Selecting relevant information and documents

1. Regulatory Concept & Core Standards

This video's topic is selecting relevant information and documents. By the end, you should be able to select relevant material without exceeding lawful access. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. A reporting person need not establish a breach conclusively. Describe facts learned through work honestly and use an appropriate route. These examples cover preparation, secure submission and follow-up. Protection depends on Estonian statutory conditions.

Relevant material helps explain the report. More files are not always better, and unrelated personal information increases risk. Section 17 does not authorise obtaining information through an offence. Provenance and unchanged contents may matter.

Apply the following rule: Section 10(3) prescribes three years and refers to feedback under section 11(4), while final-outcome feedback now appears in section 11(6). Do not conceal the cross-reference issue or automatically replace it with receipt. Document the legally confirmed starting event before automating deletion. Government Regulation 12 of 2 February 2026 covers the report, collected material and media, review of oral-report minutes and destruction under a procedure approved by the organisation’s head.

2. Practical Implementation & Procedure

Provide relevant material that may lawfully be used and identify its source. Do not use another person’s account or modify the original. Describe the existence and location of material that an authorised investigator may need. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A worker can access an invoice but not a colleague’s mailbox. They provide the relevant invoice and describe a relevant message without requesting the colleague’s password or copying the mailbox. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Should someone use another person’s password to obtain evidence? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Reporting protection is not a general licence for prohibited access. Describe known material and allow authorised people to collect it lawfully.

One mistake to avoid is: copying an entire database to support one allegation.

Now apply the national rule to a second decision. The system deletes every case five years after receipt. Is that correct for Estonia?

No. The three-year period in section 10(3) references feedback rather than automatically receipt. The current cross-reference issue needs a documented legal resolution. Apply Regulation 12 and privacy rules to related material and copies. Do not keep everything indefinitely without grounds.