MAINSYSTEMS 
organise the response to an access request or data incident
1. Regulatory Concept & Core Standards
In this video we will consolidate a skill: organise the response to an access request or data incident. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. A reporting case may contain data about the reporting person, people concerned and third parties. Data protection must accompany the whole lifecycle, from the form to archiving. This course addresses operational decisions. Legal bases and restrictions on rights require assessment of the specific processing. The law of 16 May 2023 governs the reporting channel. Proposed risk plans, codes, calendars and control tools are organisational good practice unless a separate applicable rule creates a duty. Public-service or public-procurement requirements must not be generalised to every private business.
A personal-data access request does not give unrestricted access to the whole case or the reporting person's identity. Reconcile the requester's rights, confidentiality and third-party rights, with a legal basis for restrictions. Assess unauthorised disclosure as a possible personal data breach, including risks and GDPR notification duties.
Apply the following rule: Article 23 subjects processing to data-protection law. Apply GDPR article 5(1)(e): keep identifiable data only as long as necessary for the purposes, subject to lawful exceptions. The whistleblowing law does not prescribe a universal five-year period for all channels. Under article 23(2), clearly irrelevant personal data must not be collected or must be deleted without undue delay. Document duration, purpose, starting event and review, including copies and any applicable legal or public-archive obligations.
2. Practical Implementation & Procedure
For a request, verify identity, scope and deadline, locate data and prepare a reasoned response. For an incident, contain exposure, preserve records and inform the responsible function. Under GDPR article 33, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to rights and freedoms. Explain delays. Informing individuals is governed by article 34, including high risk and its exceptions. Document the breach and the assessment. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
An attachment goes to the wrong recipient. The team restricts access where possible, requests secure deletion, documents events and assesses risk. Asking for deletion does not automatically close the incident or remove the need to assess notifications. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does asking the wrong recipient to delete the message fulfil every obligation? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. It is a containment measure. Assess exposed data, recipients, possible consequences and legally required notifications. Record the decision and its reasons.
One mistake to avoid is: equating access rights with delivery of the full report or treating every incident as identical.
Now apply the national rule to a second decision. The system deletes every case five years after receipt, regardless of the country and any pending proceedings. Is that appropriate?
No. Identify the local rule, starting event and any limits or extensions. A uniform schedule may delete records too early or retain them too long. Document the decision by category, include copies and define who reviews a suspension of deletion, rather than keeping everything indefinitely.