MAINSYSTEMS 
give each role only necessary access
1. Regulatory Concept & Core Standards
Today we will learn to give each role only necessary access. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. Configuration examples describe general methods. Verify real functions in your own environment. Each change connects permissions, procedure and Latvian rules. Fictional tests help avoid creating a new confidentiality risk.
Restricted access must be implemented in real permissions. Technical administration and substantive handling may require different rights. Do not grant an account solely for title or convenience. Check substitutes and providers too.
Apply the following rule: Cabinet Regulation 630 governs internal corruption and conflict-of-interest controls in public institutions and does not automatically apply to every private company. It includes risk, ethics, training and monitoring requirements. Course matrices and examples are methods unless a specific rule is identified. Portuguese RGPC is not Latvian law.
2. Practical Implementation & Procedure
Connect task and permission. Test allowed actions and blocked access. Cover recruitment, role change and departure. Use traceable individual access where supported. Inspect actual settings. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
An employee moves from HR to sales but keeps all-case access. The administrator removes it and checks whether data were viewed. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does a former task justify indefinite access? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Rights must fit the current task and necessity. Make timely changes and retain a necessary review record.
One mistake to avoid is: retaining permissions from former roles.
Now apply the national rule to a second decision. The team calls every risk-management method compulsory for every company. How should the claim be corrected?
Distinguish Regulation 630 public-institution duties from recommended private practice. Do not confuse its risk and measure review with a Portuguese RGPC timetable. Identify each legal source and addressee; for a chosen method identify purpose, owner and operational evidence.