Search every question across sub-FAQs

Review for changed roles, purposes, services, personal data, establishment or targeting facts, contracts, subprocessors, processing countries, transfer mechanisms, incidents, law, regulator guidance, or standard editions.

A change from the 2019 to the 2025 ISO/IEC 27018 edition needs a control crosswalk. It does not change the GDPR text or remove the need to assess current legal and regulatory requirements.

Route the request to authorized legal review before anyone searches for or discloses PII. Verify the issuer, service, customer, subject or account, requested data, time period, legal authority, jurisdiction, recipient obligations, binding effect, deadline, and any available challenge or narrowing procedure. Under the 2019 guidance, reject requests that are not legally binding, consult the customer before disclosure where legally permissible, and honor contractually agreed disclosures authorized by the customer.

The contract should require customer notice within its agreed process and time periods unless notice is prohibited. The standard gives criminal-law confidentiality as an example of a possible prohibition. It does not decide whether a particular request is valid, whether it must be challenged, or which law controls.

Keep the original request, authentication steps, legal authority and analysis, customer and service match, preservation action, search criteria, any challenge or narrowing step, customer consultation or notice, legal prohibition on notice, approval, and secure transfer record.

The disclosure record should state what PII was disclosed, to whom, when, the source of the disclosure, and the source of authority. Preserve a content manifest or other verifiable description without duplicating the disclosed PII unnecessarily. Record a rejected request and its reason as well.

Authorized legal counsel determines validity, binding effect, available challenge, and notice restrictions for the specific jurisdiction. Privacy and security identify the covered PII and access path; the service owner coordinates permitted customer communication; only approved personnel extract and transfer data.

Separate legal authorization from technical execution. Use two-person review where appropriate, preserve chain-of-custody information, and prevent the requester from gaining broader system access than the validated process permits.

Review the record after every request and test the process after changes to law, jurisdiction, processing location, subprocessor access, customer contract, request channel, personnel, or extraction controls.

A tabletop exercise should test request authentication, legal escalation, customer and service identification, notice restrictions, scoped extraction, approval, secure transfer, and the disclosure log.

Start with the trigger and authorized outcome: a customer instruction, purpose expiry, retention-schedule event, contract termination, or valid legal requirement. Then define the export format and verification, timing, contract-end recovery buffer, erasure method, live systems, temporary files, logs, backups and continuity copies, subprocessor copies, archives, legal holds, and completion notice.

ISO/IEC 27018 recognizes return, transfer to another processor or controller, secure deletion or destruction, anonymization, and archival as possible dispositions. Return or transfer requires a usable export and confirmed recipient; deletion or destruction requires a defined mechanism; anonymization requires evidence that the result is no longer identifiable by reasonably likely means; archival requires a valid purpose, restricted access, and a retention end. None should be used to avoid a required return or deletion.

Keep the authorized instruction, purpose and retention trigger, inventory and system scope, export manifest and receipt, deletion jobs and logs, temporary-file cleanup result, backup expiry schedule, subprocessor confirmations, legal-hold record, verification sample, exceptions, and completion notice.

For backups that cannot be selectively erased without harming integrity, document the technical constraint, access restriction, fixed expiry, restoration procedure, and rule that returns restored data to the deletion queue before normal use. ISO/IEC 27018 does not set one universal deletion period; the policy and contract should state the applicable period.

Cloud operations performs disposition; privacy and records owners validate the inventory and retention schedule; legal confirms a legal hold or statutory retention basis; supplier management obtains subprocessor results; the service owner confirms the customer outcome and unresolved copies.

A retention exception should identify the specific data, authority, owner, access restriction, end condition, and review date. Keep excepted data isolated from ordinary processing and delete it when the exception ends.

Retest for platform, backup, storage, logging, subprocessor, contract, retention, legal-hold, or termination-workflow changes and after a failed or partial deletion.

Test the complete path: customer authorization, export if requested, deletion from active stores and temporary files, backup expiry, subprocessor completion, exception handling, verification, and customer confirmation.

Under the 2019 edition, PII processed under a contract should not be used for a purpose independent of the customer's instructions. Marketing or advertising use requires express consent, and that consent should not be a condition of receiving the service. Where the customer depends on provider information or technical measures to handle access, correction, or erasure rights, the contract should specify that support.

The contract and responsibility map should cover minimum technical and organizational measures, customer and provider responsibilities, subprocessors and backup providers, processing countries, legally binding disclosure requests, breach notice and maximum delay, return or disposal, audit evidence, and a customer contact for PII questions. The exact allocation depends on the service model: application-layer controls can sit with the provider in SaaS but with the customer or another provider in PaaS or IaaS.

Keep the purpose-by-purpose role decision, signed contract and instruction history, service and responsibility map, selected-control rationale, security procedures, access and event-log samples, subprocessor and country disclosures, breach and third-party disclosure records, and return or disposal results.

Evidence should show the control operated for the service and period under review. A policy or certificate title alone does not show whether a customer instruction was authorized, a notice reached affected customers, an incident was reported within the agreed period, or all relevant copies entered the disposal process.

The organization should assign a customer contact for PII processing under the contract. Privacy and legal teams interpret roles and binding terms; security, cloud operations, incident response, and supplier teams operate their assigned controls; the service owner keeps the customer commitment and technical implementation aligned.

No single department can approve every processor duty. Route legal exceptions to authorized counsel, security exceptions to the risk owner, and customer-facing changes to the owner authorized to change the service commitment.

Reassess when the provider introduces an own purpose, changes the service or PII handled, adds a subprocessor or country, changes a contract or selected control, or finds a responsibility gap during an incident, audit, or customer request.

Also verify the edition named by the contract, certificate, or audit criteria. A 2019 control mapping should not be presented as evidence against the 2025 edition without an explicit transition or crosswalk.

First determine whether the vendor will process customer PII. If so, identify that subcontracting is used, the subprocessor's legal name, affected service and processing, countries where it can process PII, planned effective date, and how its contract meets or exceeds the primary processor's information-security and PII-protection obligations. A vendor with no access to or processing of customer PII is outside this notice decision.

ISO/IEC 27018 does not set a universal notice period. The processor should give notice in a timely manner, while the contract determines specific or general consent, timing, the objection route, and termination or alternative-service outcomes. If public disclosure creates unacceptable security risk, the 2019 guidance allows disclosure under a non-disclosure agreement or on customer request, provided customers know the information is available.

Keep the prior and new subprocessor records, approved due diligence, signed flow-down terms, affected services, processing and countries, notice text, recipient population, send and effective dates, delivery evidence, consent basis, objections, responses, withdrawals, alternative-service or termination outcomes, and the release approval that prevented processing before the required step.

For GDPR-covered processing, Article 28 requires prior specific authorization for the named subprocessor or general written authorization. Under general authorization, the processor must inform the controller of intended additions or replacements so the controller can object; the processor must also impose the same data-protection obligations on the other processor and remains fully liable to the controller for that processor's obligations.