[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYel0AGN6zmXge4bqFQFYjNypbonsn-sReM3Hlhurx5o":3},{"assets":4,"aiSystems":5,"attachments":6,"tags":7,"dataRetentionRules":20,"creatorUser":169,"creatorUserId":25,"updatedBy":170,"updatedById":25,"publishedBy":27,"publishedById":27,"areaOwnerId":27,"owners":171,"customFields":172,"area":173,"entity":177,"mergedFrom":27,"workflowStep":178,"accountables":184,"responsibles":185,"informedOwners":186,"securityMeasures":187,"personCategories":396,"id":35,"source":53,"label":36,"state":183,"versionDescription":27,"processingType":42,"parentId":27,"areaId":41,"mergeType":27,"readonly":28,"editable":182,"workflowStepId":179,"dateDeployment":27,"dateCreation":40,"dateArchived":27,"datePublication":27,"archived":28,"dateUpdate":39,"reviewDate":27,"nextReviewDate":27,"ref":27,"processingState":27,"description":37,"descriptionHtml":415,"subjectRightProcessDescription":27,"rightOfInformation":416,"rightOfAccess":417,"rightOfRectification":417,"rightOfErasure":417,"rightOfRestriction":417,"rightOfOpposition":418,"rightOfDataPortability":417,"advanceDirectives":417,"advanceDirectivesDescription":27,"rightOfInformationDescription":419,"rightOfAccessDescription":27,"rightOfRectificationDescription":27,"rightOfErasureDescription":27,"rightOfRestrictionDescription":27,"rightOfOppositionDescription":420,"rightOfDataPortabilityDescription":27,"stakeHolders":421,"assessmentScoring":28,"automaticDecision":28,"systematicMonitoring":27,"specialCategoryData":182,"largeScaleCollection":27,"crossReferencing":28,"vulnerablePeople":28,"isDPIARequired":28,"dpiaDate":27,"dpiaExemption":28,"dpiaExemptionJustification":27,"innovativeUse":28,"exclusionBenefitRightContract":28,"recipients":422,"dataControllers":480,"purposes":481,"progression":502,"quality":503,"sensitivity":504,"visible":182,"workspaceId":38,"nbReferences":30,"referenceId":27},[],[],[],[8,13,16],{"id":9,"label":10,"type":11,"color":12},"99e6f156-5bd7-4bc1-94c7-7f416665cf20","Organisme : Privé","DataProcessing","#64748B",{"id":14,"label":15,"type":11,"color":12},"5494cd34-13e6-4954-81cd-000195723eb0","Organisme : Public",{"id":17,"label":18,"type":11,"color":19},"efc695ca-bb22-4ad0-8292-3946e762c3ba","Secteur : Transport","#0E7490",[21,73,103,139],{"customFields":22,"tags":23,"creator":24,"readonly":28,"purposes":31,"dataProcessings":33,"dataFields":43,"asset":27,"subjectCategories":61,"id":62,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":63,"description":27,"dateCreation":64,"dateUpdate":65,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":66,"baseActiveLegalBasis":67,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":68,"intermediateArchivingRetentionDuration":69,"intermediateArchivingMinMax":27,"destructionDescription":70,"destructionLegalBasis":27,"dataSetSource":71,"sourceDescription":72,"assetId":27,"source":53},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},1602,"bc4946f8-1de1-4b70-bb67-62a0ce536160",null,false,"#4DE034",0,[32],"f103776f-6eaa-4337-b59d-5f0103f30a4c",[34],{"id":35,"label":36,"ref":27,"description":37,"workspaceId":38,"archived":28,"dateUpdate":39,"dateCreation":40,"areaId":41,"processingType":42},"ce18a61a-6a5e-4efe-36be-08df38010b74","Utilisation des données de localisation des véhicules connectés","Ce modèle de traitement est relatif à l'exploitation des données de localisation de véhicules connectés (voitures, deux-roues, vélos) par un constructeur, un loueur, un gestionnaire de flotte ou un prestataire de services, à l'égard de leurs clients, propriétaires ou locataires. Il ne vise pas les véhicules mis à disposition de salariés par leur employeur.",68,"2026-11-02T23:01:22.3905048","2026-11-02T23:01:21.067892",354,"Default",[44,54],{"id":45,"customFields":46,"ref":27,"archivingPolicy":27,"required":28,"label":47,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":49,"dataType":27,"dateCreation":50,"dateUpdate":27,"creator":51,"workflowStepId":52,"workflowStep":27,"source":53},"da9acf2b-62f9-4c02-020d-08df38010ba5",{},"Dernière position du véhicule (latitude, longitude, horodatage)","Current","GeoLocationData","2026-11-02T23:01:14.9774083",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},83450,"Api",{"id":55,"customFields":56,"ref":27,"archivingPolicy":27,"required":28,"label":57,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":58,"dataType":27,"dateCreation":59,"dateUpdate":27,"creator":60,"workflowStepId":52,"workflowStep":27,"source":53},"4b53c4fc-3c3b-4baf-020e-08df38010ba5",{},"Identifiant du véhicule (immatriculation, VIN, boîtier)","Other","2026-11-02T23:01:15.463305",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"a4709665-f240-4bf4-deea-08df38010b98","Localisation pour la lutte contre le vol et les abus de confiance","2026-11-02T23:01:18.0257395","2026-11-02T23:01:18.6105028","Seule la dernière position est conservée, chaque nouvelle position remplaçant la précédente, et plus aucune donnée n'est conservée une fois le véhicule restitué.","Recommandation CNIL sur l'utilisation des données de localisation des véhicules connectés, 30 juin 2026, points 3.6 et 5.1.","En cas de vol ou de non-restitution : le temps de l'instruction par les autorités judiciaires et des tiers concernés. L'exemple de la CNIL évoque une durée maximale de six ans, en référence à la prescription légale applicable.",3153600,"À l'issue de la durée de conservation, les données sont supprimées de manière sécurisée ou anonymisées de façon irréversible.","Direct","Recommandation de la CNIL (30 juin 2026) : conservation limitée à la dernière position, plus de conservation après restitution, et au maximum six ans dans l'exemple du vol au titre de la prescription. Il s'agit d'une recommandation, non d'une durée fixée par un texte dans le document lu.",{"customFields":74,"tags":75,"creator":76,"readonly":28,"purposes":77,"dataProcessings":79,"dataFields":81,"asset":27,"subjectCategories":94,"id":95,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":96,"description":27,"dateCreation":97,"dateUpdate":98,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":99,"baseActiveLegalBasis":100,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":101,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":70,"destructionLegalBasis":27,"dataSetSource":71,"sourceDescription":102,"assetId":27,"source":53},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[78],"bc5638ba-0f10-413f-a43e-499a0b9a4c01",[80],{"id":35,"label":36,"ref":27,"description":37,"workspaceId":38,"archived":28,"dateUpdate":39,"dateCreation":40,"areaId":41,"processingType":42},[82,88],{"id":83,"customFields":84,"ref":27,"archivingPolicy":27,"required":28,"label":85,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":49,"dataType":27,"dateCreation":86,"dateUpdate":27,"creator":87,"workflowStepId":52,"workflowStep":27,"source":53},"9bb80930-054c-449b-020f-08df38010ba5",{},"Trois dernières positions du véhicule","2026-11-02T23:01:15.7530906",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":89,"customFields":90,"ref":27,"archivingPolicy":27,"required":28,"label":91,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":58,"dataType":27,"dateCreation":92,"dateUpdate":27,"creator":93,"workflowStepId":52,"workflowStep":27,"source":53},"b2c8fe4f-cd34-416b-0210-08df38010ba5",{},"Événement déclencheur (appel du client, panne, accident)","2026-11-02T23:01:16.1308359",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"2d45e6e3-04c3-4123-deeb-08df38010b98","Localisation pour l'assistance et le dépannage","2026-11-02T23:01:18.7966424","2026-11-02T23:01:19.3005496","Sans accident : suppression à la fin du trajet. En cas d'accident ou de panne : suppression une fois la prestation d'assistance réalisée ou les procédures liées terminées.","Recommandation CNIL sur l'utilisation des données de localisation des véhicules connectés, 30 juin 2026, point 5.1 (assistance).","","Recommandation de la CNIL (30 juin 2026), par analogie avec le système européen eCall : trois dernières positions au plus, accès conditionné au fait générateur. Recommandation, non obligation légale.",{"customFields":104,"tags":105,"creator":106,"readonly":28,"purposes":107,"dataProcessings":109,"dataFields":111,"asset":27,"subjectCategories":131,"id":132,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":133,"description":27,"dateCreation":134,"dateUpdate":135,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":136,"baseActiveLegalBasis":101,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":137,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":70,"destructionLegalBasis":27,"dataSetSource":71,"sourceDescription":138,"assetId":27,"source":53},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[108,32],"e2a628c4-2d70-40d5-a046-6f10c327be40",[110],{"id":35,"label":36,"ref":27,"description":37,"workspaceId":38,"archived":28,"dateUpdate":39,"dateCreation":40,"areaId":41,"processingType":42},[112,119,125],{"id":113,"customFields":114,"ref":27,"archivingPolicy":27,"required":28,"label":115,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":116,"dataType":27,"dateCreation":117,"dateUpdate":27,"creator":118,"workflowStepId":52,"workflowStep":27,"source":53},"65dc03c0-0a55-4f9d-0211-08df38010ba5",{},"Identité du locataire ou du propriétaire","CivilStatus","2026-11-02T23:01:16.5073835",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":120,"customFields":121,"ref":27,"archivingPolicy":27,"required":28,"label":122,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":58,"dataType":27,"dateCreation":123,"dateUpdate":27,"creator":124,"workflowStepId":52,"workflowStep":27,"source":53},"45891fe7-2d44-4cba-0212-08df38010ba5",{},"Référence du contrat de location ou de service","2026-11-02T23:01:16.8886287",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":126,"customFields":127,"ref":27,"archivingPolicy":27,"required":28,"label":128,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":58,"dataType":27,"dateCreation":129,"dateUpdate":27,"creator":130,"workflowStepId":52,"workflowStep":27,"source":53},"3493d772-1e44-4fbd-0213-08df38010ba5",{},"Kilométrage parcouru calculé à partir de la localisation","2026-11-02T23:01:17.2319817",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"4a411314-beb7-4e20-deec-08df38010b98","Gestion du contrat et de la flotte de location","2026-11-02T23:01:19.5561984","2026-11-02T23:01:20.1146509","Durée du contrat de location ou de service.","Archivage intermédiaire possible pour les obligations comptables ou le temps de la prescription en cas de contentieux, à définir par le responsable de traitement.","Durée indicative, non imposée par un texte : fixée par le responsable de traitement selon la finalité (art. 5.1.e du RGPD). Aucune source officielle retrouvée. La CNIL admet l'archivage intermédiaire pour obligations comptables, sociales ou fiscales sans en préciser la durée.",{"customFields":140,"tags":141,"creator":142,"readonly":28,"purposes":143,"dataProcessings":145,"dataFields":147,"asset":27,"subjectCategories":160,"id":161,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":162,"description":27,"dateCreation":163,"dateUpdate":164,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":165,"baseActiveLegalBasis":166,"baseActiveRetentionDuration":167,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":101,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":70,"destructionLegalBasis":27,"dataSetSource":71,"sourceDescription":168,"assetId":27,"source":53},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[144],"731149c1-0b43-42d0-900c-8881446252da",[146],{"id":35,"label":36,"ref":27,"description":37,"workspaceId":38,"archived":28,"dateUpdate":39,"dateCreation":40,"areaId":41,"processingType":42},[148,154],{"id":149,"customFields":150,"ref":27,"archivingPolicy":27,"required":28,"label":151,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":49,"dataType":27,"dateCreation":152,"dateUpdate":27,"creator":153,"workflowStepId":52,"workflowStep":27,"source":53},"148aa9e4-48b1-4285-0214-08df38010ba5",{},"Positions pseudonymisées et trajets agrégés","2026-11-02T23:01:17.4875122",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":155,"customFields":156,"ref":27,"archivingPolicy":27,"required":28,"label":157,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":48,"personalDataCategory":58,"dataType":27,"dateCreation":158,"dateUpdate":27,"creator":159,"workflowStepId":52,"workflowStep":27,"source":53},"a2de2a4e-efeb-4b57-0215-08df38010ba5",{},"Données d'utilisation des fonctionnalités et équipements du véhicule","2026-11-02T23:01:17.7821221",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"3f8c58e1-b108-41de-deed-08df38010b98","Données d'usage pour l'amélioration des produits et services","2026-11-02T23:01:20.3753959","2026-11-02T23:01:20.8857001","3 ans maximum sous forme identifiante ou pseudonymisée ; les données anonymisées peuvent être conservées sans limite de durée.","Recommandation CNIL sur l'utilisation des données de localisation des véhicules connectés, 30 juin 2026, point 5 (optimisation et amélioration).",1576800,"La CNIL estime qu'une durée de trois ans est proportionnée pour cette finalité (recommandation du 30 juin 2026). Il s'agit d'une appréciation de la CNIL, non d'une obligation légale. La CNIL privilégie par ailleurs l'anonymisation, le plus tôt possible.",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],{},{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":41,"type":174,"parentId":27,"ref":27,"label":175,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":176,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},"Entity","Entité","FR",{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":41,"type":174,"parentId":27,"ref":27,"label":175,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":176,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},{"id":179,"label":180,"color":181,"order":30,"itemLimit":27,"type":11,"finalStep":28,"initialStep":182,"authorizedRole":27,"authorizedRoleId":27,"descriptionHtml":27,"mappedState":183},9439,"A compléter","#CCCCCC",true,"Draft",[],[],[],[188,202,214,225,238,249,260,270,280,291,302,312,322,333,344,355,365,375,385],{"date":189,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":191,"id":192,"ref":27,"label":193,"type":194,"description":195,"relatedRisk":27,"moreDetailsUrl":196,"dateCreation":197,"dateUpdate":27,"tags":198,"attachments":199,"creatorUser":200,"workflowStepId":201,"workflowStep":27},"2026-11-03T10:13:25.4119586Z","Done",{},"beba9da4-69b2-451b-69b0-08df38010b92","Pilotage de la sécurité des données","Organizational","L’intégration de la protection des données personnelles dans les processus de décision de l’organisme permet d’en assurer la prise en compte dans la durée et aux moments clés d’arbitrages des budgets et des projets. Les précautions élémentaires Impliquer la direction et formaliser des objectifs généraux en matière de sécurité et de protection des données personnelles, validés par la direction de l’organisme.","https://www.cnil.fr/fr/securite-piloter-la-securite-des-donnees","2026-11-02T20:57:37.2709862",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},90384,{"date":203,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":204,"id":205,"ref":27,"label":206,"type":194,"description":207,"relatedRisk":27,"moreDetailsUrl":208,"dateCreation":209,"dateUpdate":210,"tags":211,"attachments":212,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119625Z",{},"cde1cad2-4195-4ffe-9406-08dd823909d1","Cadre d'usage des utilisateurs","La charte doit rappeler les règles de protection des données et les sanctions possibles, définir son champ d’application (interventions informatiques, moyens d’authentification) et énoncer les règles de sécurité : signaler toute tentative d’intrusion, garder ses identifiants secrets, ne pas installer ni modifier de logiciels sans autorisation, verrouiller son poste en cas d’absence, n’accéder qu’aux informations utiles et respecter la procédure pour copier des données sur supports amovibles. Elle précise aussi les conditions d’usage des équipements informatiques et télécoms (poste de travail, matériels nomades, stockage, réseaux, appareils personnels, Internet, messagerie, téléphonie), les modalités d’administration du système (filtrage, traçabilité, gestion des postes) ainsi que les responsabilités et sanctions en cas de manquement.","https://www.cnil.fr/fr/securite-definir-un-cadre-pour-les-utilisateurs","2025-04-25T07:14:13.031896","2026-11-02T20:57:14.658541",[],[],90385,{"date":215,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":216,"id":217,"ref":27,"label":218,"type":194,"description":219,"relatedRisk":27,"moreDetailsUrl":220,"dateCreation":221,"dateUpdate":222,"tags":223,"attachments":224,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119633Z",{},"d77a94b8-cd42-409c-a02e-323ffad3924a","Sensibilisation et formation des utilisateurs","Les erreurs humaines et les attaques par ingénierie sociale sont à l’origine d’un nombre important d’incidents de sécurité. Les solutions techniques ne sont pas suffisantes pour assurer la protection des données personnelles détenues par un organisme.","https://www.cnil.fr/fr/securite-impliquer-et-former-les-utilisateurs","2019-01-01T00:00:00","2026-11-02T20:57:16.1776695",[],[],{"date":226,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":227,"id":228,"ref":27,"label":229,"type":230,"description":231,"relatedRisk":232,"moreDetailsUrl":233,"dateCreation":234,"dateUpdate":235,"tags":236,"attachments":237,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119641Z",{},"6c2ddc74-6750-4e76-bdad-317c6c0305ce","Authentification des utilisateurs","Technical","Avant toute utilisation des moyens informatiques, un utilisateur doit être doté d’un identifiant qui lui est propre et doit s’authentifier afin de permettre de contrôler son identité et ses accès aux données dont il a besoin. Les mécanismes permettant de réaliser l’authentification des personnes sont catégorisés selon qu’ils font intervenir :","Accès non autorisé, mots de passe partagés.","https://www.cnil.fr/fr/securite-authentifier-les-utilisateurs","2021-10-19T15:35:32.3166158","2026-11-02T20:57:18.0371731",[],[],{"date":239,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":240,"id":241,"ref":27,"label":242,"type":194,"description":243,"relatedRisk":27,"moreDetailsUrl":244,"dateCreation":245,"dateUpdate":246,"tags":247,"attachments":248,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119647Z",{},"f54ac346-ee7b-45de-9cc0-39506032df7e","Gestion des habilitations","Respecter le principe de moindre privilège, à travers la gestion des profils d’habilitation, permet de limiter les conséquences d’une usurpation de comptes ou d’une erreur de manipulation.","https://www.cnil.fr/fr/securite-gerer-les-habilitations","2021-10-19T15:35:32.1054015","2026-11-02T20:57:19.3398542",[],[],{"date":250,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":251,"id":252,"ref":27,"label":253,"type":230,"description":254,"relatedRisk":27,"moreDetailsUrl":255,"dateCreation":256,"dateUpdate":257,"tags":258,"attachments":259,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119655Z",{},"f748340f-fe32-47c4-983c-135130915929","Sécurité des postes de travail","Les risques d’intrusion dans les systèmes informatiques sont multiples et les postes de travail constituent un des principaux points d’entrée.","https://www.cnil.fr/fr/securite-securiser-les-postes-de-travail","2021-12-15T14:06:35.2861825","2026-11-02T20:57:20.9746731",[],[],{"date":261,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":262,"id":263,"ref":27,"label":264,"type":230,"description":265,"relatedRisk":27,"moreDetailsUrl":266,"dateCreation":221,"dateUpdate":267,"tags":268,"attachments":269,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119662Z",{},"ac192187-f8f9-42aa-9111-814f4a321407","Protection du réseau informatique","Le réseau interne interconnecte l’ensemble des composants des systèmes d’information d’un organisme et dispose souvent de points de connexion avec l’extérieur. Il s’agit tout autant d’un point d’entrée que d’un support de propagation des attaques. Il est donc primordial de sécuriser le réseau interne.","https://www.cnil.fr/fr/securite-proteger-le-reseau-informatique","2026-11-02T20:57:22.9977424",[],[],{"date":271,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":272,"id":273,"ref":27,"label":274,"type":230,"description":275,"relatedRisk":27,"moreDetailsUrl":276,"dateCreation":221,"dateUpdate":277,"tags":278,"attachments":279,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119668Z",{},"ed9bf5c2-97d3-4505-9b42-adabf6e7bd1d","Sécurité des serveurs","La sécurité des serveurs doit être une priorité car ils centralisent un grand nombre de données et hébergent les services permettant d’y accéder et de les manipuler. Les précautions élémentaires Désinstaller ou désactiver les services et interfaces inutiles. Limiter l’accès aux outils et interfaces d’administration aux seules personnes habilitées. Utiliser des comptes de moindres privilèges pour les opérations courantes.","https://www.cnil.fr/fr/securite-securiser-les-serveurs","2026-11-02T20:57:24.1598199",[],[],{"date":281,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":282,"id":283,"ref":27,"label":284,"type":285,"description":286,"relatedRisk":27,"moreDetailsUrl":287,"dateCreation":221,"dateUpdate":288,"tags":289,"attachments":290,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119674Z",{},"56e975ff-1611-4612-b85c-c7efcdd47c2c","Protection des locaux","Physical","L’accès aux locaux doit être contrôlé pour éviter ou ralentir un accès direct, non autorisé, que ce soit aux fichiers papier ou aux matériels informatiques, notamment aux serveurs. Les locaux doivent également être protégés contre les autres types de menaces (ex. : incendie, inondation). Les précautions élémentaires Restreindre les accès aux locaux au moyen de portes verrouillées. Installer des alarmes anti-intrusion et les vérifier périodiquement leur bon fonctionnement périodiquement.","https://www.cnil.fr/fr/securite-proteger-les-locaux","2026-11-02T20:57:28.139351",[],[],{"date":292,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":293,"id":294,"ref":27,"label":295,"type":194,"description":296,"relatedRisk":27,"moreDetailsUrl":297,"dateCreation":298,"dateUpdate":27,"tags":299,"attachments":300,"creatorUser":301,"workflowStepId":201,"workflowStep":27},"2026-11-03T10:13:25.4119681Z",{},"637227f2-e809-4991-69b1-08df38010b92","Encadrement de la maintenance et de la fin de vie des matériels et logiciels","Les opérations de support doivent être encadrées pour maitriser l’accès aux données par les prestataires. Les données doivent être préalablement effacées des matériels destinés à être mis au rebut.","https://www.cnil.fr/fr/securite-encadrer-la-maintenance-et-la-fin-de-vie-des-materiels-et-logiciels","2026-11-02T20:57:38.8686714",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":303,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":304,"id":305,"ref":27,"label":306,"type":230,"description":307,"relatedRisk":27,"moreDetailsUrl":308,"dateCreation":221,"dateUpdate":309,"tags":310,"attachments":311,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119691Z",{},"c8b527e2-07bc-4677-8c00-d222be26d357","Traçabilité des opérations","Afin de pouvoir identifier un accès frauduleux ou une utilisation abusive de données personnelles, ou de déterminer l’origine d’un incident, il convient d’enregistrer certaines des actions effectuées sur les systèmes informatiques. Les traces alors collectées sont également des éléments de preuve utiles pour la démonstration de la conformité.","https://www.cnil.fr/fr/securite-tracer-les-operations","2026-11-02T20:57:33.4681365",[],[],{"date":313,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":314,"id":315,"ref":27,"label":316,"type":230,"description":317,"relatedRisk":27,"moreDetailsUrl":318,"dateCreation":221,"dateUpdate":319,"tags":320,"attachments":321,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119697Z",{},"cae348c2-e9f2-4e49-8d60-ab56e438d5a4","Sauvegarde","Des copies de sauvegarde doivent être réalisées et testées régulièrement pour être disponibles en cas de besoin. Les précautions élémentaires S’agissant de la sauvegarde des données","https://www.cnil.fr/fr/securite-sauvegarder","2026-11-02T20:57:34.7827534",[],[],{"date":323,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":324,"id":325,"ref":27,"label":326,"type":230,"description":327,"relatedRisk":27,"moreDetailsUrl":328,"dateCreation":329,"dateUpdate":27,"tags":330,"attachments":331,"creatorUser":332,"workflowStepId":201,"workflowStep":27},"2026-11-03T10:13:25.4119703Z",{},"6eddff0a-1378-4160-69b2-08df38010b92","Continuité et reprise d'activité","Pour limiter le temps d’indisponibilité du système, il faut anticiper les incidents les plus courants. Assurer la continuité d’activité consiste à prévoir des moyens de continuer de fonctionner, en général de manière dégradée, malgré des dysfonctionnements. La reprise d’activité, quant à elle, englobe toutes les actions nécessaires pour relancer un système arrêté.","https://www.cnil.fr/fr/securite-prevoir-la-continuite-et-la-reprise-dactivite","2026-11-02T20:57:39.8112993",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":334,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":335,"id":336,"ref":27,"label":337,"type":194,"description":338,"relatedRisk":27,"moreDetailsUrl":339,"dateCreation":340,"dateUpdate":27,"tags":341,"attachments":342,"creatorUser":343,"workflowStepId":201,"workflowStep":27},"2026-11-03T10:13:25.4119709Z",{},"10c6151c-c44c-46df-69b3-08df38010b92","Gestion des incidents et des violations","Il convient d’être préparé à l’éventualité d’un incident pour intervenir à temps et de manière appropriée, en intégrant l’objectif de limiter les effets pour les personnes dont les données sont concernées. Le responsable de traitement peut être amené à notifier la CNIL ou informer les personnes concernées de l’incident en fonction du risque pour celles-ci.","https://www.cnil.fr/fr/securite-gerer-les-incidents-et-les-violations","2026-11-02T20:57:40.7676498",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":345,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":346,"id":347,"ref":27,"label":348,"type":194,"description":349,"relatedRisk":27,"moreDetailsUrl":350,"dateCreation":351,"dateUpdate":27,"tags":352,"attachments":353,"creatorUser":354,"workflowStepId":201,"workflowStep":27},"2026-11-03T10:13:25.4119715Z",{},"e064565b-514e-4755-69b4-08df38010b92","Analyse de risques","En parallèle de la mise en conformité aux précautions élémentaires présentées dans ce guide, il est pertinent, voire obligatoire selon la criticité des traitements, de réaliser des analyses de risques relative à la protection des données. Ces analyses permettent de décider des mesures de sécurité complémentaires, adaptées au contexte, permettant de limiter l’impact sur les personnes concernées par le traitement.","https://www.cnil.fr/fr/securite-analyse-de-risques","2026-11-02T20:57:42.2940193",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":356,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":357,"id":358,"ref":27,"label":359,"type":230,"description":360,"relatedRisk":27,"moreDetailsUrl":361,"dateCreation":221,"dateUpdate":362,"tags":363,"attachments":364,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119723Z",{},"eaf489b5-7441-4bb3-8aee-0b894f6ade51","Chiffrement, hachage et signature","Moyens mis en œuvre pour assurer la confidentialité des données conservées (en base de données, dans des fichiers plats, dans les sauvegardes, etc.) ainsi que les modalités de gestion des clés de chiffrement (création, conservation, modification en cas de suspections de compromission, etc.).\n\nDétaillez les moyens de chiffrement employés pour les flux de données (VPN, TLS, etc.) intégrés dans le traitement.","https://www.cnil.fr/fr/securite-chiffrement-hachage-signature","2026-11-02T20:57:36.4902402",[],[],{"date":366,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":367,"id":368,"ref":27,"label":369,"type":194,"description":370,"relatedRisk":27,"moreDetailsUrl":371,"dateCreation":221,"dateUpdate":372,"tags":373,"attachments":374,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119736Z",{},"47c52bcb-a6e9-487b-a958-f027b20dbd87","Encadrement de la sous-traitance","Les traitements de données réalisés par un sous-traitant pour le compte du responsable de traitement doivent bénéficier de garanties suffisantes, notamment en matière de sécurité.","https://www.cnil.fr/fr/securite-gerer-la-sous-traitance","2026-11-02T20:57:31.4211019",[],[],{"date":376,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":377,"id":378,"ref":27,"label":379,"type":194,"description":380,"relatedRisk":27,"moreDetailsUrl":381,"dateCreation":221,"dateUpdate":382,"tags":383,"attachments":384,"creatorUser":27,"workflowStepId":213,"workflowStep":27},"2026-11-03T10:13:25.4119744Z",{},"49230bff-1cd3-46bd-85f5-e43809136dc9","Sécurité des échanges avec l'extérieur","Sans mesure complémentaire, les canaux de transmission de données grand public (ex. : messagerie électronique, messagerie instantanée, plateforme de dépôt de fichiers) constituent rarement un moyen de communication sûr pour transmettre des données personnelles. Une simple erreur d’inattention peut conduire des personnes non habilitées à prendre connaissance de données personnelles, ce qui porte atteinte au droit à la vie privée des personnes concernées.","https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-lexterieur","2026-11-02T20:57:29.3610605",[],[],{"date":386,"state":190,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":387,"id":388,"ref":27,"label":389,"type":194,"description":390,"relatedRisk":27,"moreDetailsUrl":391,"dateCreation":392,"dateUpdate":27,"tags":393,"attachments":394,"creatorUser":395,"workflowStepId":201,"workflowStep":27},"2026-11-03T10:13:25.411975Z",{},"eba73701-684c-4de3-69ba-08df38010b92","RGS : référentiel général de sécurité des autorités administratives","Appliquer le référentiel général de sécurité (RGS) de l'ANSSI : homologation de sécurité des systèmes d'information des autorités administratives (ordonnance n° 2005-1516).","https://cyber.gouv.fr/le-referentiel-general-de-securite-rgs","2026-11-02T20:57:48.3845718",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[397,406],{"subjectCategory":398,"displayName":400,"id":404,"subjectCategoryId":399,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":405},{"id":399,"label":400,"ref":27,"dateCreation":401,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":402,"workflowStep":27,"dataRetentionRules":403},"983407ad-24f5-48b6-268b-08dac757bbf1","Clients","2022-11-15T22:21:36.912217",97319,[],"04b5cfb2-1d19-49a8-e6ba-08df38010be0",[],{"subjectCategory":407,"displayName":409,"id":413,"subjectCategoryId":408,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":414},{"id":408,"label":409,"ref":27,"dateCreation":410,"dateUpdate":27,"creatorUserId":411,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":402,"workflowStep":27,"dataRetentionRules":412},"1342173f-ef7e-432a-a1b8-01a0b9b1dd9e","Utilisateurs","2023-03-22T17:20:52.1013434",31,[],"808945c7-890d-4420-e6bb-08df38010be0",[],"\u003Cblockquote>\u003Cp>\u003Cstrong>Modèle à adapter\u003C/strong>\u003C/p>\u003Cp>Modèle de traitement fourni à titre indicatif, à adapter à votre organisation. Les finalités, les données, les durées de conservation, les destinataires, les mesures de sécurité et l'analyse d'impact y sont des valeurs de départ, établies à partir des textes et référentiels cités ci-dessous. \u003Cstrong>Ce modèle ne constitue pas un avis juridique\u003C/strong> : faites-le valider par votre DPO ou votre conseil.\u003C/p>\u003C/blockquote>\u003Cblockquote>\u003Cp>\u003Cstrong>Point d'attention\u003C/strong> : La recommandation de la CNIL du 30 juin 2026 vise les particuliers. Les véhicules de fonction sont hors périmètre : voir le modèle « Géolocalisation des véhicules utilisés par les employés ».\u003C/p>\u003C/blockquote>\u003Ch3>Sources\u003C/h3>\u003Cp>\u003Cem>Classement selon le guide pratique CNIL « Les durées de conservation ».\u003C/em>\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/default/files/2026-06/recommandation_utilisation_de_donnees_de_localisation.pdf\">CNIL, Utilisation des données de localisation des véhicules connectés, recommandation publiée le 30 juin 2026\u003C/a>. Périmètre et acteurs, finalités couvertes (gestion de flotte, assistance, lutte contre le vol, amélioration), bases légales (consentement, contrat, intérêt légitime, mission d'intérêt public, obligation légale), minimisation (dernière position, trois dernières positions), durées de conservation, rôles responsable, sous-traitant, responsables conjoints, réquisitions judiciaires, AIPD, anonymisation.\u003C/li>\u003C/ul>","Automatic","ManualOrOnDemand","NonApplicable","Les personnes sont informées au moment de la collecte (art. 13 du RGPD) ou, en cas de collecte indirecte, au plus tard dans un délai d'un mois (art. 14).","Droit d'opposition non applicable : il ne vise que les traitements fondés sur l'intérêt légitime ou une mission d'intérêt public (art. 21.1 du RGPD) ou la prospection (art. 21.2). Ici le traitement repose sur une obligation légale, un contrat ou le consentement. Le consentement se retire à tout moment (art. 7.3).",[],[423,431,446,453,460,466,473],{"purposes":424,"dataRetentionRules":27,"parentId":27,"children":425,"displayName":426,"label":426,"transfers":427,"recipientType":428,"type":429,"jobTitle":27,"id":430,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Personnel habilité du service de gestion de flotte ou service client",[],"InternalService","Recipient","505f215d-dc3b-4b0c-a0a8-08df38010bcb",{"purposes":432,"dataRetentionRules":27,"parentId":27,"children":433,"displayName":434,"label":435,"transfers":436,"recipientType":437,"type":429,"jobTitle":27,"id":438,"actorId":439,"actor":440,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Sous-traitant à préciser","Prestataire de plateforme de localisation, fournisseur de boîtiers télématiques et hébergeur",[],"Vendor","e28d5a78-1576-4506-a0a9-08df38010bcb","1af96d46-eb9e-45f3-64bc-08df38010bd1",{"label":434,"id":439,"ref":27,"dateCreation":441,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":442,"actorType":443,"description":444,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":445,"areaId":27,"source":53},"2026-11-02T20:57:51.2801474","New","Morale","Acteur générique des modèles de traitement : à remplacer par le prestataire retenu (sous-traitant au sens de l'article 28 du RGPD).",76516,{"purposes":447,"dataRetentionRules":27,"parentId":27,"children":448,"displayName":434,"label":449,"transfers":450,"recipientType":437,"type":429,"jobTitle":27,"id":451,"actorId":439,"actor":452,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Agrégateur ou intégrateur de données de véhicules",[],"8bb0d65d-d380-4c53-a0aa-08df38010bcb",{"label":434,"id":439,"ref":27,"dateCreation":441,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":442,"actorType":443,"description":444,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":445,"areaId":27,"source":53},{"purposes":454,"dataRetentionRules":27,"parentId":27,"children":455,"displayName":456,"label":456,"transfers":457,"recipientType":458,"type":429,"jobTitle":27,"id":459,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Société d'assistance ou de dépannage",[],"ThirdParty","69bd5a6e-75bb-4468-a0ab-08df38010bcb",{"purposes":461,"dataRetentionRules":27,"parentId":27,"children":462,"displayName":463,"label":463,"transfers":464,"recipientType":458,"type":429,"jobTitle":27,"id":465,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Constructeur du véhicule (accès aux données par API)",[],"83bb7a78-34f9-4e2c-a0ac-08df38010bcb",{"purposes":467,"dataRetentionRules":27,"parentId":27,"children":468,"displayName":469,"label":469,"transfers":470,"recipientType":471,"type":429,"jobTitle":27,"id":472,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Autorité organisatrice de la mobilité en responsabilité conjointe",[],"JointController","bb6a44e5-3d9a-4a14-a0ad-08df38010bcb",{"purposes":474,"dataRetentionRules":27,"parentId":27,"children":475,"displayName":476,"label":476,"transfers":477,"recipientType":478,"type":429,"jobTitle":27,"id":479,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Forces de l'ordre et autorités judiciaires (réquisition)",[],"AuthorizedThirdParty","de29dcf2-9c7b-4576-a0ae-08df38010bcb",[],[482,488,492,496],{"id":483,"key":32,"label":484,"description":485,"legalBasis":486,"legalBasisText":487,"legalBasisDescription":27,"readonly":28},"421b807f-4c24-4255-107f-08df38010b80","Prévention des abus de confiance et lutte contre le vol","Retrouver un véhicule non restitué ou volé. Selon la recommandation de la CNIL, la base du contrat convient quand le client a souscrit un service de pistage, ou pour un loueur dont le service de location est affecté par la non-restitution. L'accès à la position n'est possible qu'après le fait générateur (vol ou non-restitution suspecté ou déclaré).","Contract","Contrat ou mesures précontractuelles",{"id":489,"key":78,"label":490,"description":491,"legalBasis":486,"legalBasisText":487,"legalBasisDescription":27,"readonly":28},"20345414-89e1-47f9-1080-08df38010b80","Assistance aux personnes et dépannage en cas de panne ou d'accident","Localiser le véhicule pour envoyer les secours ou un dépanneur. Le contrat est mobilisable si l'assistance est une option choisie par le client ; si elle est incluse d'office dans le contrat de vente ou de location, la CNIL indique que le consentement est la base appropriée. Certains systèmes (eCall) reposent sur une obligation légale européenne.",{"id":493,"key":108,"label":494,"description":495,"legalBasis":486,"legalBasisText":487,"legalBasisDescription":27,"readonly":28},"5fb9023c-5125-455d-1081-08df38010b80","Gestion de la flotte et exécution des contrats de location","Vérifier par exemple le kilométrage d'un contrat à kilométrage limité, lorsque cela est nécessaire à la facturation et qu'aucun moyen moins intrusif n'existe (la CNIL cite ce cas pour la base du contrat).",{"id":497,"key":144,"label":498,"description":499,"legalBasis":500,"legalBasisText":501,"legalBasisDescription":27,"readonly":28},"a8b3b314-b722-4276-1082-08df38010b80","Optimisation et amélioration des produits et services","Analyser l'usage des véhicules ou des services pour les améliorer. La CNIL indique que cette finalité requiert en principe le consentement préalable de l'utilisateur, sauf si les données sont d'abord anonymisées (l'anonymisation peut alors reposer sur l'intérêt légitime).","Consent","Consentement",100,67,5]