ISO 27018 PII in Public Cloud Guide

ISO 27018 (formally ISO/IEC 27018) is the code of practice for cloud providers that process personal data on behalf of their customers. Where ISO/IEC 27017 covers cloud security in general, ISO/IEC 27018 focuses on privacy: the provider processes customers' personal data only as instructed, does not use it for its own advertising or other purposes, is open about where data goes and who else processes it, tells customers about breaches and legally binding requests for their data, and returns or deletes data properly.

These are the same obligations privacy laws such as the GDPR place on processors, which is why SaaS and cloud providers use ISO/IEC 27018 to give business customers recognised evidence. The third edition, published in 2025, aligns the standard with the 2022 control set and adds expanded implementation guidance. This guide explains what it covers, how SaaS companies implement it, how it is audited, and how it relates to ISO/IEC 27701, ISO/IEC 27017 and privacy law.

What is ISO/IEC 27018?

ISO/IEC 27018 establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles of ISO/IEC 29100, for the public cloud computing environment. It applies to public cloud service providers that act as PII processors, meaning they process personal data on behalf of and according to the instructions of their cloud service customers, who are the PII controllers.

It provides:

PII protection guidance for relevant ISO/IEC 27002 security controls, adapted to public cloud processing.
An extended control set based on the privacy principles of ISO/IEC 29100: consent and choice, purpose legitimacy, collection limitation, data minimisation, use, retention and disclosure limitation, accuracy, openness, individual participation, accountability, information security and privacy compliance.
In the 2025 edition, expanded implementation guidance in an additional annex.

History and why ISO/IEC 27018 was introduced

The first edition was published in 2014, when organisations, especially in Europe, were cautious about putting personal data in public clouds because they could not see how providers handled it. Customers worried that providers might mine data for advertising, hand it to authorities without notice, or keep it after contracts ended. ISO/IEC 27018 set out commitments that a provider could make and have audited. The second edition (2019) updated the standard, and the third edition (2025) aligned it with ISO/IEC 27002:2022 and added guidance, including on managing responsibilities when data is processed by sub-processors.

Its purpose is to help public cloud providers comply with applicable obligations when acting as processors, to make their practices transparent, and to help customers meet their own obligations as controllers.

Who uses ISO/IEC 27018?

Public cloud infrastructure and platform providers.
SaaS providers whose customers upload or generate personal data, such as HR, CRM, marketing, learning, health and support platforms.
Managed service providers operating multi-tenant cloud services.
Business customers, who use it as a benchmark when selecting cloud processors.

It is global and voluntary. It is particularly valued by customers subject to the GDPR, the UK GDPR and India's DPDP Act, because those laws require controllers to use processors that provide sufficient guarantees.

Key commitments and controls

Processing only on customer instructions

The provider processes PII only for the purposes and in the manner instructed by the customer, documented in the contract and service terms. It does not process customer PII for its own purposes.

PII processed under the contract is not used for marketing or advertising without the express consent of the PII principal, and consent is not made a condition of receiving the service. For SaaS companies, this is also the place to be explicit about whether customer data is used to train AI models, and to make that use opt-in or excluded.

Cooperation with data subject rights

The provider gives customers the means to meet their obligations to individuals: to access, correct and erase their data. In practice, admin tools and APIs for export, correction and deletion.

Transparency about sub-processors

The provider discloses the use of sub-processors before use, and informs customers of changes so they can object or terminate. Sub-processors are bound to equivalent obligations.

Disclosure requests

Legally binding requests for disclosure of PII by law enforcement or other authorities are notified to the customer unless prohibited, and disclosures are recorded. The provider rejects requests that are not legally binding unless the customer has authorised the disclosure.

Data location

The provider specifies and documents the countries in which PII might be stored or processed, so customers can assess legal implications and transfer requirements.

Breach notification

The provider notifies the customer promptly of any unauthorised access to PII or to processing equipment or facilities resulting in loss, disclosure or alteration of PII, with the information needed for the customer to meet its own obligations, as agreed in the contract.

Return, transfer and disposal

The provider has a policy for returning, transferring and securely disposing of PII at the end of the contract, including backups, within an agreed period, and makes this available to customers.

Security safeguards adapted to PII

Confidentiality agreements for staff, controls on creation of hardcopy material, logging of data restoration, encryption of PII transmitted over public networks and on portable media, secure disposal, unique user IDs, records of authorised users, protection when reallocating storage space, and access control restricting who can view customer data.

Accountability records

Retention of copies of security policies and procedures for a defined period after replacement, so that the provider can show what applied at the time of an incident.

How SaaS companies implement ISO/IEC 27018

Commitment	Product or process feature
Process on instructions only	DPA with clear processing purposes; internal policy forbidding other use; access controls limiting staff access to customer data
No advertising or AI training without consent	Contract terms; technical separation of customer data from analytics and model training pipelines
Help with data subject rights	Admin console and APIs for export, correction and deletion of end-user records
Sub-processor transparency	Published sub-processor list with change notifications and an objection process
Data location	Documented hosting regions, regional data residency options
Breach notification	Incident process with defined customer notification timelines and content
Return and deletion	Self-service export; documented deletion timelines including backups; deletion certificates on request
Restricted support access	Just-in-time access to customer tenants with customer approval or logging, and audit trails

Implementation step by step

Confirm your role as a public cloud PII processor for each service, and identify any processing where you act as a controller (for example account and billing data).
Extend your ISMS under ISO/IEC 27001 to include ISO/IEC 27018 in scope.
Map personal data flows for customer data: where stored, who can access it, which sub-processors receive it, which regions it lives in.
Update contracts: DPA, sub-processor terms, breach notification commitments, disclosure request handling, deletion timelines.
Build product features for rights handling, export and deletion.
Restrict and log staff access to customer data, and separate it from analytics and AI training.
Publish transparency information: sub-processors, data locations, deletion policy, law enforcement request policy.
Include the controls in internal audit, then in the certification audit.

Documentation you will need

ISMS documentation with ISO/IEC 27018 in the Statement of Applicability.
Data processing agreement and service terms.
Sub-processor list and change notification records.
Data location documentation.
Policy and records for law enforcement and other disclosure requests.
Breach notification procedure and records.
Data return and deletion policy and evidence.
Records of authorised users with access to customer data and access logs.
Staff confidentiality agreements and training records.

Audit and certification

ISO/IEC 27018 is not certifiable on its own. Accredited certification bodies assess it as part of an ISO/IEC 27001 audit, and the certificate lists conformity with ISO/IEC 27018 for the services in scope, often alongside ISO/IEC 27017. Ask your certification body when it will audit against the 2025 edition. For a full privacy management system that can be certified independently, see ISO/IEC 27701.

Timeline and cost considerations

For a provider already certified to ISO/IEC 27001, adding ISO/IEC 27018 is mostly about contracts, transparency documentation and a few product and operational features. The effort is larger if the product lacks self-service export and deletion or if staff have broad, unlogged access to customer data. Costs include extra audit time, legal review, engineering, and the operational process for sub-processor notifications and disclosure requests.

Benefits and the risk of not having it

ISO/IEC 27018 helps sales to privacy-conscious customers, particularly in Europe, and answers many privacy questionnaire items with audited evidence. It also forces discipline about customer data use, which protects the provider against reputational damage if internal teams use customer data in ways customers did not expect. There is no legal penalty for not adopting it, but customers may prefer providers who can show it, and the commitments it contains overlap heavily with legal processor obligations that do carry penalties.

Common mistakes and challenges for IT companies

Using customer data for product analytics or AI training without clear contractual basis or consent.
Unpublished or outdated sub-processor lists.
Deletion promises that backups do not honour.
Support engineers with standing access to all tenants and no logging.
Vague breach notification terms that do not let customers meet their own 72-hour deadlines.
Treating ISO/IEC 27018 as a privacy law certificate. It supports compliance but is not proof of it.

Best practices, tools and technologies

Offer regional hosting and document data flows per region.
Use just-in-time, ticket-linked access to customer data, visible to customers in their audit log.
Build bulk export and deletion APIs and track completion.
Exclude customer content from analytics and machine learning pipelines by design, with explicit opt-in if offered.
Automate sub-processor change notifications to customer contacts.
Encrypt customer data with keys scoped per tenant where feasible.

We build these capabilities into SaaS platforms and their APIs.

How ISO/IEC 27018 relates to other frameworks

Framework	Relationship
ISO/IEC 27017	General cloud security code of practice; often certified together.
ISO/IEC 27701	Full privacy management system for controllers and processors; certifiable on its own since 2025.
ISO/IEC 27001	The management system ISO/IEC 27018 is assessed within.
GDPR	Article 28 processor obligations overlap closely with ISO/IEC 27018 commitments.
DPDP Act	Fiduciaries must bind processors by contract; ISO/IEC 27018 evidence helps.
CSA STAR	Cloud assurance with privacy-related controls in the Cloud Controls Matrix.

Real-world implementation examples

Major cloud providers were among the first to adopt ISO/IEC 27018 and publish their commitments not to use customer data for advertising, to notify customers of law enforcement requests where legally allowed, and to disclose sub-processors. Those public commitments show what the standard looks like when written for customers.

An illustrative case for an HR SaaS provider: a European customer's privacy team asks whether employee data is used for product analytics and AI features. The provider separates customer content from its analytics pipeline, makes AI feature training opt-in at the customer level, publishes its sub-processor list with a 30-day notice process, and adds ISO/IEC 27018 to its ISO/IEC 27001 scope. The customer's procurement team accepts the certificate and DPA without further questionnaires.

Next steps

Confirm where you act as a processor and map customer data flows.
Review contracts and transparency documentation against the commitments above.
Build export, deletion and access logging features.
Separate customer data from your own analytics and AI work.
Add ISO/IEC 27018 to your certification scope.

Frequently asked questions

Can a company be certified to ISO 27018 alone?

No. It is assessed as an extension of ISO/IEC 27001 certification.

What is the latest version of ISO 27018?

ISO/IEC 27018:2025, the third edition, aligned with ISO/IEC 27002:2022.

Who should use ISO 27018?

Public cloud and SaaS providers that process personal data on behalf of business customers.

No. It supports processor obligations under the GDPR and similar laws, but compliance depends on all the facts and is decided by regulators.

What is the difference between ISO 27018 and ISO 27701?

ISO/IEC 27018 is a code of practice for public cloud PII processors. ISO/IEC 27701 is a full privacy management system for any controller or processor and can be certified on its own.

Can we use customer data to train AI models under ISO 27018?

Not for your own purposes without a proper basis. The standard limits processing to customer instructions and prohibits use for marketing or advertising without consent. Make any AI training explicit in contracts and opt-in.

Do we need to tell customers about law enforcement requests?

The standard expects you to notify the customer of legally binding disclosure requests unless notification is prohibited, and to record disclosures.

Does ISO 27018 require data to stay in one country?

No. It requires transparency about the countries where data may be stored or processed, so customers can assess the legal implications.

How quickly must breaches be reported to customers?

The standard expects prompt notification; the exact timeframe should be set in the contract, short enough for customers to meet their own legal deadlines.

Does ISO 27018 cover our own account and billing data?

No. It covers personal data you process on behalf of customers. Data you collect for your own purposes, such as account, billing and marketing data, makes you a controller and falls under privacy law and, if you choose, ISO/IEC 27701.

What evidence do customers usually ask for?

Your ISO/IEC 27001 certificate showing ISO/IEC 27018 in scope, your data processing agreement, the sub-processor list, data location information and your deletion policy. Having these on a trust page shortens reviews.

Is ISO 27018 only for public clouds?

It is written for public cloud processors, but private and community cloud providers often apply its guidance too.