ISO/IEC 27018 FAQ Subprocessor Notice

First determine whether the vendor will process customer PII. If so, identify that subcontracting is used, the subprocessor's legal name, affected service and processing, countries where it can process PII, planned effective date, and how its contract meets or exceeds the primary processor's information-security and PII-protection obligations. A vendor with no access to or processing of customer PII is outside this notice decision.

ISO/IEC 27018 does not set a universal notice period. The processor should give notice in a timely manner, while the contract determines specific or general consent, timing, the objection route, and termination or alternative-service outcomes. If public disclosure creates unacceptable security risk, the 2019 guidance allows disclosure under a non-disclosure agreement or on customer request, provided customers know the information is available.

Keep the prior and new subprocessor records, approved due diligence, signed flow-down terms, affected services, processing and countries, notice text, recipient population, send and effective dates, delivery evidence, consent basis, objections, responses, withdrawals, alternative-service or termination outcomes, and the release approval that prevented processing before the required step.

For GDPR-covered processing, Article 28 requires prior specific authorization for the named subprocessor or general written authorization. Under general authorization, the processor must inform the controller of intended additions or replacements so the controller can object; the processor must also impose the same data-protection obligations on the other processor and remains fully liable to the controller for that processor's obligations.

Supplier management coordinates due diligence and the subcontract; privacy and security assess processing, locations, and controls; legal interprets consent and objection terms; the service owner controls customer communication and the go-live date.

An objection is not automatically a veto under ISO/IEC 27018. Follow the contract and applicable law: the outcome may be an alternative provider, a service limitation, remediation, or termination.

Notify before first use and before an intended addition or replacement when the applicable contract or law requires it. Review whether a new notice is needed when the entity, affected service, processing purpose, countries, onward providers, or safeguards change.

Keep the effective date behind the required notice and objection window. If an urgent replacement is necessary, use only an emergency path supported by the contract and applicable law, then retain the decision and customer communication.