Collecting and preserving material

1. Regulatory Concept & Core Standards

Today we will learn to organise authorised collection with integrity and traceability. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. An internal investigation seeks to establish facts methodically while respecting the rights involved. It does not replace the authorities or grant police powers to the team. These organisational techniques are good practice and must be adapted to applicable employment, disciplinary, criminal and data protection rules. Under section 27, provide the person concerned a fair opportunity to state their position and evidence, including through counsel; delay of initial information is exceptional and justified.

Origin and version history support evidence assessment. Employee monitoring must also satisfy Labour Code sections 9 and 11/A, including necessity, proportionality and prior written information. An employer-owned device does not authorise reading every private item. Limit collection to the authorised purpose.

Apply the following rule: Section 26 limits internal-system personal data to what is indispensable for investigation and remediation. Data outside that scope must be deleted without delay. The five years in section 12 concerns the Commissioner’s protected electronic public-interest system, running from completion of the last investigative act or measure, followed by deletion. It is not a universal employer internal-system retention period. Document the specific purpose, lawful basis and review event.

2. Practical Implementation & Procedure

Identify sources and obtain necessary authorisations. Record who collected what, when, where and how. Preserve originals, work with copies and restrict access. Use qualified staff for technical analysis. Integrity verification values can support traceability, but do not by themselves prove the contents true. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Three versions of an assessment spreadsheet exist, including one exported after the report. The team preserves the versions and change logs instead of selecting only the apparently most complete file. Their sequence may explain when and by whom criteria changed. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: What is the risk of working only with the latest document version? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

The history needed to understand changes may be lost. Preserve relevant versions and their origins, and link them. This allows differences to be assessed without assuming the latest version represents the entire process.

One mistake to avoid is: collecting entire mailboxes or devices indiscriminately without a basis or defined scope.

Now apply the national rule to a second decision. The system deletes every case five years after receipt, regardless of the country and any pending proceedings. Is that appropriate?

No. Identify the local rule, starting event and any limits or extensions. A uniform schedule may delete records too early or retain them too long. Document the decision by category, include copies and define who reviews a suspension of deletion, rather than keeping everything indefinitely.