Selecting relevant information and documents

1. Regulatory Concept & Core Standards

This video's topic is selecting relevant information and documents. By the end, you should be able to choose useful attachments without disclosing excessive information. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. A reporting person should be able to describe facts and choose a safe route. They do not need to conduct their own investigation or know the final legal classification. This course covers preparation, relevant attachments and further contact without unnecessary disclosure of personal information.

An attachment should help explain or verify the account. An indiscriminate collection of documents can expose third parties and hinder assessment. Whistleblower protection does not authorise obtaining information by means that constitute a criminal offence. You do not need to break into accounts, take documents without authority or investigate colleagues to submit a report.

Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.

2. Practical Implementation & Procedure

Select documents you accessed lawfully and explain how each relates to the facts. Preserve the original and do not change its contents to strengthen the account. If unrelated data must be redacted from a copy, clearly mark the redactions without destroying the original. Remember that filenames and metadata can reveal identity. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A person has one invoice and considers downloading a colleague’s entire mailbox to obtain more evidence. They use only lawfully available material and identify the potential additional source. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does the need for stronger evidence justify access to another person’s account? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Respect the law and access rights. Identifying a potential source allows an authorised person to assess lawful collection.

One mistake to avoid is: altering an original document or disclosing third-party data unnecessarily.

Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?

No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.