MAINSYSTEMS 
recognise limits on using organisational assets, access and information
1. Regulatory Concept & Core Standards
Today we will learn to recognise limits on using organisational assets, access and information. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. A code turns organisational principles into specific conduct. It must remain consistent with law and define its scope rather than replace all legislation. This course examines resources, supplier relationships and ethical questions, distinguishing advice from statutory reporting.
Resources include equipment, time, funds, access and information. Use must respect professional purposes and internal rules. Technical access does not authorise every use. Work information may be confidential or personal. Convenience, curiosity and a friend's informal request do not justify consulting or sharing data.
Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.
2. Practical Implementation & Procedure
Before using a resource, check purpose and authority. Before sharing, verify recipient and need. Use approved methods and avoid personal accounts where procedures prohibit them. Report mistakes promptly through the proper route. Contain the problem and preserve records rather than conceal it. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
An employee can read bids but wants to use the prices to assist a supplier who is a friend. The organisation assesses that use separately from the technical ability to open the file. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does the ability to download a document authorise private use? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Purpose and authorisation govern use. Technical availability does not remove confidentiality or impartiality duties.
One mistake to avoid is: confusing technical capability with functional authorisation.
Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?
No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.