ISO/IEC 27018 FAQ Customer Instructions

Under ISO/IEC 27018:2019, instructions to a public-cloud PII processor can be contained in the contract and can include the service objective and time frame. An order, customer-controlled configuration, authenticated support request, or approved change can implement that contract when the authorized channel, requester, service, PII, operation, purpose, and duration are clear.

A processor may choose technical methods needed to deliver the customer's purpose without an express instruction for every implementation detail. For example, the provider may allocate processing resources to use network capacity efficiently. The method must remain consistent with the customer's general instructions, follow the relevant privacy principles when it collects or uses PII, and never introduce an independent processing purpose.

Keep the instruction, requester identity and authority, receipt and completion times, affected service and PII, operation, purpose and time frame, provider action, configuration or ticket evidence, approvals, exceptions, and downstream subprocessor effects.

Link the instruction to the applicable contract version and retain change history. Logs should show what the provider did without exposing another customer's information or retaining PII longer than the defined logging purpose requires.

The customer identifies authorized instructing roles. The provider's service owner validates operational scope; privacy and legal assess purpose, role, and legal conflicts; security reviews changes to access or controls; supplier management handles subprocessor effects.

Do not treat silence, an informal message from an unknown requester, or a provider's own product goal as a customer instruction. Resolve ambiguity before processing outside the established baseline.

Review for new purposes, features, data, users, locations, subprocessors, support access, retention, deletion, or provider use that could turn instructed processing into own-purpose processing.

Also review when the authorized customer roles, instruction channels, contract version, or responsibility split changes. Update the baseline before accepting new instructions.