# INQ-03 Limiting Access to or Disclosure of Data in Investigation Requests

- Domain: INQ – Dealing with Investigation Requests from Government Agencies
- Since C5:2020: changed (formerly INQ-04)
- Web page: https://c5.patrickscheid.de/en/inq-03/

## Basic criterion

### INQ-03.01B

The cloud service provider's procedures for granting access to or disclosing cloud service customer data and cloud service derived data in the context of investigation requests from government agencies ensure that the agencies only gain access to or insight into the data that is the subject of the investigation request.

### INQ-03.02B

If no clear limitation of the cloud service customer data and cloud service derived data is possible, the cloud service provider anonymises or pseudonymises this data so that government agencies can only assign it to those cloud service customers who are subject of the investigation request.

## Additional criterion

### INQ-03.01AC (additional, complementing)

The access and activities performed by or on behalf of investigators are monitored by the cloud service provider as determined by the process described in INQ-01.

### INQ-03.02AC (additional, complementing)

Timely and appropriate remediation measures address any deviations identified during the monitoring of the activities performed by or on behalf of investigators.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Otherwise, linguistic adaptation without changes in content.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.