MAINSYSTEMS 
identify confidentiality defects before using real data
1. Regulatory Concept & Core Standards
In this video we will consolidate a skill: identify confidentiality defects before using real data. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. A functioning channel needs people, procedures and suitable technology. The platform supports receipt and communication, while the organisation arranges competence, confidentiality and deadlines. Exercises use fictional data and do not demonstrate features of a real UNOVOX account.
Test receipt, communication, access and deadlines. Confidentiality can fail in an email subject or desktop notification outside the file. TÕRTKS section 14 and GDPR security apply to the processing as a whole. A campaign date does not excuse a known defect.
Apply the following rule: Under section 10, acknowledge receipt within seven days of receipt, subject to express prohibition by the reporter or confidentiality-risk exceptions. Section 11 requires follow-up feedback as soon as possible and within three months of receipt. External channels may use six months in justified cases. An authority lacking competence forwards promptly, no later than the fifth working day. Acknowledgement, follow-up feedback and final-outcome feedback are separate events.
2. Practical Implementation & Procedure
Use an authorised test environment with fictional data. Test blocked access, message contents and cover. Assign repairs and record retesting. Base launch on adequate results and assessed limitations. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
A test email exposes the reporting person’s name on a shared screen. The team replaces it with a neutral reference and confirms authorised users can still find the case. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does an announced launch date justify starting with a confidentiality defect? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
The date does not remove data-protection requirements. Correct the defect and verify the result before a reasoned launch decision.
One mistake to avoid is: prioritising a campaign schedule over confidentiality requirements.
Now apply the national rule to a second decision. The platform counts 90 days from opening in every country. Does this suit Estonia?
No. Acknowledgement is generally due within seven days of receipt. Follow-up is due within three months of receipt, or six months for a justified external-channel case. Apply statutory exceptions and distinguish working from calendar days. Three months is not always 90 days and opening does not replace receipt.