MAINSYSTEMS 
recognise limits on using organisational assets, access and information
1. Regulatory Concept & Core Standards
Today we will learn to recognise limits on using organisational assets, access and information. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. A code turns principles into usable decisions. It does not replace law or authorise prohibited conduct. Public entities must also check ZIntPK and special rules; private policies may have a different scope.
Resources include equipment, time, funds, access and information. Use must respect professional purposes and internal rules. Technical access does not authorise every use. Work information may be confidential or personal. Convenience, curiosity and a friend's informal request do not justify consulting or sharing data.
Apply the following rule: Article 7 generally requires register data to be kept for five years after the procedure ends, unless another Act provides otherwise. Personal data and the report’s contents are then destroyed; register metadata and the article 12(5) report may be retained longer under internal rules. This does not permit indefinite retention of the entire case. Clearly unnecessary personal data must not be collected and, if collected accidentally, must be deleted without undue delay.
2. Practical Implementation & Procedure
Before using a resource, check purpose and authority. Before sharing, verify recipient and need. Use approved methods and avoid personal accounts where procedures prohibit them. Report mistakes promptly through the proper route. Contain the problem and preserve records rather than conceal it. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
A friend bidding for a contract asks for unpublished criteria. The employee sees it as a small favour, but the information could influence competition. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does personal trust justify sharing the criteria? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Use official, equal communication. Confidentiality depends on rules and purpose rather than friendship.
One mistake to avoid is: confusing technical capability with functional authorisation.
Now apply the national rule to a second decision. The system deletes every item two years after receipt. Is this suitable?
No. Two years since the breach ceased concerns protection, not retention. Article 7 generally uses five years after the procedure ends unless another Act provides otherwise. Distinguish destruction of personal data and contents from possible longer retention of permitted metadata and the report.