When should the organisation or cloud provider be contacted?¶
Contact them when preservation, audit evidence, access control or urgent protection depends on systems and records they operate.
Define the holder and request¶
Providers may retain audit, deletion, administrator and security records absent from the user interface. Urgency increases with credible deletion, permission change, account closure or retention expiry.
Preserve tenant, account, object, URL, roles and timestamps. Specify whether the request concerns preservation, technical assistance, safeguarding, containment or lawful disclosure.
Record scope and confirmation¶
Use the correct administrator, legal, security or records route rather than general support. A provider can preserve material without disclosing it.
Record contact, channel, identifiers, wording, response, reference, preserved scope and duration. Consider operational sensitivity before contact that may alert a suspect.
Key takeaway
Approach the actual record holder with exact identifiers and a defined request, retaining written confirmation of what was - and was not - preserved.
