ISO/IEC 27018 FAQ Processor Duties

Under the 2019 edition, PII processed under a contract should not be used for a purpose independent of the customer's instructions. Marketing or advertising use requires express consent, and that consent should not be a condition of receiving the service. Where the customer depends on provider information or technical measures to handle access, correction, or erasure rights, the contract should specify that support.

The contract and responsibility map should cover minimum technical and organizational measures, customer and provider responsibilities, subprocessors and backup providers, processing countries, legally binding disclosure requests, breach notice and maximum delay, return or disposal, audit evidence, and a customer contact for PII questions. The exact allocation depends on the service model: application-layer controls can sit with the provider in SaaS but with the customer or another provider in PaaS or IaaS.

Keep the purpose-by-purpose role decision, signed contract and instruction history, service and responsibility map, selected-control rationale, security procedures, access and event-log samples, subprocessor and country disclosures, breach and third-party disclosure records, and return or disposal results.

Evidence should show the control operated for the service and period under review. A policy or certificate title alone does not show whether a customer instruction was authorized, a notice reached affected customers, an incident was reported within the agreed period, or all relevant copies entered the disposal process.

The organization should assign a customer contact for PII processing under the contract. Privacy and legal teams interpret roles and binding terms; security, cloud operations, incident response, and supplier teams operate their assigned controls; the service owner keeps the customer commitment and technical implementation aligned.

No single department can approve every processor duty. Route legal exceptions to authorized counsel, security exceptions to the risk owner, and customer-facing changes to the owner authorized to change the service commitment.

Reassess when the provider introduces an own purpose, changes the service or PII handled, adds a subprocessor or country, changes a contract or selected control, or finds a responsibility gap during an incident, audit, or customer request.

Also verify the edition named by the contract, certificate, or audit criteria. A 2019 control mapping should not be presented as evidence against the 2025 edition without an explicit transition or crosswalk.