":457,"id":462,"subjectCategoryId":456,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":463},{"id":456,"label":457,"ref":27,"dateCreation":458,"dateUpdate":27,"creatorUserId":25,"creatorUser":459,"description":27,"minorConcerned":28,"workflowStepId":460,"workflowStep":27,"dataRetentionRules":461},"6d2bcbac-5982-4aa8-373d-08df38010be4","Personnes âgées","2026-11-03T07:46:07.6233802",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},97318,[],"28c8a037-f611-4eee-e6e3-08df38010be0",[],{"subjectCategory":465,"displayName":467,"id":471,"subjectCategoryId":466,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":472},{"id":466,"label":467,"ref":27,"dateCreation":468,"dateUpdate":27,"creatorUserId":25,"creatorUser":469,"description":27,"minorConcerned":28,"workflowStepId":460,"workflowStep":27,"dataRetentionRules":470},"a58077f6-27ed-424d-373e-08df38010be4","Proches et personnes de confiance","2026-11-03T07:46:07.7791411",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"627191f3-9842-4dc7-e6e4-08df38010be0",[],{"subjectCategory":474,"displayName":476,"id":480,"subjectCategoryId":475,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":481},{"id":475,"label":476,"ref":27,"dateCreation":477,"dateUpdate":27,"creatorUserId":25,"creatorUser":478,"description":27,"minorConcerned":28,"workflowStepId":460,"workflowStep":27,"dataRetentionRules":479},"57a70be1-16be-4afb-373f-08df38010be4","Représentants légaux","2026-11-03T07:46:07.9709795",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"119c5a7c-dc45-4719-e6e5-08df38010be0",[],{"subjectCategory":483,"displayName":485,"id":489,"subjectCategoryId":484,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":490},{"id":484,"label":485,"ref":27,"dateCreation":486,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":487,"workflowStep":27,"dataRetentionRules":488},"3138b131-c552-4f03-26b7-08dac757bbf1","Professionnels de santé","2022-11-15T22:24:43.5885768",97319,[],"4434bb74-a737-4c99-e6e6-08df38010be0",[],{"subjectCategory":492,"displayName":494,"id":497,"subjectCategoryId":493,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":498},{"id":493,"label":494,"ref":27,"dateCreation":495,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":487,"workflowStep":27,"dataRetentionRules":496},"8b9dd7e2-2eb8-4ef5-2689-08dac757bbf1","Employés","2022-11-15T22:21:35.8123871",[],"8ef0af4a-cac1-4851-e6e7-08df38010be0",[],"\u003Cblockquote>\u003Cp>\u003Cstrong>Modèle à adapter\u003C/strong>\u003C/p>\u003Cp>Modèle de traitement fourni à titre indicatif, à adapter à votre organisation. Les finalités, les données, les durées de conservation, les destinataires, les mesures de sécurité et l'analyse d'impact y sont des valeurs de départ, établies à partir des textes et référentiels cités ci-dessous. \u003Cstrong>Ce modèle ne constitue pas un avis juridique\u003C/strong> : faites-le valider par votre DPO ou votre conseil.\u003C/p>\u003C/blockquote>\u003Cblockquote>\u003Cp>\u003Cstrong>Point d'attention\u003C/strong> : Les durées reposent sur le référentiel CNIL de 2023 et le référentiel CNIL de 2021 sur le suivi médico-social des personnes âgées, lus dans leur version PDF. Les textes du Code de l'action sociale et des familles et du Code de la santé publique n'ont pas pu être ouverts directement.\u003C/p>\u003C/blockquote>\u003Ch3>Sources\u003C/h3>\u003Cp>\u003Cem>Classement selon le guide pratique CNIL « Les durées de conservation ».\u003C/em>\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/default/files/2023-11/referentiel_durees_de_conservation_social_et_medico-social.pdf\">CNIL, Référentiel : les durées de conservation dans le secteur social et médico-social (v1.0, 14 septembre 2023)\u003C/a>. Durée de 2 ans à compter du dernier contact (hors dossier médical), 20 ans et 10 ans après décès pour le dossier médical (art. R. 1112-7 CSP), archivage intermédiaire, APA et ASH 6 ans (art. R. 232-46 CASF).\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/default/files/atoms/files/referentiel_relatif_aux_traitements_de_donnees_personnelles_pour_le_suivi_social_et_medico-social_des_personnes_agees_en_situation_de_handicap_ou_en_difficulte.pdf\">CNIL, Référentiel relatif aux traitements de données personnelles pour le suivi social et médico-social des personnes âgées, en situation de handicap ou en difficulté (11 mars 2021)\u003C/a>. Finalités (contrat de séjour, projet personnalisé, suivi médicalisé, aides), bases légales envisageables, AIPD requise pour les dossiers de résidents d'EHPAD, durée de 2 ans.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://cnil.fr/fr/secteur-social-et-medico-social-comment-gerer-les-durees-de-conservation\">CNIL, Secteur social et médico-social : comment gérer les durées de conservation ?\u003C/a>. Fiche pratique : défaut de 2 ans à compter du dernier contact, archivage intermédiaire sous conditions.\u003C/li>\u003C/ul>","Automatic","ManualOrOnDemand","Les personnes sont informées au moment de la collecte (art. 13 du RGPD) ou, en cas de collecte indirecte, au plus tard dans un délai d'un mois (art. 14).",[],[505,513,519,534,541,548,554],{"purposes":506,"dataRetentionRules":27,"parentId":27,"children":507,"displayName":508,"label":508,"transfers":509,"recipientType":510,"type":511,"jobTitle":27,"id":512,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Équipe soignante et médecin coordonnateur de l'établissement",[],"InternalService","Recipient","f804b629-aa32-4b92-a0fc-08df38010bcb",{"purposes":514,"dataRetentionRules":27,"parentId":27,"children":515,"displayName":516,"label":516,"transfers":517,"recipientType":510,"type":511,"jobTitle":27,"id":518,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Direction, secrétariat et service facturation",[],"75071ba6-96c7-4eb3-a0fd-08df38010bcb",{"purposes":520,"dataRetentionRules":27,"parentId":27,"children":521,"displayName":522,"label":523,"transfers":524,"recipientType":525,"type":511,"jobTitle":27,"id":526,"actorId":527,"actor":528,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Sous-traitant à préciser","Éditeur du logiciel de soins et prestataires de maintenance",[],"Vendor","d32f5a70-6b80-4bba-a0fe-08df38010bcb","1af96d46-eb9e-45f3-64bc-08df38010bd1",{"label":522,"id":527,"ref":27,"dateCreation":529,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":530,"actorType":531,"description":532,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":533,"areaId":27,"source":54},"2026-11-02T20:57:51.2801474","New","Morale","Acteur générique des modèles de traitement : à remplacer par le prestataire retenu (sous-traitant au sens de l'article 28 du RGPD).",76516,{"purposes":535,"dataRetentionRules":27,"parentId":27,"children":536,"displayName":522,"label":537,"transfers":538,"recipientType":525,"type":511,"jobTitle":27,"id":539,"actorId":527,"actor":540,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Hébergeur de données de santé certifié HDS",[],"242d104c-2296-46bc-a0ff-08df38010bcb",{"label":522,"id":527,"ref":27,"dateCreation":529,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":530,"actorType":531,"description":532,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":533,"areaId":27,"source":54},{"purposes":542,"dataRetentionRules":27,"parentId":27,"children":543,"displayName":544,"label":544,"transfers":545,"recipientType":546,"type":511,"jobTitle":27,"id":547,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Médecin traitant, professionnels de santé libéraux et hôpital en lien avec la prise en charge",[],"AuthorizedThirdParty","00ae08f0-328d-4aa6-a100-08df38010bcb",{"purposes":549,"dataRetentionRules":27,"parentId":27,"children":550,"displayName":551,"label":551,"transfers":552,"recipientType":546,"type":511,"jobTitle":27,"id":553,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Conseil départemental, ARS et organismes payeurs (assurance maladie, caisses)",[],"6a64fc3a-21dd-46f9-a101-08df38010bcb",{"purposes":555,"dataRetentionRules":27,"parentId":27,"children":556,"displayName":557,"label":557,"transfers":558,"recipientType":559,"type":511,"jobTitle":27,"id":560,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Résident, représentant légal et personne de confiance (accès au dossier)",[],"DataSubject","aa435077-211d-4406-a102-08df38010bcb",[],[563,569,575,578,584],{"id":564,"key":32,"label":565,"description":566,"legalBasis":567,"legalBasisText":568,"legalBasisDescription":27,"readonly":28},"f469be19-319a-411a-10b2-08df38010b80","Admission, contrat de séjour et gestion du dossier administratif","Instruire la demande d'admission, conclure le contrat de séjour ou le document individuel de prise en charge (art. L. 311-4 du CASF) avec le résident ou son représentant légal, et gérer le dossier administratif. Le référentiel CNIL cite ces contrats : exécution du contrat pour un organisme privé, mission d'intérêt public pour un organisme public lorsque le traitement excède le contrat.","Contract","Contrat ou mesures précontractuelles",{"id":570,"key":92,"label":571,"description":572,"legalBasis":573,"legalBasisText":574,"legalBasisDescription":27,"readonly":28},"76412f54-ae7f-44a2-10b3-08df38010b80","Dossier de soins et suivi médical du résident","Tenir le dossier de soins et assurer le suivi médicalisé adapté à l'état du résident (exemple cité par le référentiel CNIL). Les données de santé relèvent de l'article 9 du RGPD ; le référentiel retient la mission d'intérêt public pour l'accompagnement social et médico-social.","PublicInterest","Exécution d'une mission d'intérêt public ou relevant de l'exercice de l'autorité publique",{"id":576,"key":130,"label":148,"description":577,"legalBasis":573,"legalBasisText":574,"legalBasisDescription":27,"readonly":28},"b416b2ba-40a3-40ea-10b4-08df38010b80","Élaborer et suivre le projet personnalisé au regard des habitudes de vie, des besoins et de l'autonomie du résident (art. L. 311-3 du CASF, cité par le référentiel CNIL).",{"id":579,"key":159,"label":580,"description":581,"legalBasis":582,"legalBasisText":583,"legalBasisDescription":27,"readonly":28},"351b6be6-f56d-4203-10b5-08df38010b80","Désignation des personnes de confiance et information des proches","Recueillir les coordonnées de la personne de confiance, de la personne à prévenir et du représentant légal pour les informer et associer le résident aux décisions. Le résident reste libre de désigner ou non une personne.","Consent","Consentement",{"id":585,"key":33,"label":586,"description":587,"legalBasis":567,"legalBasisText":568,"legalBasisDescription":27,"readonly":28},"d5dbe243-ca7c-412b-10b6-08df38010b80","Facturation de l'hébergement, de la dépendance et des aides","Établir les factures de séjour, suivre les paiements et les dossiers d'aides (APA, aide sociale à l'hébergement), prestations citées par le référentiel CNIL.",86,56,23]