{"id":113,"date":"2026-08-05T09:36:17","date_gmt":"2026-08-05T09:36:17","guid":{"rendered":"https:\/\/metamine.eu\/?p=113"},"modified":"2026-08-05T09:37:35","modified_gmt":"2026-08-05T09:37:35","slug":"comment-evaluer-un-sous-traitant-au-regard-de-larticle-28-du-rgpd","status":"publish","type":"post","link":"https:\/\/dataprotect-rgpd.com\/index.php\/2026\/08\/05\/comment-evaluer-un-sous-traitant-au-regard-de-larticle-28-du-rgpd\/","title":{"rendered":"Comment \u00e9valuer un sous-traitant au regard de l\u2019article 28 du RGPD ?"},"content":{"rendered":"<style>\n.title_outer{display:none!important}.page_container_inner{padding-top:0!important}.content .container_inner.default_template_holder{width:100%!important;max-width:none!important}\n.nmc-hero{min-height:520px;display:flex;align-items:center;background-position:center;background-size:cover;padding:52px 7%;box-sizing:border-box}.nmc-hero>div{max-width:920px}.nmc-hero h1{color:#fff;font-size:48px;line-height:1.12;margin:0 0 16px}.nmc-hero p{color:#fff;font-size:21px;line-height:1.5;max-width:780px}.nmc-wrap{max-width:1160px;margin:auto;padding:72px 28px}.nmc-lead{font-size:20px;line-height:1.65;max-width:920px}.nmc-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:22px;margin:32px 0}.nmc-card{border:1px solid #e2e7e9;border-radius:12px;padding:28px;background:#fff;box-shadow:0 10px 30px rgba(22,38,43,.06)}.nmc-card h3{margin-top:0}.nmc-band{background:#f2f6f7;padding:34px;border-radius:14px;margin:36px 0}.nmc-steps{display:grid;grid-template-columns:repeat(5,1fr);gap:12px;margin:26px 0}.nmc-step{background:#143b45;color:#fff;padding:20px;border-radius:10px}.nmc-btn{display:inline-block;background:#bf3038;color:#fff!important;padding:13px 22px;border-radius:5px;text-decoration:none;font-weight:600}.nmc-link{font-weight:600;color:#a92832!important}.nmc-table{width:100%;border-collapse:collapse;margin:26px 0}.nmc-table th,.nmc-table td{border-bottom:1px solid #dce3e5;padding:16px;text-align:left;vertical-align:top}.nmc-table th{background:#143b45;color:#fff}.nmc-faq details{border-bottom:1px solid #dce3e5;padding:16px 0}.nmc-faq summary{font-weight:600;cursor:pointer}.nmc-cta{background:#143b45;color:#fff;padding:38px;border-radius:14px;margin-top:44px}.nmc-cta h2,.nmc-cta p{color:#fff}\n@media(max-width:800px){.nmc-hero{min-height:390px;padding:40px 22px}.nmc-hero h1{font-size:34px}.nmc-wrap{padding:48px 20px}.nmc-grid,.nmc-steps{grid-template-columns:1fr}.nmc-table{font-size:14px}}\n<\/style><article class=\"nmc-wrap\" style=\"padding-top:78px\"><h1>Comment \u00e9valuer un sous-traitant au regard de l\u2019article 28 du RGPD ?<\/h1><p><em>Mis \u00e0 jour le 5 ao\u00fbt 2026.<\/em><\/p><p class=\"nmc-lead\">L\u2019\u00e9valuation ne s\u2019arr\u00eate pas \u00e0 la pr\u00e9sence d\u2019une clause \u00ab RGPD \u00bb. Il faut v\u00e9rifier le r\u00f4le du prestataire, les traitements r\u00e9ellement confi\u00e9s, les garanties offertes et la coh\u00e9rence entre le contrat et la pratique.<\/p><h2>\u00c9tape 1 \u2014 qualifier les r\u00f4les<\/h2><p>Un sous-traitant traite des donn\u00e9es personnelles pour le compte du responsable de traitement. Si le prestataire d\u00e9termine ses propres finalit\u00e9s et moyens essentiels pour certains traitements, la qualification doit \u00eatre r\u00e9examin\u00e9e pour ces op\u00e9rations.<\/p><h2>\u00c9tape 2 \u2014 v\u00e9rifier le contrat<\/h2><div class=\"nmc-grid\"><div class=\"nmc-card\"><h3>Le p\u00e9rim\u00e8tre<\/h3><ul><li>Objet et dur\u00e9e.<\/li><li>Nature et finalit\u00e9.<\/li><li>Types de donn\u00e9es.<\/li><li>Cat\u00e9gories de personnes.<\/li><li>Instructions document\u00e9es.<\/li><\/ul><\/div><div class=\"nmc-card\"><h3>Les garanties<\/h3><ul><li>Confidentialit\u00e9.<\/li><li>S\u00e9curit\u00e9.<\/li><li>Sous-traitants ult\u00e9rieurs.<\/li><li>Assistance au responsable.<\/li><li>Sort des donn\u00e9es en fin de contrat.<\/li><li>Information et contribution aux audits.<\/li><\/ul><\/div><\/div><h2>\u00c9tape 3 \u2014 demander des preuves proportionn\u00e9es<\/h2><p>Selon le risque : politique de s\u00e9curit\u00e9, architecture, localisation des donn\u00e9es, gestion des acc\u00e8s, sauvegardes, incidents, tests, certifications pertinentes, liste des sous-traitants ult\u00e9rieurs et m\u00e9canismes de transfert hors Espace \u00e9conomique europ\u00e9en.<\/p><h2>\u00c9tape 4 \u2014 organiser le suivi<\/h2><p>D\u00e9finissez la fr\u00e9quence de revue, les \u00e9v\u00e9nements qui d\u00e9clenchent une r\u00e9\u00e9valuation et la proc\u00e9dure de notification d\u2019un incident ou d\u2019un changement important.<\/p><div class=\"nmc-band\"><h2>Erreur fr\u00e9quente<\/h2><p>Copier l\u2019article 28 dans un contrat sans pr\u00e9ciser comment les obligations seront ex\u00e9cut\u00e9es. La CNIL rappelle que le contrat doit expliquer concr\u00e8tement la mise en \u0153uvre des obligations et le niveau de s\u00e9curit\u00e9 requis.<\/p><\/div><p><a class=\"nmc-link\" href=\"https:\/\/www.cnil.fr\/fr\/rgpd-comment-bien-identifier-son-role\" target=\"_blank\" rel=\"noopener\">Source officielle : CNIL \u2014 responsable et sous-traitant \u2192<\/a><\/p><\/article>","protected":false},"excerpt":{"rendered":"<p>Comment \u00e9valuer un sous-traitant au regard de l\u2019article 28 du RGPD ? Mis \u00e0 jour le 5 ao\u00fbt 2026. L\u2019\u00e9valuation ne s\u2019arr\u00eate pas \u00e0 la pr\u00e9sence d\u2019une clause \u00ab RGPD \u00bb. Il faut v\u00e9rifier le r\u00f4le du prestataire, les traitements r\u00e9ellement confi\u00e9s, les garanties offertes&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry","category-rgpd-protection-donnees"],"_links":{"self":[{"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/posts\/113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/comments?post=113"}],"version-history":[{"count":1,"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/posts\/113\/revisions"}],"predecessor-version":[{"id":114,"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/posts\/113\/revisions\/114"}],"wp:attachment":[{"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/media?parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/categories?post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dataprotect-rgpd.com\/index.php\/wp-json\/wp\/v2\/tags?post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}