[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUSErYVxvoaChflrWp54FpC1cplbQPLBA9Y4VaPCcyE8":3},{"assets":4,"aiSystems":5,"attachments":6,"tags":7,"dataRetentionRules":20,"creatorUser":154,"creatorUserId":25,"updatedBy":155,"updatedById":25,"publishedBy":27,"publishedById":27,"areaOwnerId":27,"owners":156,"customFields":157,"area":158,"entity":162,"mergedFrom":27,"workflowStep":163,"accountables":169,"responsibles":170,"informedOwners":171,"securityMeasures":172,"personCategories":381,"id":36,"source":63,"label":37,"state":168,"versionDescription":27,"processingType":43,"parentId":27,"areaId":42,"mergeType":27,"readonly":28,"editable":167,"workflowStepId":164,"dateDeployment":27,"dateCreation":41,"dateArchived":27,"datePublication":27,"archived":28,"dateUpdate":40,"reviewDate":27,"nextReviewDate":27,"ref":27,"processingState":27,"description":38,"descriptionHtml":416,"subjectRightProcessDescription":27,"rightOfInformation":417,"rightOfAccess":418,"rightOfRectification":418,"rightOfErasure":418,"rightOfRestriction":418,"rightOfOpposition":418,"rightOfDataPortability":418,"advanceDirectives":418,"advanceDirectivesDescription":27,"rightOfInformationDescription":419,"rightOfAccessDescription":27,"rightOfRectificationDescription":27,"rightOfErasureDescription":27,"rightOfRestrictionDescription":27,"rightOfOppositionDescription":27,"rightOfDataPortabilityDescription":27,"stakeHolders":420,"assessmentScoring":28,"automaticDecision":28,"systematicMonitoring":28,"specialCategoryData":28,"largeScaleCollection":28,"crossReferencing":28,"vulnerablePeople":28,"isDPIARequired":28,"dpiaDate":27,"dpiaExemption":28,"dpiaExemptionJustification":27,"innovativeUse":28,"exclusionBenefitRightContract":28,"recipients":421,"dataControllers":469,"purposes":470,"progression":491,"quality":492,"sensitivity":493,"visible":167,"workspaceId":39,"nbReferences":30,"referenceId":27},[],[],[],[8,13,16],{"id":9,"label":10,"type":11,"color":12},"99e6f156-5bd7-4bc1-94c7-7f416665cf20","Organisme : Privé","DataProcessing","#64748B",{"id":14,"label":15,"type":11,"color":12},"5494cd34-13e6-4954-81cd-000195723eb0","Organisme : Public",{"id":17,"label":18,"type":11,"color":19},"a680bc18-6adc-4655-ba78-cbc42b58e390","Fonction : Ressources humaines","#B45309",[21,87,117],{"customFields":22,"tags":23,"creator":24,"readonly":28,"purposes":31,"dataProcessings":34,"dataFields":44,"asset":27,"subjectCategories":76,"id":77,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":78,"description":27,"dateCreation":79,"dateUpdate":80,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":81,"baseActiveLegalBasis":82,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":83,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":86,"assetId":27,"source":63},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},1602,"bc4946f8-1de1-4b70-bb67-62a0ce536160",null,false,"#4DE034",0,[32,33],"f4bb9830-f2b6-420c-8061-99c616a3e37d","fe49551b-e989-4b7e-8d77-e7f5cdd5be15",[35],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},"f42a6a76-4724-4dbc-36cf-08df38010b74","Intranet d'entreprise et annuaire interne","Ce modèle de traitement est relatif à la gestion de l'annuaire interne, de l'organigramme et du trombinoscope des agents, à la publication d'informations et de photographies sur l'intranet, ainsi qu'aux journaux de connexion de l'intranet.",68,"2026-11-03T07:47:43.1155078","2026-11-03T07:47:42.0327762",354,"Default",[45,55,64,70],{"id":46,"customFields":47,"ref":27,"archivingPolicy":27,"required":28,"label":48,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":50,"dataType":27,"dateCreation":51,"dateUpdate":52,"creator":27,"workflowStepId":53,"workflowStep":27,"source":54},"b4c279e1-ca69-4958-3ef7-08d8d8ff078f",{},"Nom et prénom","Current","CivilStatus","2021-02-25T08:47:35.132248","2023-07-27T13:14:45.0770506",83451,"Intern",{"id":56,"customFields":57,"ref":27,"archivingPolicy":27,"required":28,"label":58,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":60,"dateUpdate":27,"creator":61,"workflowStepId":62,"workflowStep":27,"source":63},"e37f0a47-6a94-4058-02d4-08df38010ba5",{},"Fonction, service et rattachement hiérarchique","ProfessionalLife","2026-11-03T07:47:38.4400871",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},83450,"Api",{"id":65,"customFields":66,"ref":27,"archivingPolicy":27,"required":28,"label":67,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":68,"dateUpdate":27,"creator":69,"workflowStepId":62,"workflowStep":27,"source":63},"f5892571-dc77-4094-02d5-08df38010ba5",{},"Téléphone et adresse électronique professionnels","2026-11-03T07:47:38.624289",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":71,"customFields":72,"ref":27,"archivingPolicy":27,"required":28,"label":73,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":74,"dateUpdate":27,"creator":75,"workflowStepId":62,"workflowStep":27,"source":63},"301698b9-7172-423f-02d6-08df38010ba5",{},"Formation et réalisations professionnelles (facultatif)","2026-11-03T07:47:38.8691168",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"47e846f5-d209-4c53-df2b-08df38010b98","Annuaire interne et organigramme","2026-11-03T07:47:40.2051316","2026-11-03T07:47:40.6278681","Durée de présence de l'agent dans l'organisme","Référentiel CNIL de gestion du personnel (2023) pour les données ; aucune durée propre à l'annuaire.","","À l'issue de la durée de conservation, les données sont supprimées de manière sécurisée ou anonymisées de façon irréversible.","Direct","Pas de durée imposée : la CNIL indique que les données de gestion du personnel sont conservées pendant la présence de l'agent (page « Les règles pour la gestion du personnel »). Retrait de l'annuaire au départ : choix du responsable de traitement.",{"customFields":88,"tags":89,"creator":90,"readonly":28,"purposes":91,"dataProcessings":93,"dataFields":95,"asset":27,"subjectCategories":110,"id":111,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":112,"description":27,"dateCreation":113,"dateUpdate":114,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":115,"baseActiveLegalBasis":83,"baseActiveRetentionDuration":27,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":83,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":116,"assetId":27,"source":63},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[92],"f1a646a7-f279-4ad0-8214-c055b411ef25",[94],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[96,103],{"id":97,"customFields":98,"ref":27,"archivingPolicy":27,"required":28,"label":99,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":100,"dataType":27,"dateCreation":101,"dateUpdate":27,"creator":102,"workflowStepId":62,"workflowStep":27,"source":63},"2d3de379-e4aa-477f-02d7-08df38010ba5",{},"Photographie de l'agent","PersonalLife","2026-11-03T07:47:39.117699",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":104,"customFields":105,"ref":27,"archivingPolicy":27,"required":28,"label":106,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":107,"dataType":27,"dateCreation":108,"dateUpdate":27,"creator":109,"workflowStepId":62,"workflowStep":27,"source":63},"f95ba266-43ee-4aeb-02d8-08df38010ba5",{},"Date et trace de l'accord de l'agent","Other","2026-11-03T07:47:39.3541165",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"97783f17-1558-42d7-df2c-08df38010b98","Trombinoscope et photographies","2026-11-03T07:47:40.8506217","2026-11-03T07:47:41.2672636","Jusqu'au retrait de l'accord ou au départ de l'agent","Pas de durée imposée : la photographie est facultative et repose sur l'accord de l'agent. Durée à fixer par l'organisme.",{"customFields":118,"tags":119,"creator":120,"readonly":28,"purposes":121,"dataProcessings":123,"dataFields":125,"asset":27,"subjectCategories":145,"id":146,"ref":27,"externalId":27,"externalLastSyncDate":27,"externalSource":27,"label":147,"description":27,"dateCreation":148,"dateUpdate":149,"baseActiveOverride":28,"intermediateArchivingOverride":28,"destructionOverride":28,"baseActiveDescription":150,"baseActiveLegalBasis":151,"baseActiveRetentionDuration":152,"baseActiveMinMax":27,"intermediateArchivingLegalBasis":27,"intermediateArchivingDescription":83,"intermediateArchivingRetentionDuration":27,"intermediateArchivingMinMax":27,"destructionDescription":84,"destructionLegalBasis":27,"dataSetSource":85,"sourceDescription":153,"assetId":27,"source":63},{},[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[122,33],"6d760a4a-e3b2-4943-a193-03b7352d7a3b",[124],{"id":36,"label":37,"ref":27,"description":38,"workspaceId":39,"archived":28,"dateUpdate":40,"dateCreation":41,"areaId":42,"processingType":43},[126,132,139],{"id":127,"customFields":128,"ref":27,"archivingPolicy":27,"required":28,"label":129,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":130,"dateUpdate":27,"creator":131,"workflowStepId":62,"workflowStep":27,"source":63},"d0fcd3ef-3de0-4c07-02d9-08df38010ba5",{},"Identifiant de compte et profil de droits","2026-11-03T07:47:39.5357874",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":133,"customFields":134,"ref":27,"archivingPolicy":27,"required":28,"label":135,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":136,"dataType":27,"dateCreation":137,"dateUpdate":27,"creator":138,"workflowStepId":62,"workflowStep":27,"source":63},"16c563b8-4d56-4810-02da-08df38010ba5",{},"Adresse IP, date et heure de connexion","ConnectionData","2026-11-03T07:47:39.766195",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":140,"customFields":141,"ref":27,"archivingPolicy":27,"required":28,"label":142,"definition":27,"technicalDefinition":27,"sensitiveDataFieldLegalJustification":27,"sensitiveDataFieldLegalJustificationDescription":27,"sensitiveData":28,"sensitivityClassification":49,"personalDataCategory":59,"dataType":27,"dateCreation":143,"dateUpdate":27,"creator":144,"workflowStepId":62,"workflowStep":27,"source":63},"403e6b16-4c34-44c3-02db-08df38010ba5",{},"Contributions aux espaces de discussion","2026-11-03T07:47:39.9809664",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],"55efb583-5e16-4a8f-df2d-08df38010b98","Comptes et journaux de connexion de l'intranet","2026-11-03T07:47:41.461832","2026-11-03T07:47:41.8267906","De 6 mois à 1 an glissants pour les journaux (recommandation CNIL)","Recommandation CNIL, non obligatoire.",525600,"Journaux : Recommandation CNIL : conserver les journaux de 6 mois à 1 an glissants, sauf obligation légale, gestion de litige, contrôle interne ou analyse post-incident (fiche « Tracer les opérations » et référentiel de durées RH 2026, délibération 2021-122). Ce n'est pas une obligation légale. Contributions et comptes : durée indicative, fixée par le responsable de traitement.",{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[],{},{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":159,"parentId":27,"ref":27,"label":160,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":161,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},"Entity","Entité","FR",{"dpo":27,"referent":27,"owner":27,"representative":27,"dataProtectionAuthority":27,"id":42,"type":159,"parentId":27,"ref":27,"label":160,"description":27,"logoUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"countryCode":161,"immatriculationNumber":27,"phoneNumber":27,"mailAddress":27,"dpoId":27,"referentId":27,"ownerId":27,"representativeId":27,"dataProtectionAuthorityId":27},{"id":164,"label":165,"color":166,"order":30,"itemLimit":27,"type":11,"finalStep":28,"initialStep":167,"authorizedRole":27,"authorizedRoleId":27,"descriptionHtml":27,"mappedState":168},9439,"A compléter","#CCCCCC",true,"Draft",[],[],[],[173,187,199,210,223,234,245,255,265,276,287,297,307,318,329,340,350,360,370],{"date":174,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":176,"id":177,"ref":27,"label":178,"type":179,"description":180,"relatedRisk":27,"moreDetailsUrl":181,"dateCreation":182,"dateUpdate":27,"tags":183,"attachments":184,"creatorUser":185,"workflowStepId":186,"workflowStep":27},"2026-11-03T11:39:28.500584Z","Done",{},"beba9da4-69b2-451b-69b0-08df38010b92","Pilotage de la sécurité des données","Organizational","L’intégration de la protection des données personnelles dans les processus de décision de l’organisme permet d’en assurer la prise en compte dans la durée et aux moments clés d’arbitrages des budgets et des projets. Les précautions élémentaires Impliquer la direction et formaliser des objectifs généraux en matière de sécurité et de protection des données personnelles, validés par la direction de l’organisme.","https://www.cnil.fr/fr/securite-piloter-la-securite-des-donnees","2026-11-02T20:57:37.2709862",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},90384,{"date":188,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":189,"id":190,"ref":27,"label":191,"type":179,"description":192,"relatedRisk":27,"moreDetailsUrl":193,"dateCreation":194,"dateUpdate":195,"tags":196,"attachments":197,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005874Z",{},"cde1cad2-4195-4ffe-9406-08dd823909d1","Cadre d'usage des utilisateurs","La charte doit rappeler les règles de protection des données et les sanctions possibles, définir son champ d’application (interventions informatiques, moyens d’authentification) et énoncer les règles de sécurité : signaler toute tentative d’intrusion, garder ses identifiants secrets, ne pas installer ni modifier de logiciels sans autorisation, verrouiller son poste en cas d’absence, n’accéder qu’aux informations utiles et respecter la procédure pour copier des données sur supports amovibles. Elle précise aussi les conditions d’usage des équipements informatiques et télécoms (poste de travail, matériels nomades, stockage, réseaux, appareils personnels, Internet, messagerie, téléphonie), les modalités d’administration du système (filtrage, traçabilité, gestion des postes) ainsi que les responsabilités et sanctions en cas de manquement.","https://www.cnil.fr/fr/securite-definir-un-cadre-pour-les-utilisateurs","2025-04-25T07:14:13.031896","2026-11-02T20:57:14.658541",[],[],90385,{"date":200,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":201,"id":202,"ref":27,"label":203,"type":179,"description":204,"relatedRisk":27,"moreDetailsUrl":205,"dateCreation":206,"dateUpdate":207,"tags":208,"attachments":209,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005881Z",{},"d77a94b8-cd42-409c-a02e-323ffad3924a","Sensibilisation et formation des utilisateurs","Les erreurs humaines et les attaques par ingénierie sociale sont à l’origine d’un nombre important d’incidents de sécurité. Les solutions techniques ne sont pas suffisantes pour assurer la protection des données personnelles détenues par un organisme.","https://www.cnil.fr/fr/securite-impliquer-et-former-les-utilisateurs","2019-01-01T00:00:00","2026-11-02T20:57:16.1776695",[],[],{"date":211,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":212,"id":213,"ref":27,"label":214,"type":215,"description":216,"relatedRisk":217,"moreDetailsUrl":218,"dateCreation":219,"dateUpdate":220,"tags":221,"attachments":222,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005888Z",{},"6c2ddc74-6750-4e76-bdad-317c6c0305ce","Authentification des utilisateurs","Technical","Avant toute utilisation des moyens informatiques, un utilisateur doit être doté d’un identifiant qui lui est propre et doit s’authentifier afin de permettre de contrôler son identité et ses accès aux données dont il a besoin. Les mécanismes permettant de réaliser l’authentification des personnes sont catégorisés selon qu’ils font intervenir :","Accès non autorisé, mots de passe partagés.","https://www.cnil.fr/fr/securite-authentifier-les-utilisateurs","2021-10-19T15:35:32.3166158","2026-11-02T20:57:18.0371731",[],[],{"date":224,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":225,"id":226,"ref":27,"label":227,"type":179,"description":228,"relatedRisk":27,"moreDetailsUrl":229,"dateCreation":230,"dateUpdate":231,"tags":232,"attachments":233,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005895Z",{},"f54ac346-ee7b-45de-9cc0-39506032df7e","Gestion des habilitations","Respecter le principe de moindre privilège, à travers la gestion des profils d’habilitation, permet de limiter les conséquences d’une usurpation de comptes ou d’une erreur de manipulation.","https://www.cnil.fr/fr/securite-gerer-les-habilitations","2021-10-19T15:35:32.1054015","2026-11-02T20:57:19.3398542",[],[],{"date":235,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":236,"id":237,"ref":27,"label":238,"type":215,"description":239,"relatedRisk":27,"moreDetailsUrl":240,"dateCreation":241,"dateUpdate":242,"tags":243,"attachments":244,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005905Z",{},"f748340f-fe32-47c4-983c-135130915929","Sécurité des postes de travail","Les risques d’intrusion dans les systèmes informatiques sont multiples et les postes de travail constituent un des principaux points d’entrée.","https://www.cnil.fr/fr/securite-securiser-les-postes-de-travail","2021-12-15T14:06:35.2861825","2026-11-02T20:57:20.9746731",[],[],{"date":246,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":247,"id":248,"ref":27,"label":249,"type":215,"description":250,"relatedRisk":27,"moreDetailsUrl":251,"dateCreation":206,"dateUpdate":252,"tags":253,"attachments":254,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005912Z",{},"ac192187-f8f9-42aa-9111-814f4a321407","Protection du réseau informatique","Le réseau interne interconnecte l’ensemble des composants des systèmes d’information d’un organisme et dispose souvent de points de connexion avec l’extérieur. Il s’agit tout autant d’un point d’entrée que d’un support de propagation des attaques. Il est donc primordial de sécuriser le réseau interne.","https://www.cnil.fr/fr/securite-proteger-le-reseau-informatique","2026-11-02T20:57:22.9977424",[],[],{"date":256,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":257,"id":258,"ref":27,"label":259,"type":215,"description":260,"relatedRisk":27,"moreDetailsUrl":261,"dateCreation":206,"dateUpdate":262,"tags":263,"attachments":264,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005918Z",{},"ed9bf5c2-97d3-4505-9b42-adabf6e7bd1d","Sécurité des serveurs","La sécurité des serveurs doit être une priorité car ils centralisent un grand nombre de données et hébergent les services permettant d’y accéder et de les manipuler. Les précautions élémentaires Désinstaller ou désactiver les services et interfaces inutiles. Limiter l’accès aux outils et interfaces d’administration aux seules personnes habilitées. Utiliser des comptes de moindres privilèges pour les opérations courantes.","https://www.cnil.fr/fr/securite-securiser-les-serveurs","2026-11-02T20:57:24.1598199",[],[],{"date":266,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":267,"id":268,"ref":27,"label":269,"type":270,"description":271,"relatedRisk":27,"moreDetailsUrl":272,"dateCreation":206,"dateUpdate":273,"tags":274,"attachments":275,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005925Z",{},"56e975ff-1611-4612-b85c-c7efcdd47c2c","Protection des locaux","Physical","L’accès aux locaux doit être contrôlé pour éviter ou ralentir un accès direct, non autorisé, que ce soit aux fichiers papier ou aux matériels informatiques, notamment aux serveurs. Les locaux doivent également être protégés contre les autres types de menaces (ex. : incendie, inondation). Les précautions élémentaires Restreindre les accès aux locaux au moyen de portes verrouillées. Installer des alarmes anti-intrusion et les vérifier périodiquement leur bon fonctionnement périodiquement.","https://www.cnil.fr/fr/securite-proteger-les-locaux","2026-11-02T20:57:28.139351",[],[],{"date":277,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":278,"id":279,"ref":27,"label":280,"type":179,"description":281,"relatedRisk":27,"moreDetailsUrl":282,"dateCreation":283,"dateUpdate":27,"tags":284,"attachments":285,"creatorUser":286,"workflowStepId":186,"workflowStep":27},"2026-11-03T11:39:28.5005945Z",{},"637227f2-e809-4991-69b1-08df38010b92","Encadrement de la maintenance et de la fin de vie des matériels et logiciels","Les opérations de support doivent être encadrées pour maitriser l’accès aux données par les prestataires. Les données doivent être préalablement effacées des matériels destinés à être mis au rebut.","https://www.cnil.fr/fr/securite-encadrer-la-maintenance-et-la-fin-de-vie-des-materiels-et-logiciels","2026-11-02T20:57:38.8686714",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":288,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":289,"id":290,"ref":27,"label":291,"type":215,"description":292,"relatedRisk":27,"moreDetailsUrl":293,"dateCreation":206,"dateUpdate":294,"tags":295,"attachments":296,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005951Z",{},"c8b527e2-07bc-4677-8c00-d222be26d357","Traçabilité des opérations","Afin de pouvoir identifier un accès frauduleux ou une utilisation abusive de données personnelles, ou de déterminer l’origine d’un incident, il convient d’enregistrer certaines des actions effectuées sur les systèmes informatiques. Les traces alors collectées sont également des éléments de preuve utiles pour la démonstration de la conformité.","https://www.cnil.fr/fr/securite-tracer-les-operations","2026-11-02T20:57:33.4681365",[],[],{"date":298,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":299,"id":300,"ref":27,"label":301,"type":215,"description":302,"relatedRisk":27,"moreDetailsUrl":303,"dateCreation":206,"dateUpdate":304,"tags":305,"attachments":306,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005957Z",{},"cae348c2-e9f2-4e49-8d60-ab56e438d5a4","Sauvegarde","Des copies de sauvegarde doivent être réalisées et testées régulièrement pour être disponibles en cas de besoin. Les précautions élémentaires S’agissant de la sauvegarde des données","https://www.cnil.fr/fr/securite-sauvegarder","2026-11-02T20:57:34.7827534",[],[],{"date":308,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":309,"id":310,"ref":27,"label":311,"type":215,"description":312,"relatedRisk":27,"moreDetailsUrl":313,"dateCreation":314,"dateUpdate":27,"tags":315,"attachments":316,"creatorUser":317,"workflowStepId":186,"workflowStep":27},"2026-11-03T11:39:28.5005966Z",{},"6eddff0a-1378-4160-69b2-08df38010b92","Continuité et reprise d'activité","Pour limiter le temps d’indisponibilité du système, il faut anticiper les incidents les plus courants. Assurer la continuité d’activité consiste à prévoir des moyens de continuer de fonctionner, en général de manière dégradée, malgré des dysfonctionnements. La reprise d’activité, quant à elle, englobe toutes les actions nécessaires pour relancer un système arrêté.","https://www.cnil.fr/fr/securite-prevoir-la-continuite-et-la-reprise-dactivite","2026-11-02T20:57:39.8112993",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":319,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":320,"id":321,"ref":27,"label":322,"type":179,"description":323,"relatedRisk":27,"moreDetailsUrl":324,"dateCreation":325,"dateUpdate":27,"tags":326,"attachments":327,"creatorUser":328,"workflowStepId":186,"workflowStep":27},"2026-11-03T11:39:28.5005971Z",{},"10c6151c-c44c-46df-69b3-08df38010b92","Gestion des incidents et des violations","Il convient d’être préparé à l’éventualité d’un incident pour intervenir à temps et de manière appropriée, en intégrant l’objectif de limiter les effets pour les personnes dont les données sont concernées. Le responsable de traitement peut être amené à notifier la CNIL ou informer les personnes concernées de l’incident en fonction du risque pour celles-ci.","https://www.cnil.fr/fr/securite-gerer-les-incidents-et-les-violations","2026-11-02T20:57:40.7676498",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":330,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":331,"id":332,"ref":27,"label":333,"type":179,"description":334,"relatedRisk":27,"moreDetailsUrl":335,"dateCreation":336,"dateUpdate":27,"tags":337,"attachments":338,"creatorUser":339,"workflowStepId":186,"workflowStep":27},"2026-11-03T11:39:28.500598Z",{},"e064565b-514e-4755-69b4-08df38010b92","Analyse de risques","En parallèle de la mise en conformité aux précautions élémentaires présentées dans ce guide, il est pertinent, voire obligatoire selon la criticité des traitements, de réaliser des analyses de risques relative à la protection des données. Ces analyses permettent de décider des mesures de sécurité complémentaires, adaptées au contexte, permettant de limiter l’impact sur les personnes concernées par le traitement.","https://www.cnil.fr/fr/securite-analyse-de-risques","2026-11-02T20:57:42.2940193",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},{"date":341,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":342,"id":343,"ref":27,"label":344,"type":215,"description":345,"relatedRisk":27,"moreDetailsUrl":346,"dateCreation":206,"dateUpdate":347,"tags":348,"attachments":349,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005986Z",{},"43ba60c3-6739-4e15-bc7b-bc80cad63155","Sécurité des sites web","Tout site web doit garantir son identité aux terminaux s’y connectant et la confidentialité des informations transmises. Les précautions élémentaires Sécuriser les flux d’échange de données par l’utilisation de TLS :","https://www.cnil.fr/fr/securite-securiser-les-sites-web","2026-11-02T20:57:25.0515414",[],[],{"date":351,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":352,"id":353,"ref":27,"label":354,"type":179,"description":355,"relatedRisk":27,"moreDetailsUrl":356,"dateCreation":206,"dateUpdate":357,"tags":358,"attachments":359,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005991Z",{},"5c75cb90-f2b8-43c2-8bcf-808d92f00aa6","Encadrement des développements informatiques","La protection des données à caractère personnel doit être intégrée dans le cycle de développement informatique dès les phases de conception et pour les configurations par défaut afin d’offrir aux personnes concernées une meilleure maîtrise de leurs données et de limiter les erreurs, pertes, modifications non autorisée, ou mauvais usages de celles-ci dans les applications.","https://www.cnil.fr/fr/securite-encadrer-les-developpements-informatiques","2026-11-02T20:57:27.2009232",[],[],{"date":361,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":362,"id":363,"ref":27,"label":364,"type":179,"description":365,"relatedRisk":27,"moreDetailsUrl":366,"dateCreation":206,"dateUpdate":367,"tags":368,"attachments":369,"creatorUser":27,"workflowStepId":198,"workflowStep":27},"2026-11-03T11:39:28.5005998Z",{},"47c52bcb-a6e9-487b-a958-f027b20dbd87","Encadrement de la sous-traitance","Les traitements de données réalisés par un sous-traitant pour le compte du responsable de traitement doivent bénéficier de garanties suffisantes, notamment en matière de sécurité.","https://www.cnil.fr/fr/securite-gerer-la-sous-traitance","2026-11-02T20:57:31.4211019",[],[],{"date":371,"state":175,"descriptionHtml":27,"readonly":28,"purposes":27,"customFields":372,"id":373,"ref":27,"label":374,"type":179,"description":375,"relatedRisk":27,"moreDetailsUrl":376,"dateCreation":377,"dateUpdate":27,"tags":378,"attachments":379,"creatorUser":380,"workflowStepId":186,"workflowStep":27},"2026-11-03T11:39:28.5006005Z",{},"eba73701-684c-4de3-69ba-08df38010b92","RGS : référentiel général de sécurité des autorités administratives","Appliquer le référentiel général de sécurité (RGS) de l'ANSSI : homologation de sécurité des systèmes d'information des autorités administratives (ordonnance n° 2005-1516).","https://cyber.gouv.fr/le-referentiel-general-de-securite-rgs","2026-11-02T20:57:48.3845718",[],[],{"id":25,"displayName":26,"familyName":27,"givenName":27,"email":26,"active":28,"color":29,"avatarUrl":27,"tenantId":30},[382,391,399,408],{"subjectCategory":383,"displayName":385,"id":389,"subjectCategoryId":384,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":390},{"id":384,"label":385,"ref":27,"dateCreation":386,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":387,"workflowStep":27,"dataRetentionRules":388},"8b9dd7e2-2eb8-4ef5-2689-08dac757bbf1","Employés","2022-11-15T22:21:35.8123871",97319,[],"fd688aed-0d9c-4555-e6f6-08df38010be0",[],{"subjectCategory":392,"displayName":394,"id":397,"subjectCategoryId":393,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":398},{"id":393,"label":394,"ref":27,"dateCreation":395,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":387,"workflowStep":27,"dataRetentionRules":396},"cb9a057b-fe7d-4c54-26b5-08dac757bbf1","Agents administratifs","2022-11-15T22:23:57.0023128",[],"a6a0ea61-6f24-4352-e6f7-08df38010be0",[],{"subjectCategory":400,"displayName":402,"id":406,"subjectCategoryId":401,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":407},{"id":401,"label":402,"ref":27,"dateCreation":403,"dateUpdate":27,"creatorUserId":404,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":387,"workflowStep":27,"dataRetentionRules":405},"d0b5b5f8-c58e-4172-b66b-ff3a2792ff2a","Utilisateurs des SI","2023-03-22T17:20:52.655827",31,[],"b4c69f21-5f45-49e9-e6f8-08df38010be0",[],{"subjectCategory":409,"displayName":411,"id":414,"subjectCategoryId":410,"comment":27,"dataSubjectVolumeMax":27,"readonly":28,"purposes":415},{"id":410,"label":411,"ref":27,"dateCreation":412,"dateUpdate":27,"creatorUserId":27,"creatorUser":27,"description":27,"minorConcerned":28,"workflowStepId":387,"workflowStep":27,"dataRetentionRules":413},"86a6e2c9-6168-4a82-26b0-08dac757bbf1","Intérimaires","2022-11-15T22:23:06.424583",[],"e7b61c6d-1e5d-40ae-e6f9-08df38010be0",[],"\u003Cblockquote>\u003Cp>\u003Cstrong>Modèle à adapter\u003C/strong>\u003C/p>\u003Cp>Modèle de traitement fourni à titre indicatif, à adapter à votre organisation. Les finalités, les données, les durées de conservation, les destinataires, les mesures de sécurité et l'analyse d'impact y sont des valeurs de départ, établies à partir des textes et référentiels cités ci-dessous. \u003Cstrong>Ce modèle ne constitue pas un avis juridique\u003C/strong> : faites-le valider par votre DPO ou votre conseil.\u003C/p>\u003C/blockquote>\u003Cblockquote>\u003Cp>\u003Cstrong>Point d'attention\u003C/strong> : Le référentiel CNIL de durées de conservation RH 2026 ne comporte pas de ligne propre aux annuaires (relevé sur mots-clés, extraction partielle) : durées fondées sur la présence de l'agent.\u003C/p>\u003C/blockquote>\u003Ch3>Sources\u003C/h3>\u003Cp>\u003Cem>Classement selon le guide pratique CNIL « Les durées de conservation ».\u003C/em>\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Doctrine CNIL\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/cnil/files/2023-09/referentiel_gestion_des_ressources_humaines.pdf\">CNIL, Référentiel relatif aux traitements de données personnelles mis en œuvre aux fins de gestion du personnel (2023)\u003C/a>. Finalités « gestion des annuaires internes et des organigrammes », annuaires informatiques, messagerie, intranet, sur la base de l'intérêt légitime ; données : nom, prénom, photographie (facultatif), fonction, coordonnées professionnelles ; données de connexion enregistrées pour la sécurité, à l'exclusion de tout contrôle individuel de l'activité ; outils de communication dont visioconférences, sans profilage ni biométrie, cités parmi les traitements dispensés d'AIPD pour les organismes de moins de 250 personnes.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/fr/les-regles-pour-la-gestion-du-personnel\">CNIL, Les règles pour la gestion du personnel\u003C/a>. Photographie facultative dans les annuaires internes, données conservées pendant la présence de l'agent, information des agents, traçabilité des accès, inscription au registre.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/default/files/2026-04/referentiel_durees_de_conservation_gestion_des_ressources_humaines.pdf\">CNIL, Référentiel des durées de conservation, gestion des ressources humaines (avril 2026)\u003C/a>. Ligne « Suivi et contrôle des traces, des accès et des actions des travailleurs à des fins de détection des intrusions et de réalisation des audits de sécurité » : 6 mois à 1 an à compter de la connexion (recommandation, délibération 2021-122). Le référentiel ne contient pas de ligne propre aux annuaires, aux visioconférences ni au BYOD (relevé sur mots-clés, extraction du PDF partielle).\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/fr/securite-tracer-les-operations\">CNIL, Guide de la sécurité des données personnelles : Tracer les opérations\u003C/a>. Journalisation des activités et interventions techniques, conservation glissante de 6 mois à 1 an sauf exceptions, information des utilisateurs, protection des journaux, interdiction de détourner les journaux vers une autre finalité.\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/fr/controle-de-lactivite-des-personnes-employees\">CNIL, Contrôle de l'activité des personnes employées\u003C/a>. Conditions cumulatives (proportionnalité, consultation du CSE de 50 salariés et plus, information préalable) à respecter si les journaux servent à contrôler l'activité ; surveillance constante en général excessive.\u003C/li>\u003C/ul>","Automatic","ManualOrOnDemand","Les personnes sont informées au moment de la collecte (art. 13 du RGPD) ou, en cas de collecte indirecte, au plus tard dans un délai d'un mois (art. 14).",[],[422,430,436,442,448,454],{"purposes":423,"dataRetentionRules":27,"parentId":27,"children":424,"displayName":425,"label":425,"transfers":426,"recipientType":427,"type":428,"jobTitle":27,"id":429,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Agents de l'organisme (consultation de l'annuaire et de l'intranet)",[],"InternalService","Recipient","4346a858-3385-40e8-a11f-08df38010bcb",{"purposes":431,"dataRetentionRules":27,"parentId":27,"children":432,"displayName":433,"label":433,"transfers":434,"recipientType":427,"type":428,"jobTitle":27,"id":435,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Service des ressources humaines",[],"2b19cad3-9574-44c4-a120-08df38010bcb",{"purposes":437,"dataRetentionRules":27,"parentId":27,"children":438,"displayName":439,"label":439,"transfers":440,"recipientType":427,"type":428,"jobTitle":27,"id":441,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Service informatique et administrateurs de l'intranet",[],"28a07770-d172-4886-a121-08df38010bcb",{"purposes":443,"dataRetentionRules":27,"parentId":27,"children":444,"displayName":445,"label":445,"transfers":446,"recipientType":427,"type":428,"jobTitle":27,"id":447,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Service communication interne",[],"b2a966c5-150d-4872-a122-08df38010bcb",{"purposes":449,"dataRetentionRules":27,"parentId":27,"children":450,"displayName":451,"label":451,"transfers":452,"recipientType":427,"type":428,"jobTitle":27,"id":453,"actorId":27,"actor":27,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Délégué à la protection des données (DPO)",[],"be10ba59-28e5-448b-a123-08df38010bcb",{"purposes":455,"dataRetentionRules":27,"parentId":27,"children":456,"displayName":457,"label":458,"transfers":459,"recipientType":460,"type":428,"jobTitle":27,"id":461,"actorId":462,"actor":463,"areaId":27,"area":27,"description":27,"readonly":28},[],[],"Sous-traitant à préciser","Éditeur ou hébergeur de la solution intranet",[],"Vendor","3e02384c-0e1c-4961-a124-08df38010bcb","1af96d46-eb9e-45f3-64bc-08df38010bd1",{"label":457,"id":462,"ref":27,"dateCreation":464,"dateUpdate":27,"reviewDate":27,"nextReviewDate":27,"logoUrl":27,"state":465,"actorType":466,"description":467,"countryCode":27,"readonly":28,"email":27,"phoneNumber":27,"contactName":27,"contactPosition":27,"immatriculationNumber":27,"websiteUrl":27,"address":27,"zipCode":27,"city":27,"region":27,"workflowStepId":468,"areaId":27,"source":63},"2026-11-02T20:57:51.2801474","New","Morale","Acteur générique des modèles de traitement : à remplacer par le prestataire retenu (sous-traitant au sens de l'article 28 du RGPD).",76516,[],[471,477,483,487],{"id":472,"key":32,"label":473,"description":474,"legalBasis":475,"legalBasisText":476,"legalBasisDescription":27,"readonly":28},"e27b3127-90fe-46be-10c9-08df38010b80","Gestion de l'annuaire interne et de l'organigramme","Permettre aux agents de se retrouver et de se contacter : nom, fonction, service, coordonnées professionnelles. Le référentiel CNIL de gestion du personnel (2023) retient cette finalité sur la base de l'intérêt légitime.","LegitimateInterest","Intérêts légitimes du responsable du traitement ou d'un tiers",{"id":478,"key":92,"label":479,"description":480,"legalBasis":481,"legalBasisText":482,"legalBasisDescription":27,"readonly":28},"29aee5c3-30d1-4f5e-10ca-08df38010b80","Publication du trombinoscope et des photographies","Afficher la photographie des agents dans l'annuaire ou l'intranet. La CNIL précise que la photographie est facultative : la publication repose sur l'accord libre de l'agent, retirable à tout moment.","Consent","Consentement",{"id":484,"key":33,"label":485,"description":486,"legalBasis":475,"legalBasisText":476,"legalBasisDescription":27,"readonly":28},"2e2a2ca5-5701-4b6e-10cb-08df38010b80","Diffusion d'informations et services sur l'intranet","Mettre à disposition les formulaires administratifs, actualités, espaces de discussion et d'information (finalité « intranet » du référentiel CNIL de gestion du personnel, intérêt légitime).",{"id":488,"key":122,"label":489,"description":490,"legalBasis":475,"legalBasisText":476,"legalBasisDescription":27,"readonly":28},"b1ca3cf0-26d2-4042-10cc-08df38010b80","Sécurité et bon fonctionnement de l'intranet","Authentifier les agents, gérer les droits d'accès et conserver les journaux de connexion pour la sécurité, sans contrôle individuel de l'activité (référentiel CNIL de gestion du personnel).",100,67,5]