SBS - The Best Value in QMS software

Customer Property Exclusion as it applies to Personal Data

Big Jim

Super Moderator
#1
Recently I ran into something that I thought I would ask about here.

With the added note in 7.5.4 concerning customer property applies to personal data, at least some certification bodies interpret that to mean that no organization can claim exclusion to customer property.

Has anyone else run into this? Has anyone seen anything from TC-176 or ANAB that would indicate this interpretation?

Any insight would be helpful.
 
Elsmar Forum Sponsor

Stijloor

Staff member
Super Moderator
#2
Re: Customer Property Exclusion

Recently I ran into something that I thought I would ask about here.

With the added note in 7.5.4 concerning customer property applies to personal data, at least some certification bodies interpret that to mean that no organization can claim exclusion to customer property.

Has anyone else run into this? Has anyone seen anything from TC-176 or ANAB that would indicate this interpretation?

Any insight would be helpful.
Note that Clause 7.5.4 includes this sentence:

The organization shall identify, verify, protect and safeguard customer property provided for use or incorporation into the product.
Emphasis mine.

If personal data is not used in this manner, it can be excluded.

Stijloor.
 

somashekar

Staff member
Super Moderator
#3
Recently I ran into something that I thought I would ask about here.

With the added note in 7.5.4 concerning customer property applies to personal data, at least some certification bodies interpret that to mean that no organization can claim exclusion to customer property.

Has anyone else run into this? Has anyone seen anything from TC-176 or ANAB that would indicate this interpretation?

Any insight would be helpful.
As long as one has customers, they will in one way or other deal with some customer property. Here the two things concern to protection against loss or damage to such customer property, and communication and records of communication to customers in case such an event occures, and that these property in an organization's custody is from the customer and must have been of a nature of providing some use or incorporation into the product.
Would personal data fall into this ?
One must look into the justification given for exclusion of customer property from scope of the QMS, and probe this to take a decision in the right sense. My view is that it concerns to customers tangible property that are in the organization's control and any intellectual property, personal data, or anything else if so said and declared by the customer. It is better to ask customer and get clarity about them. I would not consider every piece of drawing given by customer as customer property (in the sense of what ISO9001 says in 7.5.4) over here unless clearly declared by the customer that such drawings needs our control. It is apt to clarify these within the supplier agreements or purchasing agreements or terms and conditions.
A very typical example is the cellular phone service providers who give a cell phone number to a subscriber which is his personal data. They at that time take an undertaking within the application if one would like to have this shared to other service providers or not and accordingly manage that personal data.
 
Last edited:

Big Jim

Super Moderator
#4
Re: Customer Property Exclusion

Note that Clause 7.5.4 includes this sentence:



Emphasis mine.

If personal data is not used in this manner, it can be excluded.

Stijloor.
That's clear enough, but the example of a bank in the Auditing Practices Group's ISO/TC 176SC 2/N 524R6 seems to muddy the water.

In that example, a bank had claimed exclusion to customer property, and it was found to be inappropriate. In the Analysis and Conclusion, nothing is mentioned about the bank needing that personal information for use or incorporation into the product. I can certainly see how such information is needed for their product (banking services), but it wasn't mentioned.

This document can be downloaded from the TC 176 Web Site:

http://isotc.iso.org/livelink/livel...c=ll&objId=3541460&objAction=browse&sort=name

The link to the document can be found near the bottom under the heading of "Further Reading", item 4.

Further muddying the water is the possible reading of element 7.5.4 portion "customer property provided for use or incorporation into the product" so that the "provided for use" is not necessarily connected to "or incorporated into the product".

Any additional insight or references to how this should be understood would be greatly appreciated.
 

Big Jim

Super Moderator
#5
I was hoping for more action on this thread. My perception is that it would be an extremely narrow reading of 7.5.4 that would lead to saying that it could never be excluded.

Does anyone have any official insight on the topic?
 
J

JaneB

#6
My view is that it concerns to customers tangible property that are in the organization's control and any intellectual property, personal data, or anything else if so said and declared by the customer. It is better to ask customer and get clarity about them.
Disagree that it only relates to 'tangible' property or to IP, data etc "if so said and declared by the customer". It isn't entirely up to the customer - remember that bit about meeting requirements, and they don't always have to be explicitly stated.

For example, yes, I would expect any bank or other financial/service institution to take due care with my private data or with data confidential to my company. And I do not expect to have to explicitly state that every time I use such an organisation.

Which is also the view taken by many of the auditors from CBs here, by the way.
 

somashekar

Staff member
Super Moderator
#7
Disagree that it only relates to 'tangible' property or to IP, data etc "if so said and declared by the customer". It isn't entirely up to the customer - remember that bit about meeting requirements, and they don't always have to be explicitly stated.

For example, yes, I would expect any bank or other financial/service institution to take due care with my private data or with data confidential to my company. And I do not expect to have to explicitly state that every time I use such an organisation.

Which is also the view taken by many of the auditors from CBs here, by the way.
In an organization aligning to the systems per ISO9001, more often then not, either the customer property is ignorently excluded till they are awakened by some CB auditors, OR every piece and bit of customer information is said as included into customer property clause 7.5.4. and struggle about its management per the clause.
It would do good if the organization makes attempt and gets clarity from customer as to what would constitute his property with regard to 7.5.4 application.
As an example., If we take a drawing of a simple shaft provided by a customer and if the organization has to outsource it.,
Can it be sent out to parts manufacturers without consultation with customer if he has any objections about the drawings identity and ownership details reaching out to various parts manufacturers ?
Yes, however it is not a sound customer property handling process.
Can it be done after consultation with customer if he has any objections about the drawings identity and ownership details reaching out to various parts manufacturers ?
Yes, Here have controls as how customer desires or do not consider it as customer property per the clause 7.5.4.
Going further, across the board check with the customer which of his delivered stuff needs some management, and which of those does not, from the point of what is said in 7.5.4.
 
Thread starter Similar threads Forum Replies Date
P 7.5.10 Customer property - applies to leased/rented equipment? ISO 13485:2016 - Medical Device Quality Management Systems 10
M Customer Property - ISO 13485:2016 Clause 7.5.10 ISO 13485:2016 - Medical Device Quality Management Systems 9
lanley liao Does the customer`s trademark belong to customer-supplied property? Oil and Gas Industry Standards and Regulations 2
C What falls under the 'Customer Property' according to ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 29
S Customer Property - If at all the customer return the product ISO 13485:2016 - Medical Device Quality Management Systems 2
M Damaged Customer Property - ISO 13485:2016 Clause 7.5.10 ISO 13485:2016 - Medical Device Quality Management Systems 7
A Identification of Customer Property: Customer-Supplied Thumb Drives & Ext Hard Drives ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
M Receiving Inspection of Customer Owner Property IATF 16949 - Automotive Quality Systems Standard 5
E Owns Customer Property but No Product Integration ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
Uriel Alejandro 7.5.4 Customer Property in a Repair Station AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 7
S ISO 9001 Clause 7.5.4 - Damaged or Lost Customer Property Record ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
E ISO 9001 - 7.5.4 Customer Property - Services (e.g.: Training) on Rental Property ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 9
M Does anyone have an example Customer Property Procedure AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 11
G Customer Property Cl. 7.5.4 - Where does ISO 9001 stop and ISO 27001 start? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 33
C Identification of Customer Property - Requirements ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
P Is a Drawing (Print) Customer Intellectual Property? ISO 13485:2016 - Medical Device Quality Management Systems 16
L Customer Property Checklist example wanted ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 4
somashekar FDA cGMP on Feedback, Advisory Notice and Customer Property 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 2
C Customer Property Log example wanted ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 2
E How Do You VERIFY Customer Property? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
D Customer Property Identification Requirement - ISO 9001 Clause 7.5.4 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 77
Q Customer Property Tools - par. 7.5.4.1 - Electronic identification of a certain tool IATF 16949 - Automotive Quality Systems Standard 6
J Customer Property ISO 9001:2008 Clause 7.5.4 - Does this include E-mails? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
P Supplier's Property - Does 7.5.4 Customer property apply to supplier's property ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 15
N Customer Property Logs - Tracking customer property, specifically production tooling IATF 16949 - Automotive Quality Systems Standard 5
B What is Customer Owned Property for moulds and spare parts factory ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
T Notification of lost/damaged Customer Property - Customer Requirement ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
B Customer Property - The best way to inspect MLO and what acceptance criteria AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 1
D TS 16949 Clause 7.5.4 Customer Property, Intellectual Property requirements IATF 16949 - Automotive Quality Systems Standard 5
M 7.5.4 Customer Property - ISO 9001:2008 Intellectual Property ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 13
D Can I exclude Customer Property? ISO 9001 Clause 7.5.4 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 36
D Clarification on "Customer Property" - TS 16949 Clause 7.5.4 IATF 16949 - Automotive Quality Systems Standard 4
6 Customer Property documentation (Audit Finding) - Clause 7.5.4 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 9
H Can the documents supplied by the client categorised as customer property?? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 6
H What can be customer supplied properties (property) for the software industry? Software Quality Assurance 18
K Customer Property - Notifying Customers ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
D Purchase Order and its relationship with customer property ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
D Absence Of Any Form Of Customer Property ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
K Identifying production dies to satisfy the 7.5.4 Customer Property clause ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
H Not having a form for Customer Property Damage - ISO 9001 Clause 7.5 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 24
P Customer Supplied Property - System breakdowns at every level including sales ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
A How is Customer Property defined by TS 16949? IATF 16949 - Automotive Quality Systems Standard 6
G 7.5.4 Customer Property (Shipping Containers) IATF 16949 - Automotive Quality Systems Standard 2
K Defining Customer Property - Specifications, templates, patterns from customers ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
T Customer Property ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
Claes Gefvenberg Customer Property - 7.5.4 (intellectual property) ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
P Customer Property - 7.5.4 ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 8
D Customer Specific Requirements / Customer Requirements for Indirect Customers IATF 16949 - Automotive Quality Systems Standard 10
H Customer Specific Change in a SaaS SAMD IEC 62304 - Medical Device Software Life Cycle Processes 1
B Put on escalation by customer? is there a requirement to notify registrar? IATF 16949 - Automotive Quality Systems Standard 6

Similar threads

Top Bottom