Controlling access and sharing

1. Regulatory Concept & Core Standards

This video's topic is controlling access and sharing. By the end, you should be able to assess the necessity and conditions of sharing case data. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. GDPR, ZVOP-2 and ZZPri operate together. Processing needs purpose, legal basis, proportionate scope and security. A platform does not remove organisational responsibility for data, contracts or actual access rights.

The contract must fit actual functions. A processor under GDPR article 28 needs suitable obligations, security and subprocessor controls. Server location alone does not reveal every access from third countries.

Apply the following rule: Entities with an internal-route duty and external authorities report previous-year statistics to KPK by 1 March; this does not mean sending every identified case. The ZIntPK integrity plan has a different group of obliged entities. Current KPK guidelines apply from 1 January 2025, with reporting on implementation by 5 June. Portugal’s RGPC is not Slovenian law. Recommended organisational measures are not automatically universal legal duties.

2. Practical Implementation & Procedure

Review services, instructions, support, exports, subprocessors and contract termination. Check possible international transfers under GDPR Chapter V. Limit a consultant’s view to the task. Document evidence rather than relying on a contract title. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A consultancy contract broadly permits access to every report, although the consultant handles one narrow technical question. Scope exceeds need. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does a signed contract alone justify full access? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Assess actual tasks, legal basis and minimum scope. The contract must support rather than remove limits.

One mistake to avoid is: assuming that a confidentiality obligation removes the need to limit shared data.

Now apply the national rule to a second decision. The team describes every prevention measure as mandatory in every organisation. How should the explanation change?

Separate the specific duty and its obliged entities from recommended practice. Integrity plans, conflicts and public procurement have their own scope. Portugal’s RGPC does not transfer automatically. For a recommended control, identify risk, owner and evidence of effectiveness.