ISO/IEC 27018 Subprocessor Evidence Workflow

Open the workflow before the proposed provider receives customer PII, including PII used in testing. Record its legal entity, service, role, processing purpose and operations, PII categories, access type, affected customer services, possible storage and access countries, onward providers, and planned start date.

Confirm that the customer contract permits the appointment and states whether consent is specific or general. Identify the promised notice period, objection or termination route, transfer terms, security schedule, and the ISO/IEC 27018 edition used as a review criterion.

Treat a downstream provider as a subprocessor for this workflow when it processes customer PII on the public-cloud provider's behalf while the provider performs the customer's instructions. Include backup, support, monitoring, content-delivery, and disaster-recovery providers when they meet that test. A vendor label or lack of routine human access does not decide the role; a provider with no PII access or one used only for a separate provider-controlled purpose needs its own documented classification.

Compare the supplier's controls and contract with the obligations the public-cloud provider owes its customers. Under the 2019 guidance, the subprocessor contract should specify minimum technical and organizational measures that meet the provider's information-security and PII-protection obligations and should prevent unilateral reduction by the subprocessor.

Resolve gaps before approval or record a time-limited exception with the affected obligation, compensating measure, owner, approver, expiry, and customer impact. An assurance report supports due diligence only for the entities, services, locations, controls, and period it actually covers.

The 2019 guidance says relevant customers should be told about sub-contracted PII processing before use. It calls for the fact of subcontracting, relevant names, possible processing countries, and how the subprocessor is bound to meet or exceed the provider's obligations.

Send notice through the contractually valid channel early enough for the promised objection or termination process. Preserve the notice version, recipient population, send and effective dates, delivery result, objections, responses, exceptions, withdrawals, and termination outcomes.

If public disclosure would create unacceptable security risk, the 2019 guidance permits controlled disclosure under a non-disclosure agreement or on request, while making customers aware that the information is available. Do not use that exception merely to avoid notice.

After the notice and objection window, an authorized approver checks the due-diligence report, signed terms, control mapping, country and transfer review, customer outcomes, unresolved conditions, and production safeguards. Record the approval and actual activation date.

Update the subprocessor register, data-flow map, processing inventory, customer-facing list, country list, access groups, monitoring, incident contacts, retention schedule, backup map, and exit plan. Evidence must identify the supplier and service version actually approved.

Monitor material control changes, assurance coverage, incidents, complaints, country changes, acquisitions, onward providers, and contract renewals. Reopen due diligence and customer notice before a change takes effect when the contract or applicable rule requires it.

On exit, stop new transfers, revoke accounts and keys, remove integrations, reconcile stored PII and backups, obtain return or deletion evidence, update registers and notices, and record any legally required retention with access restrictions and a disposal date.