Module Learning Objective

organise information and responsibilities before portal access

1. Regulatory Concept & Core Standards

Today we will learn to organise information and responsibilities before portal access. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. MENAC's RGPC Platform communicates compliance information. It differs from the platform an entity uses to receive reports of wrongdoing. This walkthrough follows the official January 2025 manual. Video production must verify the screens and instructions available at that time.

The manual distinguishes public and private entities, with or without pre-registration. Identifiers, contacts and routes differ. Public access is linked to the SIOE code and DGAEP data. Private access uses a tax identifier and the pre-registration contact. Confirm these details against current instructions without exposing credentials in recordings.

National rule: The User Manual distinguishes between access routes for public and private entities, with or without pre-registration. The required identifiers and contact details vary. Check current MENAC instructions before demonstrating access, and protect credentials during recording.

2. Practical Implementation & Procedure

Gather the entity's identity, institutional contact, responsible officer and authority to act. Check for an existing registration before requesting another. Enter through the official portal and follow the correct route. Correct source-data errors through the designated process. Do not share passwords in course documents or record real recovery messages. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A public entity receives no recovery message because the address in its source data is no longer monitored. The team checks the contact and update procedure rather than making repeated requests with different details or using another entity's account. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: What should be checked first when account recovery does not reach the expected recipient? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Verify the identifier, pre-registration and associated institutional contact using official instructions. The source data may be wrong. Avoid duplicates and never use another entity's credentials.

One mistake to avoid is: assuming portal edits automatically update DGAEP source records.

Which document, responsible person and evidence from your entity demonstrate application of this rule?

Confirm the scope and applicable source. Record the decision, who can approve it and the evidence required. Application in this lesson should support the following objective: organise information and responsibilities before portal access Distinguish the legal duty from the organisational method chosen by the entity.

National Legal Framework: Lei n.º 93/2021 & RGPC (DL 109-E/2021), transposing Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law.