Cloud Service Provider Privacy Assessment
Overview
Cloud service providers present unique privacy assessment challenges due to shared responsibility models, multi-tenancy architectures, global infrastructure, and the abstraction of physical processing locations. GDPR Article 28 obligations apply fully to cloud processing relationships, but the assessment approach must account for cloud-specific characteristics.
ISO/IEC 27018:2019 provides the international standard for protecting personally identifiable information (PII) in public clouds, supplementing ISO 27001 with cloud-specific privacy controls. The Cloud Security Alliance (CSA) STAR program provides a cloud-specific security assurance framework. SOC 2 Type II with the Privacy trust services criterion addresses personal data handling controls.
At Summit Cloud Partners, cloud providers undergo enhanced assessment incorporating these cloud-specific frameworks alongside standard vendor due diligence.
Cloud Service Models and Privacy Implications
IaaS (Infrastructure as a Service)
| Aspect |
Controller Responsibility |
Provider Responsibility |
| Data encryption at rest |
Configure and manage keys |
Provide encryption infrastructure |
| Access management (app level) |
Define and manage |
Provide IAM platform |
| Network security (app level) |
Configure security groups, firewall rules |
Provide network infrastructure |
| Physical security |
None |
Full responsibility |
| Patch management (OS) |
Controller (or managed service) |
Hypervisor and below |
| Data backup |
Configure and manage |
Provide backup infrastructure |
| Incident detection (app) |
Application-level monitoring |
Infrastructure-level monitoring |
PaaS (Platform as a Service)
| Aspect |
Controller Responsibility |
Provider Responsibility |
| Application code security |
Full responsibility |
None |
| Data handling in application |
Full responsibility |
None |
| Runtime and middleware |
Limited — configuration only |
Manage platform components |
| OS and infrastructure |
None |
Full responsibility |
| Platform security patching |
None |
Full responsibility |
| Identity management |
Configure |
Provide identity platform |
SaaS (Software as a Service)
| Aspect |
Controller Responsibility |
Provider Responsibility |
| Data entered by users |
Determine what data to process |
Process per controller instructions |
| Application security |
None (except configuration) |
Full responsibility |
| Infrastructure security |
None |
Full responsibility |
| Data portability |
Define export requirements |
Provide export functionality |
| Data deletion |
Request deletion |
Implement deletion per DPA |
| Access configuration |
Configure user roles |
Provide RBAC platform |
Assessment Framework
Domain 1: Data Residency and Sovereignty
Assessment Questions:
| # |
Question |
Expected Evidence |
| 1.1 |
In which regions/availability zones will personal data be stored at rest? |
Architecture documentation specifying data storage locations |
| 1.2 |
Can the controller restrict processing to specific geographic regions? |
Configuration documentation showing region-locking capability |
| 1.3 |
Are there any circumstances where data may be processed outside the selected region? |
Disclosure of any cross-region processing (DR, support, analytics) |
| 1.4 |
Where is metadata and telemetry data stored? |
Often stored in provider's home jurisdiction — must be disclosed |
| 1.5 |
Where do support staff access data from? |
List of countries from which support personnel may access data |
| 1.6 |
What government access or disclosure obligations apply in processing jurisdictions? |
Legal analysis of government access powers per EDPB Recommendations 01/2020 |
Domain 2: Multi-Tenancy and Data Isolation
| # |
Question |
Expected Evidence |
| 2.1 |
How is tenant data isolated from other customers' data? |
Architecture documentation — logical/physical separation details |
| 2.2 |
Are encryption keys unique per tenant? |
Key management architecture documentation |
| 2.3 |
Can one tenant's operations affect another tenant's data? |
Side-channel and cross-tenant risk assessment |
| 2.4 |
How are shared infrastructure components secured? |
Hypervisor security, shared storage controls |
| 2.5 |
What tenant isolation testing has been performed? |
Penetration test results covering cross-tenant attacks |
Domain 3: ISO 27018 Cloud Privacy Controls
ISO/IEC 27018:2019 extends ISO 27001 with cloud-specific PII protection controls:
| Control |
Requirement |
Assessment Check |
| A.1 |
PII processor consent — process only per controller instructions |
Verify contractual terms and processing boundaries |
| A.2 |
Purpose limitation — no processing beyond controller purpose |
Review processing scope documentation |
| A.3 |
Use for marketing — no use of PII for marketing without consent |
Confirm no data monetization or marketing use |
| A.4 |
Notification — notify controller of government access requests |
Verify government access notification process |
| A.5 |
Disclosure — document all disclosures of PII |
Review disclosure logging mechanism |
| A.10 |
Return, transfer, and disposal — secure data handling at termination |
Verify deletion procedures and certification |
| A.11 |
Confidentiality — binding confidentiality obligations on personnel |
Verify personnel agreements cover cloud-specific risks |
| A.12 |
Sub-contracting — notification of sub-processor engagement |
Verify sub-processor management per Art. 28(2) |
Domain 4: CSA STAR Assessment
The Cloud Security Alliance STAR (Security, Trust, Assurance, and Risk) program provides three levels:
| Level |
Description |
Assessment Method |
| Level 1: Self-Assessment |
Provider completes CSA Consensus Assessments Initiative Questionnaire (CAIQ) |
Review self-assessment for completeness and substantiation |
| Level 2: Third-Party Audit |
Independent audit against CSA Cloud Controls Matrix (CCM) |
Review audit report, scope, and findings |
| Level 3: Continuous Monitoring |
Real-time monitoring of control effectiveness |
Review continuous monitoring dashboard and alerts |
Key CCM Control Domains for Privacy:
| Domain |
Controls |
Privacy Relevance |
| DSP (Data Security & Privacy) |
DSP-01 through DSP-19 |
Data classification, retention, inventory, privacy by design |
| GRC (Governance, Risk, Compliance) |
GRC-01 through GRC-08 |
Governance framework, risk assessment, policy management |
| IAM (Identity & Access Management) |
IAM-01 through IAM-16 |
Access control, credential management, MFA |
| SEF (Security Incident Management) |
SEF-01 through SEF-08 |
Incident response, breach notification |
Domain 5: SOC 2 Type II Privacy Criterion
The AICPA Trust Services Criteria Privacy criterion evaluates:
| Criterion |
Area |
Assessment Focus |
| P1 |
Notice |
Provider discloses privacy practices to controllers |
| P2 |
Choice and consent |
Controller can configure privacy settings |
| P3 |
Collection |
Data collection limited to stated purposes |
| P4 |
Use, retention, disposal |
Processing per instructions; retention per DPA; certified deletion |
| P5 |
Access |
Controller can access and retrieve their data |
| P6 |
Disclosure to third parties |
Sub-processor disclosure and management |
| P7 |
Security for privacy |
Technical controls protecting PII |
| P8 |
Quality |
Data integrity and accuracy controls |
| P9 |
Monitoring and enforcement |
Compliance monitoring and breach response |
Domain 6: Shared Responsibility Model Mapping
Document the shared responsibility boundary for every control domain:
| Control Domain |
Controller Responsibility |
Provider Responsibility |
Gap/Risk |
| Data classification |
Classify data before upload |
Provide classification tools |
[Gap?] |
| Encryption key management |
[Depends on model] |
[Depends on model] |
[Gap?] |
| Access control (application) |
[Depends on model] |
[Depends on model] |
[Gap?] |
| Vulnerability management |
[Depends on model] |
[Depends on model] |
[Gap?] |
| Incident detection |
[Depends on model] |
[Depends on model] |
[Gap?] |
| Data backup |
[Depends on model] |
[Depends on model] |
[Gap?] |
| Compliance reporting |
[Depends on model] |
[Depends on model] |
[Gap?] |
Assessment Scoring
| Domain |
Weight |
Score (1-5) |
Weighted |
| Data residency and sovereignty |
20% |
|
|
| Multi-tenancy and isolation |
20% |
|
|
| ISO 27018 compliance |
15% |
|
|
| CSA STAR level |
15% |
|
|
| SOC 2 Privacy criterion |
15% |
|
|
| Shared responsibility clarity |
15% |
|
|
| TOTAL |
100% |
|
|
Key Regulatory References
- GDPR Article 28 — Controller-processor relationship applies fully to cloud
- GDPR Article 32 — Security measures including cloud-specific controls
- ISO/IEC 27018:2019 — Code of practice for protection of PII in public clouds
- ISO/IEC 27017:2015 — Code of practice for information security controls for cloud services
- CSA Cloud Controls Matrix (CCM) v4.0 — Cloud security control framework
- EDPB Recommendations 01/2020 — Supplementary measures for cloud transfers
- ENISA Cloud Computing Risk Assessment (2009, updated) — EU cloud risk framework
1---2name: cloud-provider-assessment3description: Cloud service provider privacy assessment framework. Covers ISO 27018 cloud privacy controls, CSA STAR certification, SOC 2 Type II evaluation, shared responsibility model mapping, data residency verification, and cloud-specific privacy risk analysis.4license: Apache-2.05---67# Cloud Service Provider Privacy Assessment89## Overview1011Cloud service providers present unique privacy assessment challenges due to shared responsibility models, multi-tenancy architectures, global infrastructure, and the abstraction of physical processing locations. GDPR Article 28 obligations apply fully to cloud processing relationships, but the assessment approach must account for cloud-specific characteristics.1213ISO/IEC 27018:2019 provides the international standard for protecting personally identifiable information (PII) in public clouds, supplementing ISO 27001 with cloud-specific privacy controls. The Cloud Security Alliance (CSA) STAR program provides a cloud-specific security assurance framework. SOC 2 Type II with the Privacy trust services criterion addresses personal data handling controls.1415At Summit Cloud Partners, cloud providers undergo enhanced assessment incorporating these cloud-specific frameworks alongside standard vendor due diligence.1617## Cloud Service Models and Privacy Implications1819### IaaS (Infrastructure as a Service)2021| Aspect | Controller Responsibility | Provider Responsibility |22|--------|--------------------------|------------------------|23| Data encryption at rest | Configure and manage keys | Provide encryption infrastructure |24| Access management (app level) | Define and manage | Provide IAM platform |25| Network security (app level) | Configure security groups, firewall rules | Provide network infrastructure |26| Physical security | None | Full responsibility |27| Patch management (OS) | Controller (or managed service) | Hypervisor and below |28| Data backup | Configure and manage | Provide backup infrastructure |29| Incident detection (app) | Application-level monitoring | Infrastructure-level monitoring |3031### PaaS (Platform as a Service)3233| Aspect | Controller Responsibility | Provider Responsibility |34|--------|--------------------------|------------------------|35| Application code security | Full responsibility | None |36| Data handling in application | Full responsibility | None |37| Runtime and middleware | Limited — configuration only | Manage platform components |38| OS and infrastructure | None | Full responsibility |39| Platform security patching | None | Full responsibility |40| Identity management | Configure | Provide identity platform |4142### SaaS (Software as a Service)4344| Aspect | Controller Responsibility | Provider Responsibility |45|--------|--------------------------|------------------------|46| Data entered by users | Determine what data to process | Process per controller instructions |47| Application security | None (except configuration) | Full responsibility |48| Infrastructure security | None | Full responsibility |49| Data portability | Define export requirements | Provide export functionality |50| Data deletion | Request deletion | Implement deletion per DPA |51| Access configuration | Configure user roles | Provide RBAC platform |5253## Assessment Framework5455### Domain 1: Data Residency and Sovereignty5657**Assessment Questions:**5859| # | Question | Expected Evidence |60|---|----------|-------------------|61| 1.1 | In which regions/availability zones will personal data be stored at rest? | Architecture documentation specifying data storage locations |62| 1.2 | Can the controller restrict processing to specific geographic regions? | Configuration documentation showing region-locking capability |63| 1.3 | Are there any circumstances where data may be processed outside the selected region? | Disclosure of any cross-region processing (DR, support, analytics) |64| 1.4 | Where is metadata and telemetry data stored? | Often stored in provider's home jurisdiction — must be disclosed |65| 1.5 | Where do support staff access data from? | List of countries from which support personnel may access data |66| 1.6 | What government access or disclosure obligations apply in processing jurisdictions? | Legal analysis of government access powers per EDPB Recommendations 01/2020 |6768### Domain 2: Multi-Tenancy and Data Isolation6970| # | Question | Expected Evidence |71|---|----------|-------------------|72| 2.1 | How is tenant data isolated from other customers' data? | Architecture documentation — logical/physical separation details |73| 2.2 | Are encryption keys unique per tenant? | Key management architecture documentation |74| 2.3 | Can one tenant's operations affect another tenant's data? | Side-channel and cross-tenant risk assessment |75| 2.4 | How are shared infrastructure components secured? | Hypervisor security, shared storage controls |76| 2.5 | What tenant isolation testing has been performed? | Penetration test results covering cross-tenant attacks |7778### Domain 3: ISO 27018 Cloud Privacy Controls7980ISO/IEC 27018:2019 extends ISO 27001 with cloud-specific PII protection controls:8182| Control | Requirement | Assessment Check |83|---------|-------------|-----------------|84| A.1 | PII processor consent — process only per controller instructions | Verify contractual terms and processing boundaries |85| A.2 | Purpose limitation — no processing beyond controller purpose | Review processing scope documentation |86| A.3 | Use for marketing — no use of PII for marketing without consent | Confirm no data monetization or marketing use |87| A.4 | Notification — notify controller of government access requests | Verify government access notification process |88| A.5 | Disclosure — document all disclosures of PII | Review disclosure logging mechanism |89| A.10 | Return, transfer, and disposal — secure data handling at termination | Verify deletion procedures and certification |90| A.11 | Confidentiality — binding confidentiality obligations on personnel | Verify personnel agreements cover cloud-specific risks |91| A.12 | Sub-contracting — notification of sub-processor engagement | Verify sub-processor management per Art. 28(2) |9293### Domain 4: CSA STAR Assessment9495The Cloud Security Alliance STAR (Security, Trust, Assurance, and Risk) program provides three levels:9697| Level | Description | Assessment Method |98|-------|-------------|-------------------|99| Level 1: Self-Assessment | Provider completes CSA Consensus Assessments Initiative Questionnaire (CAIQ) | Review self-assessment for completeness and substantiation |100| Level 2: Third-Party Audit | Independent audit against CSA Cloud Controls Matrix (CCM) | Review audit report, scope, and findings |101| Level 3: Continuous Monitoring | Real-time monitoring of control effectiveness | Review continuous monitoring dashboard and alerts |102103**Key CCM Control Domains for Privacy:**104105| Domain | Controls | Privacy Relevance |106|--------|----------|------------------|107| DSP (Data Security & Privacy) | DSP-01 through DSP-19 | Data classification, retention, inventory, privacy by design |108| GRC (Governance, Risk, Compliance) | GRC-01 through GRC-08 | Governance framework, risk assessment, policy management |109| IAM (Identity & Access Management) | IAM-01 through IAM-16 | Access control, credential management, MFA |110| SEF (Security Incident Management) | SEF-01 through SEF-08 | Incident response, breach notification |111112### Domain 5: SOC 2 Type II Privacy Criterion113114The AICPA Trust Services Criteria Privacy criterion evaluates:115116| Criterion | Area | Assessment Focus |117|-----------|------|-----------------|118| P1 | Notice | Provider discloses privacy practices to controllers |119| P2 | Choice and consent | Controller can configure privacy settings |120| P3 | Collection | Data collection limited to stated purposes |121| P4 | Use, retention, disposal | Processing per instructions; retention per DPA; certified deletion |122| P5 | Access | Controller can access and retrieve their data |123| P6 | Disclosure to third parties | Sub-processor disclosure and management |124| P7 | Security for privacy | Technical controls protecting PII |125| P8 | Quality | Data integrity and accuracy controls |126| P9 | Monitoring and enforcement | Compliance monitoring and breach response |127128### Domain 6: Shared Responsibility Model Mapping129130Document the shared responsibility boundary for every control domain:131132| Control Domain | Controller Responsibility | Provider Responsibility | Gap/Risk |133|---------------|--------------------------|------------------------|----------|134| Data classification | Classify data before upload | Provide classification tools | [Gap?] |135| Encryption key management | [Depends on model] | [Depends on model] | [Gap?] |136| Access control (application) | [Depends on model] | [Depends on model] | [Gap?] |137| Vulnerability management | [Depends on model] | [Depends on model] | [Gap?] |138| Incident detection | [Depends on model] | [Depends on model] | [Gap?] |139| Data backup | [Depends on model] | [Depends on model] | [Gap?] |140| Compliance reporting | [Depends on model] | [Depends on model] | [Gap?] |141142## Assessment Scoring143144| Domain | Weight | Score (1-5) | Weighted |145|--------|--------|-------------|----------|146| Data residency and sovereignty | 20% | | |147| Multi-tenancy and isolation | 20% | | |148| ISO 27018 compliance | 15% | | |149| CSA STAR level | 15% | | |150| SOC 2 Privacy criterion | 15% | | |151| Shared responsibility clarity | 15% | | |152| **TOTAL** | **100%** | | |153154## Key Regulatory References155156- GDPR Article 28 — Controller-processor relationship applies fully to cloud157- GDPR Article 32 — Security measures including cloud-specific controls158- ISO/IEC 27018:2019 — Code of practice for protection of PII in public clouds159- ISO/IEC 27017:2015 — Code of practice for information security controls for cloud services160- CSA Cloud Controls Matrix (CCM) v4.0 — Cloud security control framework161- EDPB Recommendations 01/2020 — Supplementary measures for cloud transfers162- ENISA Cloud Computing Risk Assessment (2009, updated) — EU cloud risk framework
mukul975