ISO/IEC 27018 Government Access Evidence

A case record must connect the original request to the requesting body, authentication check, cited authority, jurisdiction, service of process, deadline, affected provider entity, customer, service, account, period, requested PII, preservation instruction, legal reviewer, and final decision.

Record whether the demand was unauthenticated, invalid, voluntary, binding as issued, narrowed, challenged, withdrawn, prohibited from customer notice, or satisfied. Keep the reasoning and approval at the level permitted by privilege, secrecy, and internal access rules; a request label alone does not establish legal effect.

For any disclosure, reconcile the approved scope with the collected dataset and transfer record. Record excluded, unavailable, and withheld items so reviewers do not mistake the request's scope for what was actually disclosed.

Use separate fields for preservation, collection, disclosure, and notice. An obligation to preserve does not itself authorize disclosure, and authority to disclose does not always permit customer notice.

ISO/IEC 27018:2019 Annex A.6.1 calls for contractual notice of a legally binding law-enforcement request under the agreed procedure and timing unless disclosure is prohibited. Its guidance says the provider should reject non-binding requests and consult the customer before disclosure where legally permissible.

Annex A.6.2 says third-party disclosures should record what PII was disclosed, to whom, and when; its guidance adds the source of the disclosure and source of authority. Keep those fields with the authentication, legal decision, notice outcome, approval, transfer, and closure records.

Classify and separate request content, legal analysis, customer PII, disclosure exports, transfer records, and assurance summaries. Give access only to named roles with a case need, log access, protect exports in transit and at rest, and apply the case retention and legal-hold rules.

Customer assurance should show that the control operated without exposing another customer's PII, privileged analysis, sealed material, investigative details, or data whose disclosure is prohibited. Use a redacted case summary, sampled metadata, control walkthrough, or aggregate report when authorized.

Do not retain only the request and response letter. Without authentication, legal analysis, approved scope, exact disclosed-data inventory, destination check, and transfer record, the provider cannot show what decision it made or what it sent.

Do not treat a transparency report, policy, or ISO certificate as case evidence. Do not store protected legal material in an unrestricted audit folder. Do not leave a temporary notice prohibition or legal hold open without an owner and review trigger.

Review each case after closure. Reconcile the request, decision, collection, disclosure, recipient confirmation, notice, holds, working copies, access logs, and final sign-off. Convert errors and near misses into owned corrective actions.

Review the procedure when laws, request portals, authorized recipients, provider entities, customer terms, processing locations, subprocessors, collection tooling, transfer channels, retention rules, or the cited ISO/IEC 27018 edition changes.