Collecting and preserving material

1. Regulatory Concept & Core Standards

Today we will learn to organise authorised collection with integrity and traceability. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. An internal review establishes facts within lawful powers. It does not replace law enforcement or give the employer unlimited investigative authority. This course covers planning, preservation, interviews, conflicting information and conclusions proportionate to the evidence.

Preservation prevents loss or improper alteration of relevant material. Collection requires lawful authority and proportionality. Organisational ownership of a device does not permit indiscriminate access to private communications. Respect rights, monitoring rules and secrecy requirements. A copy must have an identifiable origin and connection to the original.

Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.

2. Practical Implementation & Procedure

Identify sources and obtain necessary authorisations. Record who collected what, when, where and how. Preserve originals, work with copies and restrict access. Use qualified staff for technical analysis. Integrity verification values can support traceability, but do not by themselves prove the contents true. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A spreadsheet has been forwarded and altered several times. The team preserves the relevant versions and establishes their origins instead of treating the latest file as the original. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why can version history change the assessment? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

It shows what existed at a given time and whether a later change explains a discrepancy. Without that context, conclusions can be mistaken.

One mistake to avoid is: collecting entire mailboxes or devices indiscriminately without a basis or defined scope.

Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?

No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.