INQ · Dealing with Investigation Requests from Government Agencies
INQ-02 Informing Cloud Service Customers about Investigation Requests
Changed since C5:2020
Basic criterion
Specified that it is the government agency's request that is based on the applicable legal basis.
Wording in C5:2020
Basic criterion
The Cloud Service Provider informs the affected Cloud Customer(s) without undue delay, unless the applicable legal basis on which the government agency is based prohibits this or there are clear indications of illegal actions in connection with the use of the Cloud Service.
Basic criterion
The cloud service provider informs the affected cloud service customer(s) without undue delay, unless the applicable legal basis, on which the government agency's request is based, prohibits this or there are clear indications of illegal actions in connection with the use of the cloud service.
Supplementary information
This does not affect other legal or regulatory requirements that requires earlier information for cloud service customers.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that such notifications are received and assessed from a legal perspective according to their own specifications and possibilities.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources