MAINSYSTEMS 
check a request’s basis and necessary scope
1. Regulatory Concept & Core Standards
In this video we will consolidate a skill: check a request’s basis and necessary scope. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. External recipients depend on the breach field. Advice, receipt and investigation can differ. Since March 2026 KNAB is the contact point with statutory functions. Exercises send no real reports and do not make one authority every subject’s investigator.
Requests and returns may rely on specific powers. Do not assume all data are always required. Section 7(10) requires competent-authority procedure review at least every three years, not automatically a report from every company.
Apply the following rule: Cabinet Regulation 630 governs internal corruption and conflict-of-interest controls in public institutions and does not automatically apply to every private company. It includes risk, ethics, training and monitoring requirements. Course matrices and examples are methods unless a specific rule is identified. Portuguese RGPC is not Latvian law.
2. Practical Implementation & Procedure
Verify authenticity, grounds, deadline and necessary data. Involve authorised staff and send needed material securely. Record the answer and seek clarification where permitted without delaying the duty. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
A statistics request arrives. The team verifies basis and period and avoids unnecessary identifiable files. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Are institutional returns and individual reports one duty? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Recipient, grounds, data and timing may differ. Identify and document each separately.
One mistake to avoid is: extending an authority-specific duty to every employer.
Now apply the national rule to a second decision. The team calls every risk-management method compulsory for every company. How should the claim be corrected?
Distinguish Regulation 630 public-institution duties from recommended private practice. Do not confuse its risk and measure review with a Portuguese RGPC timetable. Identify each legal source and addressee; for a chosen method identify purpose, owner and operational evidence.