We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

ISO/IEC 27018Free Resource

ISO/IEC 27018 Scope, controls, contracts, evidence, and comparisons

ISO/IEC 27018:2025 gives privacy guidance to public-cloud providers that process personally identifiable information (), meaning information that can identify or be linked to a natural person, for customers. It is a standard, not a privacy law or a standalone management-system certification, and it does not replace duties created by applicable law or contract.

Jump to guides
By Sorena AICurrent edition: 2025No signup required
Quick scan
ISO/IEC 27018
What it covers
Privacy controls and implementation guidance for public-cloud providers acting as . It does not cover the provider's separate controller purposes or replace jurisdiction-specific controller duties. The 2025 edition is aligned with ISO/IEC 27002:2022 and adds extended implementation guidance in Annex B.
How to use it
Decide the role, purpose, data, and service boundary first. Then select controls through the applicable risk and information security management system process, assign contract responsibilities, test operation with service-specific records, justify omissions, and set scheduled and event-driven review triggers.
Who should read it first
Cloud providers, customers evaluating those providers, and privacy, security, legal, procurement, and compliance teams that need a shared scope and evidence model.

ISO published edition 3 on 26 August 2025 and withdrew the 2019 edition. The standard sets no universal implementation, breach-notification, deletion, audit, or reassessment deadline; law, contract, risk, and the selected controls determine those timings. Check the edition, criteria, entity, service scope, period, exclusions, and assessment method before relying on any conformance or assurance claim.

Key dates
Guides
Deep pages
FAQ
Standalone answers
Compare
Side-by-side
Evidence
Reusable
What this ISO/IEC 27018 hub helps you do
Understand the standard
Confirm that the service uses the public-cloud model, handles information that can identify or be linked to a person, and processes that on behalf of and according to a customer's instructions. The same provider may be a controller for separate processing that it determines, so classify each purpose and operation rather than the company as a whole.
Organize the work
Translate the processor role into allocated responsibilities, customer instructions, purpose limits, access and logging, subprocessor notice and objection routes, country transparency, legally binding disclosure handling, incident support, and return or deletion controls. Assign shared controls for the actual software, platform, or infrastructure service model.
Prepare for questions
Keep the contract, control mapping, operating samples, subprocessor and country notices, disclosure and incident records, deletion evidence, exceptions, and assurance material tied to the named entity, service boundary, period, edition, and assessment method. Reassess when roles, purposes, systems, suppliers, countries, terms, law, incidents, or criteria change.
Scope
Evidence
Review
Publication details
Editorial metadata for this artifact
Author
Sorena AI
Published
Mar 4, 2026
Updated
Jul 16, 2026

First confirm the offering uses the public-cloud model and the provider processes on behalf of and according to the customer's instructions. Apply that test to each purpose: provider-controlled account, billing, fraud-prevention, analytics, or marketing activity needs a separate controller analysis. Then map responsibilities, purpose limits, subprocessors, countries, disclosures, incident support, security, return or deletion, and evidence to the actual service and contract.

Recommended reading path

Choose the next ISO/IEC 27018 decision

New to the standard? Confirm the public-cloud processor role first. If scope is already documented, jump to the control, contract, evidence, assurance, or comparison you need.

1

Start here: scope and responsibilities

Establish the service boundary, distinguish controller and processor activities, and understand what the standard and a scoped assurance report can and cannot demonstrate.

ISO/IEC 27018 Public Cloud PII Processor Scope Guide
Decide whether a service fits ISO/IEC 27018's public-cloud PII processor scope, separate processor and controller activities, and document the boundary.
Read guide
Using ISO/IEC 27018 for Public-Cloud PII Processing
Decide whether ISO/IEC 27018:2025 applies to a public-cloud PII processor, how it fits an ISMS, what evidence to keep, and which claims the evidence supports.
Read guide
ISO/IEC 27018 Privacy Control Checklist
A practical ISO/IEC 27018:2025 checklist for public-cloud PII processors, with verifiable conditions, owners, evidence, exceptions, and edition controls.
Read guide
3

Subprocessors and compelled disclosures

Build evidence for subprocessor transparency and change notice, processing countries, legally binding disclosure requests, legally permitted customer notice, and disclosure records.

ISO/IEC 27018 Subprocessor Evidence Guide
Build subprocessor evidence that proves who processed customer PII, where, under which terms and controls, after which notice and approval, and with what exit result.
Read guide
ISO/IEC 27018 Subprocessor Evidence Workflow
Assess and approve a cloud subprocessor, disclose its use and countries before processing, handle customer objections, and retain operating and exit evidence.
Read guide
ISO/IEC 27018 Government Access Evidence Guide
Build a controlled government-access case record showing request authentication, legal review, notice, approval, minimized disclosure, transfer, and closure.
Read guide
ISO/IEC 27018 Government Access Evidence Workflow
Triage a government request for customer PII, validate authority, decide notice and challenge options, minimize disclosure, and preserve the decision record.
Read guide
4

Compare frameworks or answer a specific question

Keep ISO/IEC 27018 distinct from binding privacy law, a broader privacy information management system, and SOC 2 examination criteria, or open the focused FAQ.

ISO/IEC 27018 vs GDPR Comparison
Compare ISO/IEC 27018 cloud-processor guidance with GDPR legal duties, including scope, Article 28 contracts, breaches, transfers, evidence, and assurance limits.
Read guide
ISO/IEC 27018 vs ISO/IEC 27701 Comparison
Compare ISO/IEC 27018:2025 cloud-processor guidance with the independent ISO/IEC 27701:2025 privacy management system, including scope, evidence, and assurance.
Read guide
ISO/IEC 27018 vs SOC 2 Privacy Comparison
Compare ISO/IEC 27018 cloud-processor guidance with a SOC 2 examination that includes Privacy, including scope, Type 1 vs Type 2, evidence, and limits.
Read guide
ISO/IEC 27018 Cloud Privacy FAQ
ISO/IEC 27018 FAQ on public-cloud PII processor scope, customer instructions, subprocessors, disclosures, breaches, deletion, audit evidence, and GDPR.
Read guide
Next step

Turn ISO/IEC 27018 guidance into owned work

Assign ISO/IEC 27018 controls, evidence requests, exceptions, and review checkpoints to the teams responsible for them.

What this unlocks
  • Start with the overview to confirm whether the standard fits your cloud processing model.
  • Use the topic pages to identify the controls, evidence, and owners that matter most.
  • Keep records in one place so privacy, security, legal, and compliance teams can review the same source of truth.
Recommended route
Open Research Copilot
Answer ISO/IEC 27018 scope and interpretation questions with cited outputs.
Supporting route
Open SSOT
Keep ISO/IEC 27018 evidence, decisions, and control records in one governed system.
Talk to Sorena
Talk through implementation
Review scope, evidence gaps, and next implementation steps.
Discuss your setup