Indicators and evidence collection

1. Regulatory Concept & Core Standards

Today we will learn to build indicators that assess implementation of measures. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. Monitoring should show both implementation and whether controls reduce risk. The course covers indicators, evidence and reporting. Institutional requirements apply within the entity’s scope, while the example report structure does not create a new legal obligation.

An indicator needs a definition, source and period. A percentage without its denominator can mislead. Coverage measures how many required situations were handled. Quality assesses whether handling was adequate. Evidence can include approvals, review records, tests and training results. Collect proportionately without duplicating unnecessary personal data.

Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.

2. Practical Implementation & Procedure

Define numerator and denominator before calculating. State exclusions and unassessed situations. Choose a reliable source and update owner. Combine implementation indicators with quality checks. If sampling, explain the method and limits. Evidence must allow the calculation to be reconstructed. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Of 40 actions, 20 were checked on time. The result is 50 percent if those 40 form the full relevant population. Removing ten overdue actions to improve the percentage would misrepresent performance. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: What should accompany the 50 percent result? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

The population definition, period and method of checking timeliness. Without them, comparisons with other periods may mislead.

One mistake to avoid is: choosing a denominator that makes performance look better.

Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?

No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.