Testing settings and reviewing access

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: review functions and access after platform changes. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. This course presents a configuration method, not an assertion about the functions of a particular UNOVOX account. Each setting should be linked to the procedure and tested with fictional information. A technical change can affect access, confidentiality or time calculations and therefore needs verification.

Settings may become unsuitable after staffing changes, new integrations or product updates. Reviews must cover who has access, which actions they can perform and how actions are logged. Plan recovery and continuity tests with the technical team. Real cases need not be exposed to verify permissions and processes.

Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.

2. Practical Implementation & Procedure

List active accounts, compare them with current roles and remove unnecessary permissions. Test changes with fictional data and document results. Check that exports, notifications and support access remain restricted. Repeat affected tests after changes and retain the approved configuration. A review without an owner or evidence is difficult to monitor. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A former handler moves to sales but still receives alerts and can download files. Review reveals that the role’s name changed without removing its functions. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: What should be checked after unnecessary access is removed? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Actual refusal of access and cessation of notifications, plus whether earlier exposure needs assessment. A table entry does not prove the technical change worked.

One mistake to avoid is: leaving old accounts active to avoid reviewing permissions.

Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?

No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.