ISO/IEC 27018 FAQ Breach Support

First classify the event. ISO/IEC 27018:2019 says an information security incident should trigger a review to determine whether a data breach involving PII occurred. Routine events such as port scans, unsuccessful logons, or denial-of-service attempts do not necessarily trigger that review when they create neither actual nor a significant probability of unauthorized PII access. If the breach trigger is met, notify the affected customer as the contract requires and supply the facts the customer needs for its own legal assessment and notifications.

The 2019 control does not extend its processor-to-customer notice to a breach caused by the customer or PII principal, or within components for which they are responsible. Record the service-model boundary, such as whether the customer controls application access in an IaaS or PaaS deployment, before relying on that exclusion. Other laws or contract terms may still require cooperation.

For every confirmed breach, record the incident description and period, consequences, reporter, recipients, resolution steps, person in charge, recovered data, and whether loss, disclosure, or alteration occurred. Add the compromised data if known and the steps taken to notify the customer or regulators.

The record should also preserve detection and notice times, affected service and responsibility boundary, changing facts, decision rationale, copies of notices, subprocessor input, containment and recovery evidence, and follow-up actions. Do not turn an estimate into a confirmed fact.

Incident response owns containment and the fact record; privacy and legal assess PII impact and legal duties; the service owner sends authenticated customer communications; cloud and supplier teams provide system and subprocessor facts.

The provider's customer notice is not the customer's decision about notifying a regulator or affected people. For GDPR-covered processing, the processor must notify the controller without undue delay after becoming aware of a personal data breach; the controller separately applies Articles 33 and 34.

Review after exercises and incidents and whenever services, responsibility splits, subprocessor response duties, customer contacts, notice channels, contract timing, or applicable law changes.

Test whether responders can identify the affected customer and service, reach the correct contact, assemble the 2019 edition's incident record, and meet the shortest applicable notification commitment.