Collecting and preserving material

1. Regulatory Concept & Core Standards

Today we will learn to organise authorised collection with integrity and traceability. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. Internal fact-finding requires scope, authority and fair assessment. It does not replace police or court powers. The aim is a reasoned finding within lawful access boundaries and proportionate action.

Preservation prevents loss or improper alteration of relevant material. Collection requires lawful authority and proportionality. Organisational ownership of a device does not permit indiscriminate access to private communications. Respect rights, monitoring rules and secrecy requirements. A copy must have an identifiable origin and connection to the original.

Apply the following rule: Article 7 generally requires register data to be kept for five years after the procedure ends, unless another Act provides otherwise. Personal data and the report’s contents are then destroyed; register metadata and the article 12(5) report may be retained longer under internal rules. This does not permit indefinite retention of the entire case. Clearly unnecessary personal data must not be collected and, if collected accidentally, must be deleted without undue delay.

2. Practical Implementation & Procedure

Identify sources and obtain necessary authorisations. Record who collected what, when, where and how. Preserve originals, work with copies and restrict access. Use qualified staff for technical analysis. Integrity verification values can support traceability, but do not by themselves prove the contents true. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Three spreadsheet versions are found: simulation, draft and submitted file. Without establishing purpose, the team could wrongly attribute effects to each change. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Which version is decisive? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Establish provenance, timing and actual use. The latest date alone does not prove a file influenced the decision.

One mistake to avoid is: collecting entire mailboxes or devices indiscriminately without a basis or defined scope.

Now apply the national rule to a second decision. The system deletes every item two years after receipt. Is this suitable?

No. Two years since the breach ceased concerns protection, not retention. Article 7 generally uses five years after the procedure ends unless another Act provides otherwise. Distinguish destruction of personal data and contents from possible longer retention of permitted metadata and the report.