ISO/IEC 27018:2019 Compliance – Protecting Personal Data in Public Cloud

What is ISO/IEC 27018:2019?

ISO/IEC 27018:2019 is the second edition of the international code of practice for protecting personally identifiable information (PII) in public clouds acting as PII processors, developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The first edition was published in 2014, and the second edition (a minor revision) was published in 2019.

The 2019 edition was built on ISO/IEC 27002:2013 and the privacy principles of ISO/IEC 29100. It provided cloud service providers with additional guidance for existing security controls, plus an extended set of privacy controls designed specifically for processing personal data in public cloud environments.

ISO/IEC 27018:2019 was widely adopted by major cloud providers, SaaS platforms, and data centers as a recognized way to demonstrate responsible handling of customer personal data.

What Does ISO/IEC 27018:2019 Compliance Mean?

ISO/IEC 27018:2019 compliance means that a public cloud service provider has implemented the standard's guidance and controls to protect customer personal data. In practice, this includes:

• Processing personal data only for purposes defined by the cloud customer
• Not using customer personal data for marketing or advertising without express consent
• Being transparent about where personal data is stored and processed
• Disclosing the use of sub-processors to customers
• Notifying customers of personal data breaches and legally binding disclosure requests
• Supporting customers in responding to individuals' requests
• Securely returning or deleting personal data at the end of a contract
• Maintaining records that demonstrate accountability

Since ISO 27018 is a code of practice rather than a management system standard, compliance is typically demonstrated by including its controls within the scope of an ISO 27001 Information Security Management System and having them assessed during ISO 27001 certification audits.




Structure of ISO/IEC 27018:2019

Understanding the structure of the standard is key to ISO/IEC 27018:2019 compliance:

1. Clauses 1 to 4: Scope, References, Terms, and Overview

Define the scope of the standard, normative references, cloud and privacy terminology, and how the document is structured.

2. Clauses 5 to 18: Additional Guidance for ISO/IEC 27002:2013 Controls

These clauses follow the structure of ISO/IEC 27002:2013, covering information security policies, organization of information security, human resource security, asset management, access control, cryptography, physical security, operations security, communications security, system acquisition, supplier relationships, incident management, business continuity, and compliance. For relevant controls, the standard adds PII protection guidance specific to public cloud providers.

3. Annex A: Public Cloud PII Processor Extended Control Set

Annex A contains additional privacy controls organized around the ISO/IEC 29100 privacy principles. This annex is what makes ISO 27018 distinctive.

ISO/IEC 27018:2019 Annex A: Privacy Principles and Controls

The Annex A controls of ISO/IEC 27018:2019 are grouped by privacy principle:

• Consent and Choice: Helping customers support individuals in exercising their rights over their personal data.
• Purpose Legitimacy and Specification: Processing personal data only for the customer's specified purposes, and not for the provider's own marketing or advertising without consent.
• Collection Limitation and Data Minimization: Supporting the principle of collecting and processing only the personal data needed.
• Use, Retention, and Disclosure Limitation: Managing temporary files, notifying customers of legally binding disclosure requests, and recording disclosures of personal data to third parties..
• Accuracy and Quality: Supporting customers in keeping personal data accurate.
• Openness, Transparency, and Notice: Disclosing the use of sub-processors to customers before use.
• Individual Participation and Access: Assisting customers in meeting obligations related to individuals' access, correction, and deletion requests.
• Accountability: Notifying customers of personal data breaches and maintaining policies for the return, transfer, and disposal of personal data.
• Information Security: Confidentiality obligations for staff, restrictions on hard copy materials, control of data restoration, protection of data on storage media leaving premises, encryption over public networks, secure disposal, unique user IDs, and records of authorized users.
• Privacy Compliance: Disclosing the geographical locations where personal data may be processed, and ensuring personal data is processed in line with the agreed contract.



Key ISO/IEC 27018:2019 Compliance Requirements for Cloud Providers

• Contractual Commitments Contracts with customers must clearly state that personal data will be processed only on customer instructions, and define responsibilities for security, breach notification, sub-processors, and data return or deletion.
• Transparency Obligations Cloud providers must inform customers about data storage locations, the use of sub-processors, and any changes that may affect how personal data is processed.
• Breach and Disclosure Notifications Providers must promptly notify customers of personal data breaches and, where legally permitted, of legally binding requests from authorities to disclose personal data.
• Data Lifecycle Controls Providers must manage personal data throughout its lifecycle, including temporary files, backups, restoration, and secure disposal at the end of the service.
• Security Safeguards Providers must implement strong security controls such as encryption, access control, unique user IDs, and confidentiality agreements to protect personal data.

ISO/IEC 27018:2019 and Data Protection Laws

ISO/IEC 27018:2019 helps cloud providers demonstrate alignment with the processor obligations found in many privacy laws, such as the GDPR and India's Digital Personal Data Protection (DPDP) Act. Its controls on processing on instructions, sub-processor disclosure, breach notification, and data deletion map closely to the requirements these laws place on data processors.

However, compliance with ISO/IEC 27018:2019 supports legal compliance but does not by itself guarantee it. Cloud providers should also review their specific legal obligations in each jurisdiction where they operate.

ISO 27018 focuses on the responsibilities of the cloud provider as a PII processor. This means the provider must process data only as instructed, support the controller in meeting its obligations, be transparent about how data is handled, and never use customer data for its own purposes without consent. Clear contracts between the cloud provider and customer are essential to define these roles and responsibilities




ISO/IEC 27018:2019 vs ISO/IEC 27018:2025




The new edition is titled "Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors." It also provides greater precision in the distinction between the roles of data processor and data controller, with an emphasis on monitoring of activities and accountability.

Why Choose TopCertifier for ISO/IEC 27018 Compliance?

TopCertifier is a leading ISO consulting and certification service provider that helps cloud providers maintain ISO/IEC 27018:2019 compliance and transition smoothly to ISO/IEC 27018:2025. Our experienced consultants provide end-to-end support, including compliance gap assessments, control mapping, data mapping, contract and sub-processor review, Statement of Applicability updates, documentation, internal audits, and certification audit preparation.

Whether you're maintaining your current 2019 controls or moving to the latest edition, TopCertifier delivers practical solutions tailored to your cloud services and customer obligations. We also help integrate ISO 27018 with ISO 27001, ISO 27017, and ISO 27701 for complete cloud security and privacy assurance, helping you build customer trust and stay certified with confidence