ISO 27018: Cloud Privacy Controls for PII
ISO 27018 gives cloud service providers and their customers a concrete set of controls for protecting personally identifiable information (PII) in public cloud environments. If your organization processes personal data in the cloud - whether as a provider or a customer - this standard fills the gaps that ISO 27002 alone does not address.
ISO/IEC 27018:2025 is a set of guidelines, not a code of practice. That was the 2019 title. ISO published the third edition on 26 August 2025 and withdrew ISO/IEC 27018:2019. The 2025 edition is aligned with ISO/IEC 27002:2022. Annex B maps the 2019 Annex A identifiers to the 2025 text. It is not a new requirements annex. The standard is still for a public-cloud provider acting as a PII processor. It is not separately certifiable. You implement it within an ISO 27001 ISMS and reference, in the Statement of Applicability, the 2025 guidelines you actually adopt.
How ISO 27018 fits into the ISO 27001 framework
The relationship between ISO 27018 and the broader ISMS standards is straightforward:
- ISO 27001 defines the management system requirements - your risk assessment, leadership commitment, internal audits, and continuous improvement cycle
- ISO 27002 provides the general information security controls (93 controls in the 2022 version)
- ISO 27018:2025 adds cloud PII guidance for a public-cloud PII processor, on top of ISO 27002. The 2019 edition’s extra set was 25 Annex A controls. Do not copy that count into a 2025 Statement of Applicability without the current text
In practice, you keep the ISO 27001 ISMS and apply the 2025 guidelines where the cloud service processes PII for a customer. The 2025 main text follows the ISO/IEC 27002:2022 themes. Annex A of the 2025 edition is informative. Do not paste the 2019 Annex A into the Statement of Applicability. Use Annex B only to see where an old identifier went.
This approach works because ISO 27018 follows the same control structure as ISO 27002. If you already have controls for access management, encryption, or incident response, ISO 27018 tells you how to apply those controls specifically to PII in cloud environments.
Processor obligations the standard is built for
The 2019 edition grouped 25 Annex A controls around the privacy principles in ISO 29100. ISO/IEC 27018:2025 Annex A is still that extended set for a public-cloud PII processor, classified under the same principles, and it is informative. The controls are written as “should”, not as ISO 27001 requirements. Do not copy the 2019 count of 25 into a Statement of Applicability without the 2025 text:
Consent and choice. The cloud provider should support the customer’s ability to manage data subject consent. This includes mechanisms for users to access, correct, and erase their PII. That supports GDPR Article 17 (right to erasure) and similar rights under other privacy regulations. The GDPR duty and the guideline are not the same sentence.
Purpose limitation. PII processed on behalf of a customer should only be used for the purposes specified in the service agreement. The guideline is that the provider does not repurpose customer data for marketing, analytics, or any secondary use without explicit authorization. This matters because cloud platforms often have the technical ability to analyze data across tenants.
Data minimization. Providers should limit PII collection to what is necessary for service delivery. Temporary files, logs, and metadata containing PII should follow defined retention periods and deletion procedures.
Disclosure and transparency. Before engaging subprocessors, the provider should disclose their identity and role to the customer. Government or law enforcement requests for PII should be communicated to the customer unless legally prohibited. That theme gained weight after the Schrems II ruling and its implications for cross-border data transfers.
Breach notification. The provider should notify the customer promptly about any unauthorized PII access, loss, or disclosure, with enough detail for the customer to meet their own reporting duties. Under GDPR Article 33(2), a processor tells the controller without undue delay. The controller’s notice to the supervisory authority, where the breach is likely to result in a risk to people, is 72 hours from when the controller becomes aware.
Data location. The provider should disclose the countries and regions where PII is stored, processed, or backed up. Customers should be able to specify geographic restrictions. That supports data residency commitments under GDPR, local data protection laws, and contracts.
Return and disposal. When a contract ends, the provider should return all PII to the customer in a usable format and securely delete copies, including backups and disaster recovery replicas.
ISO 27018 vs ISO 27701
Both standards address personal data protection, but they serve different purposes and scopes:
| Aspect | ISO 27018 | ISO 27701 |
|---|---|---|
| Scope | PII in public cloud environments only | PII across all processing activities |
| Role | Cloud provider as PII processor | Both PII controllers and processors |
| Structure | Guidelines on ISO/IEC 27002. Annex B maps 2019 Annex A identifiers to the 2025 text | Standalone PIMS since ISO/IEC 27701:2025. ISO 27001 is not required. Integration is still possible |
| Certification | Not separately certifiable - referenced within ISO 27001 SoA | Certifiable on its own since the 2025 edition |
| GDPR alignment | Processor-focused cloud guidance. Not a GDPR map | Controller and processor controls. Not a full GDPR map |
If your organization is a cloud service provider processing PII on behalf of customers, ISO 27018 gives you targeted controls for that specific relationship. If you need a broader privacy management system covering all personal data processing - whether in the cloud or on-premises - ISO 27701 is the more comprehensive choice. Many organizations implement both, using ISO 27018 for their cloud-specific obligations and ISO 27701 for the overall privacy management framework.
Implementing ISO 27018 in your ISMS
How long this takes depends on the cloud services in scope and how mature the ISMS already is. There is no fixed duration. Here is a practical approach:
1. Scope definition. Identify which cloud services process PII and which provider relationships fall under ISO 27018. Not every cloud service handles personal data - focus on the ones that do.
2. Gap analysis. Map your existing ISO 27002 controls against the ISO/IEC 27018:2025 guidelines. Encryption, access management, and logging often already help. The open questions are usually purpose limitation, subprocessor disclosure, and where the data sits. Read those in the 2025 text, not in the withdrawn 2019 annex.
3. SoA. Record the 2025 guidelines you adopt in the Statement of Applicability, with a justification for each inclusion or exclusion. Do not add the 2019 Annex A as if it were still the control set. Annex B is the map if a customer still quotes the old identifiers.
4. Policy and procedure updates. Update your information security policy, data processing agreements, and incident response procedures to reflect the ISO 27018 guidelines you adopt. Pay particular attention to breach notification timelines and subprocessor disclosure obligations.
5. Supplier assessment. If you are a cloud customer, assess your providers against ISO 27018 controls. Request their SOC 2 reports, ISO 27001 certificates, and any ISO 27018 compliance documentation. Major providers like AWS, Microsoft Azure, and Google Cloud publish ISO 27018 compliance statements.
6. Internal audit. Include the ISO 27018 controls in your next internal audit cycle. Auditors should verify that cloud PII controls are implemented, effective, and documented - not just present on paper.
When ISO 27018 matters most
ISO 27018 carries particular weight in situations where cloud PII processing is central to your business:
- Cloud SaaS providers processing customer data - enterprise clients increasingly ask for ISO 27018 compliance alongside ISO 27017 and SOC 2
- Healthcare and fintech organizations storing sensitive PII in cloud infrastructure, where regulatory scrutiny on data handling is highest
- Cross-border data processing where demonstrating adequate privacy controls supports data transfer mechanisms under GDPR or equivalent frameworks
- Government and public sector contracts that require explicit PII protection assurances from cloud providers, particularly in the EU market alongside C5 attestation
How 27kay can help
We help organizations implement ISO 27018 controls within their existing ISO 27001 ISMS - from gap analysis through audit preparation. Whether you are a cloud provider building trust with enterprise customers or a cloud customer assessing your providers’ PII protections, we can help you get the controls right without overcomplicating the process.
Need to strengthen your cloud privacy controls? Let’s talk - we will assess where you stand and build a practical plan to close the gaps.