ISO/IEC 27018 FAQ Processor Duties

Start with the actual duty: a public cloud provider acting as a PII processor should protect personally identifiable information (PII) for the customer under contract, using the control objectives, controls, and guidelines in ISO/IEC 27018.

For cloud privacy work, connect each control to customer instructions, processor role, subprocessor change, disclosure handling, deletion or return, and breach-support evidence. This keeps the answer useful in audits, customer reviews, incidents, supplier reviews, and management review.

The evidence should show the process operating. For this artifact, the strongest record usually includes customer instructions, DPA clauses, subprocessor notices, deletion and return records, disclosure records, access logs, and incident support evidence.

Avoid evidence that only repeats a requirement. A reviewer should be able to see the actual owner, date, system, supplier, AI system, service, incident, risk, or control sample behind the answer.

The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions.

For high-impact changes, approval should include the teams affected by the evidence: security, privacy, resilience, supplier management, AI governance, legal, risk, or business service owners as relevant.

Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, AI system, personal data flow, incident process, or customer commitment changes.

A stale record is worse than a short record. If the facts change, update the evidence and mark what changed so the next reviewer can trust the page.