Controlling access and sharing

1. Regulatory Concept & Core Standards

This video's topic is controlling access and sharing. By the end, you should be able to check the recipient’s task before disclosure. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. Reports may contain information about reporters, persons concerned and bystanders. The GDPR, Latvian data-processing law and special reporting rules govern processing. Distinguish lawful handling from unjustified collection, sharing and retention.

Sections 11–12 protect identities of reporters and persons concerned. GDPR security also applies. Processors need article 28 arrangements; cross-border transfers may require additional safeguards. Group affiliation removes none of these questions.

Apply the following rule: Cabinet Regulation 630 governs internal corruption and conflict-of-interest controls in public institutions and does not automatically apply to every private company. It includes risk, ethics, training and monitoring requirements. Course matrices and examples are methods unless a specific rule is identified. Portuguese RGPC is not Latvian law.

2. Practical Implementation & Procedure

Check purpose, recipient and necessary data. Assess contract, powers and transfer route. Use limited views or copies if sufficient. Document significant disclosures and test actual permissions. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An overseas group director requests the entire database. The team assesses need and provides an appropriate aggregate rather than automatic full access. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does common ownership give everyone access to all files? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Purpose, grounds, confidentiality and transfer requirements need separate assessment. Group membership is not a substitute.

One mistake to avoid is: treating the group as unrestricted data space.

Now apply the national rule to a second decision. The team calls every risk-management method compulsory for every company. How should the claim be corrected?

Distinguish Regulation 630 public-institution duties from recommended private practice. Do not confuse its risk and measure review with a Portuguese RGPC timetable. Identify each legal source and addressee; for a chosen method identify purpose, owner and operational evidence.