Module Learning Objective

apply retention criteria without confusing closure with erasure

1. Regulatory Concept & Core Standards

This video focuses on how to apply retention criteria without confusing closure with erasure. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. A reporting case may contain data about the reporting person, people concerned and third parties. Data protection must accompany the whole lifecycle, from the form to archiving. This course addresses operational decisions. Legal bases and restrictions on rights require assessment of the specific processing.

The retention plan identifies records, legal rules, calculation and responsibility. Romanian article 7 requires keeping reports for five years and then destroying them, regardless of medium. Article 7(2) does not expressly give a starting event. Article 13(2)(d), for ANI and the authorities in article 3(15)(c), expressly counts five years from registration. Distinguish these rules and assess records of separate proceedings on their own legal basis.

Apply the following rule: Article 7 requires an electronic record, retention of reports for five years and subsequent destruction regardless of medium. Paragraph 2 does not expressly specify the starting event. For ANI and the authorities in article 3(15)(c), article 13(2)(d) expressly sets five years from registration. Distinguish these provisions and document the calculation. Assess records of other proceedings separately, without automatic extensions or scattered copies.

2. Practical Implementation & Procedure

Maintain the electronic reporting record required by article 7. Document the retention calculation and final destruction for each medium. Assess any separate legal obligations for documents of another procedure without treating litigation as an automatic extension of the reporting file’s period. Include exports and copies, restrict access and remove data that are not necessary under the applicable rules. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A Romanian report is approaching the five-year retention date recorded in the organisation’s procedure, while related proceedings are pending. The reviewer checks how the date was determined and which documents belong to the reporting record or a separate procedure. The team does not invent a statutory starting event or simply keep every copy indefinitely. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does reaching the originally planned date permit automatic deletion of everything? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Check the applicable rule and documented calculation, but do not override article 7’s five-year retention and destruction requirement through an automatic litigation extension. Assess any legally distinct records separately and record the basis, access and final action for each medium.

One mistake to avoid is: configuring a single deletion period without legally relevant exceptions.

Now apply the national rule to a second decision. The system deletes every case five years after receipt, regardless of the country and any pending proceedings. Is that appropriate?

No. Identify the local rule, starting event and any limits or extensions. A uniform schedule may delete records too early or retain them too long. Document the decision by category, include copies and define who reviews a suspension of deletion, rather than keeping everything indefinitely.

National Legal Framework: Legea nr. 361/2022, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law.