Processor due diligence
A recognised answer to customers' data processing questionnaires.
Implementation & guidance
ISO/IEC 27018 PII Protection in Public Cloud
Current edition: ISO/IEC 27018:2025 · extension to ISO/IEC 27001
Guidelines for public cloud providers acting as processors of personally identifiable information. It adapts ISO/IEC 27002 controls to cloud processing and adds controls based on the ISO/IEC 29100 privacy principles.
2025Third edition
ISO/IEC 27018:2025 is published
The third edition, published in August 2025, aligns the guidance with ISO/IEC 27002:2022 and the updated ISO/IEC 29100 privacy framework. Providers using the 2019 edition should review their control mapping and Statement of Applicability.
What the guidance covers
Protecting PII in the public cloud
ISO/IEC 27018 focuses on what a public cloud processor must do to protect customer personal data and support its customers' obligations.
Customer instructions
PII processed only according to the customer's instructions.
Purpose limitation
No use of customer PII for the provider's own purposes, such as marketing, without consent.
Data subject requests
Support for customers responding to access and deletion requests.
Sub-processors
Disclosure and control of sub-processors that handle PII.
Disclosure requests
Handling of legally binding requests for disclosure of PII.
Breach notification
Prompt notification to customers of incidents affecting their PII.
Return and deletion
PII returned or securely deleted at the end of the service.
Data location
Transparency about the countries where PII may be stored or processed.
Why organisations implement it
What cloud PII assurance delivers
GDPR support
Controls that support processor obligations under data protection law.
Transparent sub-processing
Clear disclosure and control of your sub-processors.
Faster sales cycles
Fewer bespoke privacy reviews for enterprise customers.
One audit programme
Assessed alongside your ISO/IEC 27001 certification.
Path to a full PIMS
A step towards ISO/IEC 27701 where customers expect it.
How we work
Path to assessed PII controls
One AEC methodology from first assessment to assessment, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 27018, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Control extension
We add the controls to your existing ISMS and Statement of Applicability.
Typically 2 to 4 monthsCombined build
We build ISO/IEC 27001 and the additional controls together.
Typically 6 to 9 monthsReadiness review
We test your controls against customer or regulator expectations before an audit.
Typically 1 to 2 months
How it is recognised
Assessed as an extension of ISO/IEC 27001
ISO/IEC 27018 is a code of practice, not a standalone certifiable management system standard. Its controls are implemented within an ISO/IEC 27001 management system, and many accredited certification bodies assess them alongside the ISO/IEC 27001 audit, referencing ISO/IEC 27018 on the certificate or in a separate statement. AEC prepares you for that assessment; the decision is the certification body's.
Built on your ISMS
Controls added to your ISO/IEC 27001 risk treatment and Statement of Applicability.
Assessment-ready
Evidence organised so the certification body can assess the additional controls in the same audit.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO/IEC 27018 by industry
IT services · SaaS and public cloud providers
Healthcare · cloud platforms holding health data
Finance · cloud platforms holding customer data
Related standards
Questions
ISO/IEC 27018 FAQ
Can we be certified to ISO/IEC 27018 alone?
No. ISO/IEC 27018 is a code of practice. Its controls are implemented within an ISO/IEC 27001 ISMS, and many certification bodies assess them during the ISO/IEC 27001 audit and reference them on the certificate or in a statement.
ISO/IEC 27018 or ISO/IEC 27701?
ISO/IEC 27018 is focused guidance for public cloud processors. ISO/IEC 27701:2025 is a full, standalone privacy management system for controllers and processors. Providers with demanding customers often implement both.
Does it apply if we are a private cloud or hosting provider?
The guidance is written for public cloud processors, but many of its controls are useful for other processing services. We confirm the right scope during the gap assessment.
Does AEC issue the certificate?
No. Certification and any reference to ISO/IEC 27018 are issued by an accredited certification body. AEC prepares your controls and evidence.
Protect customer data in your cloud
Tell us your cloud services and data processing. We reply with a proposal covering control design, implementation and assessment readiness.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.