ISO/IEC 27018 FAQ

It directly targets organizations of any type or size that provide information-processing services as PII processors through public cloud computing under contract. A provider is acting as a PII processor when it processes PII on behalf of and according to the instructions of a PII controller.

The same provider may act as a controller for account, billing, fraud-prevention, or other data it processes for its own purposes. That controller activity falls outside ISO/IEC 27018's processor scope and needs its own legal and control analysis.

Confirm the service model and responsibility split. Application-layer access, backup, logging, and deletion responsibilities can differ across software, platform, and infrastructure services, so the contract should assign each responsibility.

The 2019 edition covers instructions and independent-purpose limits, express consent for marketing use, customer support for PII rights, security and confidentiality, access and logs, subprocessors and processing countries, legally binding disclosures, breach notice, return and disposal, and independent assurance.

Control selection depends on risk, the contract, applicable law, and the provider's actual role. When the standard is used with ISO/IEC 27001, omitted controls need a documented justification; additional controls may also be required.

It is voluntary guidance, not privacy law. ISO lists ISO/IEC 27018:2025 as the current third edition and ISO/IEC 27018:2019 as withdrawn. Verify the edition, audit criteria, legal entity, public-cloud service, processor scope, period, exclusions, and assurance scheme before describing what a certificate or report covers.

ISO/IEC 27018 can support an ISO/IEC 27001 control environment, but an ISO/IEC 27018 reference does not by itself prove GDPR compliance, create a lawful basis, or satisfy a contract.

Ask for the provider's role and service scope, relevant contract terms, responsibility and control mappings, current independent evidence, operating samples, subprocessor and country records, breach and disclosure handling, deletion outcomes, open findings, and customer responsibilities.

Match each item to the customer's service and review period. A certificate outside the service boundary, an expired report, or a generic policy cannot answer a service-specific control question. Keep ISO guidance separate from binding legal and contractual duties.

Open the focused answers for processor duties, customer instructions, subprocessor notice, government access, breach support, PII return and deletion, audit evidence, and GDPR overlap. Each page identifies the decision, evidence, exceptions, and review triggers for that topic.

Reuse evidence across customer assurance, internal audit, supplier governance, incident review, and legal mapping only when its service, period, criteria, and limitations still match the new use.