cours donné pour infosafe en mai 2017

1. Jacques Folon Ph.D.
www.folon.com
Partner Edge Consulting
Professeur
ICHEC
Maître de conférences
Université de Liège
Professeur invité
Université Saint Louis (Bxl)
ESC Rennes School of Business
Université de Lorraine (Metz)
Comment définir la stratégie, le rôle, le WHY, la
proposition de valeur du DPO?
COMMENT IMPLÉMENTER PRATIQUEMENT LE
GDPR?

2. CONTEXTE
LE DPO EST UN
EXTRATERRESTRE
QUI DEBARQUE
DANS UN
UNIVERS
HOSTILE
2

3. 3
CONTEXTE
LE MONDE
CHANGE

13. ICT DISRUPTION

14. internet des
objets

17. today 15 billion connected objects
in 2020 50 billon….

18. http://java.sys-con.com/node/3261583

19. Quid des données
personnelles vis à vis d’IOT?

20. RIEN DANS CETTE
VIDEO N’EXISTAIT
EN 2007 !

22. 22
N'OUBLIEZ PAS LA
RESISTANCE AU
CHANGEMENT
FACE AU GDPR ET AU DPO

23. On ne change
rien !

27. reasons for
not changing

32. First the vision
then the change

33. Strategic
Vision
Implementation:
Driving Change
through the
Organization
The road to change

35. It’s about achieving “task alignment”
● Making a vision come to life with clear
strategies, initiatives and well-defined
work activities
● Grouping work activities into refined or
redefined jobs
● Putting the right people in those jobs and
giving them direction...people only change
behavior if their work changes

36. Three steps
DEFINE CORE
CAPABILITIES
SYSTEMS
& TOOLS
PHASE II
ORGANIZATIONAL DESIGN
PHASE I
STRATEGY DEVELOPMENT
JOBS AND
STRUCTURE
STRATEGY
DEVELOP BUSINESS
PROCESSES , ACTIVITIES
AND PERFORMANCE
REQUIREMENTS
TRANSITION
PHASE III
TRANSITION
ASSESS & SELECT
TALENT
Activity Definition& Sequencing Investment Allocation& Re-Allocation
INVEST IN
SYSTEMS
& TOOLS OR
HUMAN
CAPITAL?
Some level of Resistance is a natural part of change

37. STRATEGY
DEFINE CORE
CAPABILITIES
PHASE I
STRATEGY DEVELOPMENT
STRATEGY
● Strategy – What is the future state that
you want to achieve? What are the specific,
measurable strategies or objectives for the
business? Are the strategies sufficiently
defined in order to identify the work
activities associated with them?
● Core Capabilities – What organizational
capabilities will be critical for achieving
the strategy? What must the organization
be able to do well?

38. SYSTEMS
& TOOLS
PHASE II
ORGANIZATIONAL DESIGN
JOBS AND
STRUCTURE
DEVELOP BUSINESS
PROCESSES, ACTIVITIES
AND PERFORMANCE
REQUIREMENTS
ASSESS & SELECT
TALENT
Activity Definition& Sequencing Resource Allocation& Re-Allocation
INVEST IN
SYSTEMS
& TOOLS OR
HUMAN
CAPITAL?
● Develop Business Processes and Activities
– What are the processes that must be designed
and implemented in order to achieve the strategic
objectives? What metrics will be used to measure
these activities?
● Performance Requirements – How will we
know we have been successful? How will the
organization distinguish itself from competitors?
● Resource Allocation – What allocation or re-
allocation decisions will we need to make to
effectively support these activities and processes?
● Systems and Tools – What systems and tools
will be put in place to support the business
strategy and to perform critical business
activities?
● Jobs and Structure – What roles will be
necessary to carry out the critical business
activities? How will the roles be effectively and
efficiently organized?

39. TRANSITION
PHASE III
TRANSITION ● Transition – What activities are required
to transition to the future state? How will
new processes, roles, and systems be
implemented? How will people be set up
to perform successfully in their new or
changed roles? How will you deal with
resistance?
Some level of Resistance is a natural part of change

40. All Employees
Transition
Organizational
Design
Strategy
Development
Senior Leadership
Management
Everybody is needed

41. 41
LES
ORGANISATIONS
CHANGENT …
VITE

43. ICT DISRUPTION

44. Source: http://fr.slideshare.net/briansolis/official-slideshare-for-whats-the-future-of-business

49. 49
N'OUBLIEZ PAS
LA CULTURE
D’ENTREPRISE

50. LA CULTURE D’ENTREPRISE
CADRE DE LA SECURITE DE L’INFORMATION

51. IL Y A 20 ANS

52. LA CULTURE NE PEUT PLUS ETRE IDENTIQUE

56. 56
QUELLE EST LA
CULTURE
D’ENTREPRISE
CHEZ VOUS?

58. COMMENT
IMPLANTER LE
DPO EN FONCTION
DE LA CULTURE ?

59. ET DONC LES
ENJEUX DE
SECURITÉ
CHANGENT

60. Source : https://www.britestream.com/difference.html.

64. SOURCE : UWE | 5 juin 2013| @awtbe | André Blavier & Pascal Poty

65. 65
Sécurité…

66. BRING YOUR
OWN DEVICE

67. Les employés veulent utiliser leurs propres outils
personnels
ACATAWAD!

68. http://fr.slideshare.net/MicrosoftEntrepreneurs/rdi105-byod-resister-ou-embrasser?qid=d1192010-03b1-49ee-a555-ab31c4e7a1cd&v=default&b=&from_search=4

69. DIGITAL
GENERATION

70. http://sandstormdigital.com/2012/11/08/understanding-digital-natives/

71. GESTION DES
CONNAISSANCES

72. hKp://fr.slideshare.net/brainopera/seducNon-of-the-swarm

73. LA PEUR EST
PRESENTE

75. 75
STRESS AND NO BUDGET

77. RÔLE DES DPO
WHY ?

79. PROPOSITION DE
VALEUR DES
DPO ?

81. QUI SONT LES
CLIENTS DES
DPO ?

83. QUELS SONT LEURS BESOINS?
QUELS SONT LEURS PROBLEMES?

85. Les clients• DirecNon générale
• clients finaux B2C
• Organismes de contrôle
– CPVP
– autres
– pouvoirs subsistants
• Cours et tribunaux
• IT
• CISO
• MarkeNng B2C - B2B
• LogisNc (badge d'accès)
• RH
• sous traitants
• CommunicaNon
• Ombudsman
• Legal
• audit
• finances
• contact et demandes de
clients
• personnel
• sous-traitants
• Fournisseurs de données
• sources authenNques
• Syndicat

86. QUELLE EST LA PROPOSITION DE
VALEUR D’UN DPO POUR CHACUN
DE CES CLIENTS ?

92. PRÉPARER SA DÉSIGNATION
92

93. PRÉPARER SA DÉSIGNATION
93

94. PRÉPARER SA DÉSIGNATION
94

95. PRÉPARER SA DÉSIGNATION
95

96. RÉDIGER SA DESCRIPTION DE FONCTION
IDENTIFIER LES STAKEHOLDERS INTERNES
IDENTIFIER LES RESISTANCES
INFORMER EN INTERNE SUR SON ROLE
CREER UN RESEAU DE "CORRESPONDANTS"
CREER UN SOUTIEN REEL DE LA HIERARCHIE
96
PRÉPARER SA DÉSIGNATION

101. EXEMPLE DE REGISTRE EN EXCEL
MODELE DE FICHE
PROPOSÉ PAR LA CNIL
101

109. PRIVACY BY DESIGN

114. BONNE CHANCE A TOUS
114

116. QUESTIONS ?