INQ-03 Limiting Access to or Disclosure of Data in Investigation Requests

The cloud service provider's procedures for granting access to or disclosing cloud service customer data and cloud service derived data in the context of investigation requests from government agencies ensure that the agencies only gain access to or insight into the data that is the subject of the investigation request.

If no clear limitation of the cloud service customer data and cloud service derived data is possible, the cloud service provider anonymises or pseudonymises this data so that government agencies can only assign it to those cloud service customers who are subject of the investigation request.

The access and activities performed by or on behalf of investigators are monitored by the cloud service provider as determined by the process described in INQ-01.

Timely and appropriate remediation measures address any deviations identified during the monitoring of the activities performed by or on behalf of investigators.