MAINSYSTEMS 
organise the response to an access request or data incident
1. Regulatory Concept & Core Standards
In this video we will consolidate a skill: organise the response to an access request or data incident. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. Case files may contain information about reporting persons, witnesses and people concerned. The Polish Act and GDPR require assessment of purpose, scope and access. The course also covers retention, rights and incidents, distinguishing registers, case documentation and records in other proceedings.
A personal-data access request does not give unrestricted access to the whole case or the reporting person's identity. Reconcile the requester's rights, confidentiality and third-party rights, with a legal basis for restrictions. Assess unauthorised disclosure as a possible personal data breach, including risks and GDPR notification duties.
Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.
2. Practical Implementation & Procedure
For a request, verify identity, scope and deadline, locate data and prepare a reasoned response. For an incident, contain exposure, preserve records and inform the responsible function. Under GDPR article 33, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to rights and freedoms. Explain delays. Informing individuals is governed by article 34, including high risk and its exceptions. Document the breach and the assessment. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
A report is sent to an unauthorised recipient. The handler seeks to limit further access and immediately informs the responsible team to assess the breach instead of hiding the mistake. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does deleting the sent message alone end all duties? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Assess consequences, risks and GDPR obligations and document the action. Incidents do not all require identical notification, but each requires proper assessment.
One mistake to avoid is: equating access rights with delivery of the full report or treating every incident as identical.
Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?
No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.