Chapter 3 — Authorized practice and evidence handling

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Working within authority"]
  N2["3.2 Evidence handling"]
  N3["3.3 Confidentiality in conversations"]
  N4["3.4 Recording decisions"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Working within authority"]
  N2["3.2 Evidence handling"]
  N3["3.3 Confidentiality in conversations"]
  N4["3.4 Recording decisions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Working within authority]
    |
    v
[3.2 Evidence handling]
    |
    v
[3.3 Confidentiality in conversations]
    |
    v
[3.4 Recording decisions]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) work within an authorised scope; (2) handle evidence containing personal data; (3) respect confidentiality during reviews.

3.1 Working within authority

Ms. Lin explains that a privacy practitioner often sees sensitive data and must act only within the authority given. Marta's placement agreement allows her to review processes, configuration settings and samples of records chosen with the data protection lead, using synthetic or redacted data where possible. It does not allow her to contact candidates, change system settings herself or search records out of curiosity. When a consultant asks her to look up a friend's application status, she declines and records the request.

3.2 Evidence handling

During reviews, Marta collects evidence such as screenshots of retention settings, exported counts and copies of privacy notices. She keeps evidence in a restricted folder, names files consistently with the date and topic, and records how each item was obtained. Where a screenshot would show candidate names, she asks for a synthetic example or crops the image to show only the setting. She notes that evidence is itself personal data when it includes names, so it needs its own retention period. Evidence expires after the placement.

3.3 Confidentiality in conversations

Interviews with consultants sometimes reveal concerns about colleagues, such as a manager who shares CVs through personal email. Marta records facts relevant to processes and avoids gossip or personal judgements in her notes. She discusses sensitive findings only with the data protection lead and Ms. Lin. She learns that people share problems more openly when they trust that information will be used to fix processes rather than to blame individuals, which makes fair handling a practical as well as an ethical matter.

3.4 Recording decisions

Marta keeps a decision log for her placement: what she was asked to do, what she decided and why, and who approved it. The log includes the declined lookup request, a decision to use a synthetic export for the retention review and an agreement with the data protection lead about which mailboxes she may sample. Ms. Lin reviews the log weekly. She explains that a clear record protects both the practitioner and the organisation if decisions are later questioned by management or a regulator.

Worked example

Marta works within a written placement scope, declines a lookup of a friend's application, handles evidence in a restricted folder with crops or synthetic examples, keeps conversations confidential and maintains a decision log.

Synthetic case. The scope and log are synthetic.

Errors and limits

Authority can be unclear in small firms; ask in writing before acting.

Exercises

• EX011 — Out-of-scope request. What request did Marta decline?
  Show marking criteria

  Rubric: 3 = looking up a friend's application status;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX012 — Placement limits. Name one thing Marta may not do.
  Show marking criteria

  Rubric: 3 = contact candidates, change settings, search out of curiosity;; 2 = one;; 1 = vague;; 0 = none.
• EX013 — Screenshot names. How does Marta avoid capturing names in screenshots?
  Show marking criteria

  Rubric: 3 = synthetic examples or cropping;; 2 = one;; 1 = vague;; 0 = none.
• EX014 — Trust benefit. Why does fair handling help practically?
  Show marking criteria

  Rubric: 3 = people share problems more openly;; 2 = mentions openness;; 1 = vague;; 0 = none.
• EX015 — Decision log. What does Marta's decision log record?
  Show marking criteria

  Rubric: 3 = request, decision, reason, approver;; 2 = most;; 1 = one;; 0 = none.