Creating users and setting permissions

1. Regulatory Concept & Core Standards

Today we will learn to assign permissions proportionate to reporting-channel roles. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. The demonstrations in this course use a generic platform and fictional data. Field names depend on the chosen product. The aim is to understand which settings to look for and how to verify the result, keeping technical administration rights separate from access to case content.

Reading, assigning, communicating, exporting, closing and technical administration are distinct actions. Under section 21(3), access to internal reports, related documents and the register belongs only to the competent person. General need-to-know reasoning is not an exception for HR or technical staff. Individual accounts help identify actions and revoke access.

Apply the following rule: Written and oral reporting must both be available; a requested personal meeting must be arranged within a reasonable time, at most 14 days from the request. The competent person must meet section 10 requirements and act impartially under section 11; the instruction required by section 9 is recorded. Under section 19, an audio recording requires consent and the reporting person may comment on the record or transcript. Sharing, outsourcing and special AML rules need separate assessment. The Portuguese RGPC is not Czech law.

2. Practical Implementation & Procedure

Map statutory and technical roles before creating accounts. Separate content access from administration, use suitable authentication, record approval and test permitted and prohibited actions. Plan changes of role and cover. Keep sensitive content out of general service messages; a technical need does not itself authorise access to the report. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

In the demonstration, a support user can export every attachment although their role should only involve credentials. The team removes content permission and checks that the technical function still works. A negative test confirms that inappropriate access is now blocked. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why should you test an action that the user is not authorised to perform? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Because verification must confirm both necessary access and the blocking of inappropriate access. A role that enables someone to work may still grant excessive powers that are not apparent in ordinary use.

One mistake to avoid is: copying an administrator's permissions to resolve an access request quickly.

Now apply the national rule to a second decision. The team presents every integrity instrument as mandatory in every country. How should the message be revised?

Distinguish what national law actually requires, the conditions for its application to the entity and the proposed good practices. The specific rule just examined must appear in the corresponding procedure. Each duty needs a source; each management choice needs a purpose, an owner and evidence of implementation.