Responding to requests and reporting duties

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: check a request’s legal basis and necessary scope. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. The Estonian external recipient depends on the field of breach. Advice, receipt and investigation may be different roles. TÕRTKS permits direct external reporting. Exercises do not submit real reports or identify one universal authority for every subject.

A request or institutional return may rely on specific powers. Do not assume all data must always be supplied. The section 9(5) review at least every three years applies to competent authorities’ arrangements, not automatically every company report.

Apply the following rule: Section 13 requires reasonable grounds at reporting to believe that a breach has directly begun or been completed and falls within scope. Do not automatically extend this to every hypothetical future concern. KVS primarily addresses public functions and contains specific corruption-reporting provisions. Portuguese RGPC is not Estonian law. Risk matrices, internal plans and teaching methods are recommendations unless a specific legal duty is identified.

2. Practical Implementation & Procedure

Check authenticity, legal basis, deadline and required data. Involve authorised staff and send necessary material securely. Record the response and seek clarification where appropriate under the procedure. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An organisation receives a statistics request. The team verifies its basis and period and avoids adding identifiable case files unnecessarily. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Are institutional returns and individual reports the same duty? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Their recipients, grounds, data and deadlines may differ. Identify and document each separately.

One mistake to avoid is: extending one authority’s specific duty to every employer.

Now apply the national rule to a second decision. The team presents every integrity instrument as mandatory in every country. How should it correct the claim?

Separate actual Estonian duties, their scope and recommended management methods. KVS public-function duties do not automatically apply to every private company. Each duty needs a source, while each internal choice needs a purpose, owner and evidence. Portuguese RGPC does not replace Estonian law.