Creating users and setting permissions

1. Regulatory Concept & Core Standards

Today we will learn to assign permissions proportionate to reporting-channel roles. Throughout the video, consider the difference between knowing a rule and applying it to a decision. We will work through an example, identify a possible failure and develop a response that can be used at work. The demonstrations in this course use a generic platform and fictional data. Field names depend on the chosen product. The aim is to understand which settings to look for and how to verify the result, keeping technical administration rights separate from access to case content.

A permission must meet a work-related need. Reading, assigning, communicating, exporting, closing and administering are different actions. Least privilege means granting only the access required. Individual accounts identify who acted. Shared accounts weaken accountability and complicate revocation when someone changes roles.

Apply the following rule: At least one reporting method must be continuously accessible. Under section 10(2), an external person may receive and acknowledge reports; examination may be outsourced under the stated conditions for a non-public employer with fewer than 250 employees. An internal responsible person remains necessary. A section 12 application to suspend an employment act has a 15-day deadline from learning of it; this remedy differs from formal protected status. Portuguese RGPC is not Slovak law. Prevention methods are recommendations unless a specific applicable duty is identified.

2. Practical Implementation & Procedure

Define roles before creating users. Map each role to permitted actions and accessible cases. Enable suitable authentication where available, and test both a permitted and a prohibited action. Document approvals. Plan periodic reviews, temporary cover and revocation. Technical support should not retain permanent content access without a justified need. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

In the demonstration, a support user can export every attachment although their role should only involve credentials. The team removes content permission and checks that the technical function still works. A negative test confirms that inappropriate access is now blocked. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why should you test an action that the user is not authorised to perform? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Because verification must confirm both necessary access and the blocking of inappropriate access. A role that enables someone to work may still grant excessive powers that are not apparent in ordinary use.

One mistake to avoid is: copying an administrator's permissions to resolve an access request quickly.

Now apply the national rule to a second decision. The team presents all preventive tools as mandatory for every organisation. How should it revise the explanation?

Separate Slovak legal duties, their scope and recommended practice. Public procurement and the departmental anti-corruption methodology have their own applicability. Portuguese RGPC is not automatically transferred. For recommendations state the risk, owner and effectiveness evidence; for a claimed duty identify the applicable legal basis.