Responding to requests and reporting duties

1. Regulatory Concept & Core Standards

In this video we will consolidate a skill: distinguish case follow-up from institutional reporting. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. Slovenia has several external reporting authorities. Choice depends on subject and competence. Distinguish reporting a breach, support for the person and statistical reporting to KPK.

An individual-case request and annual statistics have different bases. Under ZZPri obliged entities report to KPK by 1 March for the previous year. Integrity-plan implementation is reported by 5 June. Neither is the period for acknowledging an individual report.

Apply the following rule: Entities with an internal-route duty and external authorities report previous-year statistics to KPK by 1 March; this does not mean sending every identified case. The ZIntPK integrity plan has a different group of obliged entities. Current KPK guidelines apply from 1 January 2025, with reporting on implementation by 5 June. Portugal’s RGPC is not Slovenian law. Recommended organisational measures are not automatically universal legal duties.

2. Practical Implementation & Procedure

Classify requests by purpose and competence. Confirm authenticity, deadline and necessary data. Record the response and keep evidence. For statistics, define consistent categories with sufficient aggregation. For individual cases, use the designated secure method. Review official contacts and procedure versions periodically. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

The organisation receives annual-figure and individual-case requests. It prepares two appropriate responses instead of one indiscriminate export. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Should complete reports be sent for the statistical request? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Send prescribed data and handle the individual request under its own basis. Check confidentiality and time limits.

One mistake to avoid is: turning management reporting into general distribution of whistleblowing cases.

Now apply the national rule to a second decision. The team describes every prevention measure as mandatory in every organisation. How should the explanation change?

Separate the specific duty and its obliged entities from recommended practice. Integrity plans, conflicts and public procurement have their own scope. Portugal’s RGPC does not transfer automatically. For a recommended control, identify risk, owner and evidence of effectiveness.