ISO/IEC 27018 Government Access Evidence Workflow

Send every request to a restricted legal-response channel. Preserve the original message and attachments, record receipt time and deadline, verify the sender through an independent official channel, and prevent support or operations staff from disclosing PII before approval.

Open a case with a unique identifier. Link the affected customer, service, account, jurisdiction, request type, requested PII, preservation demand, responsible lawyer, privacy and security contacts, technical custodian, and executive approver where the escalation policy requires one.

Treat suspicious or misdirected requests as security events. Preserve relevant access and communication logs without expanding access to the requested PII or alerting unauthorized recipients.

Legal reviews the issuing body's jurisdiction, the cited authority, required form and service, signature or authorization, deadline, affected entity, requested period and data, conflicts of law, and any right or duty to challenge, narrow, preserve, or seek clarification.

ISO/IEC 27018:2019 Annex A.6.1 says the provider should contractually guarantee that it will reject requests that are not legally binding. It does not define when a demand is binding in a particular jurisdiction, so record the legal basis and reviewer rather than relying on the request's label.

Check both the contract and governing law. The 2019 guidance calls for customer notification under the agreed procedure and time periods for a legally binding law-enforcement request unless notice is prohibited, and for consultation before disclosure where legally permissible.

If notice is allowed, record the recipient, content, channel, sender, time, and any customer response or authorized disclosure instruction. If notice is delayed or prohibited, record the source, scope, start date, approving reviewer, and the event or date for reconsideration without exposing protected material to unauthorized staff.

Technical staff should collect only the approved fields, accounts, and time range; use a second-person check for scope and destination; protect the export; and transfer it through the authorized channel. Keep hashes or another suitable integrity check when the procedure requires proof of what was delivered.

ISO/IEC 27018:2019 Annex A.6.2 says third-party PII disclosures should record what PII was disclosed, to whom, and when, and its guidance adds the source of the disclosure and the source of authority. Add the case decision, collector, reviewer, transfer channel, notice outcome, and deletion or return of working copies.

After response, reconcile the approval, collected dataset, transfer record, and recipient confirmation. Remove working copies under the case procedure, preserve the controlled record, review access logs, close holds when authorized, and record any error or unauthorized access under the incident process.

A customer or auditor usually needs evidence that the process operated, not unrestricted case files. Provide a redacted case summary, control walkthrough, sample metadata, or aggregate report only where law, contract, privilege, confidentiality, and other customers' rights permit.