Selecting relevant information and documents

1. Regulatory Concept & Core Standards

This video's topic is selecting relevant information and documents. By the end, you should be able to choose useful attachments without disclosing excessive information. We will connect the information available, the criterion guiding the decision and the action that must be recorded. Follow the case and compare your answer with the proposed response. The reporting person supplies known information without a duty to conduct a personal investigation. Clarity separates facts, sources and uncertainty. Safety includes choosing a route and limiting unnecessary personal data.

An attachment should help explain or verify the account. An indiscriminate collection of documents can expose third parties and hinder assessment. Whistleblower protection does not authorise obtaining information by means that constitute a criminal offence. You do not need to break into accounts, take documents without authority or investigate colleagues to submit a report.

Apply the following rule: Article 7 generally requires register data to be kept for five years after the procedure ends, unless another Act provides otherwise. Personal data and the report’s contents are then destroyed; register metadata and the article 12(5) report may be retained longer under internal rules. This does not permit indefinite retention of the entire case. Clearly unnecessary personal data must not be collected and, if collected accidentally, must be deleted without undue delay.

2. Practical Implementation & Procedure

Select documents you accessed lawfully and explain how each relates to the facts. Preserve the original and do not change its contents to strengthen the account. If unrelated data must be redacted from a copy, clearly mark the redactions without destroying the original. Remember that filenames and metadata can reveal identity. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

A spreadsheet includes a suspicious payment and a long list of unrelated customers. The person identifies the relevant row and limits the attachment instead of disclosing everything without reason. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Should the whole database be attached just in case? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Select relevant material and identify where the original exists. Additional evidence can be obtained proportionately by authorised means.

One mistake to avoid is: altering an original document or disclosing third-party data unnecessarily.

Now apply the national rule to a second decision. The system deletes every item two years after receipt. Is this suitable?

No. Two years since the breach ceased concerns protection, not retention. Article 7 generally uses five years after the procedure ends unless another Act provides otherwise. Distinguish destruction of personal data and contents from possible longer retention of permitted metadata and the report.