MAINSYSTEMS 
organise the response to an access request or data incident
1. Regulatory Concept & Core Standards
In this video we will consolidate a skill: organise the response to an access request or data incident. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. GDPR, ZVOP-2 and ZZPri operate together. Processing needs purpose, legal basis, proportionate scope and security. A platform does not remove organisational responsibility for data, contracts or actual access rights.
An incorrect recipient may constitute a personal-data breach and breach of reporting confidentiality. Contain effects and establish scope. Under GDPR notify the supervisory authority, normally within 72 hours of awareness, unless risk is unlikely; high risk also raises communication to affected individuals.
Apply the following rule: Article 7 generally requires register data to be kept for five years after the procedure ends, unless another Act provides otherwise. Personal data and the report’s contents are then destroyed; register metadata and the article 12(5) report may be retained longer under internal rules. This does not permit indefinite retention of the entire case. Clearly unnecessary personal data must not be collected and, if collected accidentally, must be deleted without undue delay.
2. Practical Implementation & Procedure
For a request, verify identity, scope and deadline, locate data and prepare a reasoned response. For an incident, contain exposure, preserve records and inform the responsible function. Under GDPR article 33, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to rights and freedoms. Explain delays. Informing individuals is governed by article 34, including high risk and its exceptions. Document the breach and the assessment. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
A case summary is sent to the wrong person. The team limits further use, checks access and assesses identification risk. Deleting its own sent message is insufficient. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does correcting the recipient remove the need for incident assessment? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Assess actual disclosure, risk and duties. Correction is only one containment step.
One mistake to avoid is: equating access rights with delivery of the full report or treating every incident as identical.
Now apply the national rule to a second decision. The system deletes every item two years after receipt. Is this suitable?
No. Two years since the breach ceased concerns protection, not retention. Article 7 generally uses five years after the procedure ends unless another Act provides otherwise. Distinguish destruction of personal data and contents from possible longer retention of permitted metadata and the report.