MAINSYSTEMS 
find the recipient competent for the case
1. Regulatory Concept & Core Standards
Today we will learn to find the recipient competent for the case. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. External recipients depend on the breach field. Advice, receipt and investigation can differ. Since March 2026 KNAB is the contact point with statutory functions. Exercises send no real reports and do not make one authority every subject’s investigator.
Section 4 provides authorities and specified intermediaries. Internal reporting is encouraged under section 5(4), not universally required first. Assess public disclosure separately. External hosting does not create public supervisory powers.
Apply the following rule: Reports can go to competent authorities or through the contact point and specified organisations. Since 1 March 2026 KNAB is the contact point. It advises, refers, supervises compliance and examines cases where no competent institution can be determined. It does not replace every sector authority’s powers. Internal reporting is encouraged only under section 5(4); public disclosure has separate section 4 conditions.
2. Practical Implementation & Procedure
Describe field and event. Verify powers and guidance. Seek secure contact-point advice with limited information if needed. Retain checked address and date and assess other protection conditions. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
Someone fearing internal pressure seeks an external channel. Employer permission is not automatically required, but recipient and subject must fit. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: May employers always demand internal reporting first? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
Not as a universal statutory prerequisite. Competent-authority reporting is a permitted route. Other conditions and competence still matter.
One mistake to avoid is: adding prerequisites absent from law.
Now apply the national rule to a second decision. The team treats KNAB as the only investigator for every sector. What needs clarification?
KNAB has performed contact-point functions since March 2026, but the competent institution examines the particular breach. The contact point helps identify it and also examines statutory cases where competence cannot be determined. Check the current official route. A private software provider does not become a competent public authority.