Answer the main ISO/IEC 27018 questions by separating processor scope, voluntary guidance, contract and control evidence, and applicable privacy law.
The current edition is ISO/IEC 27018:2025; the detailed control explanations here use the prior 2019 edition and should be checked against the edition named in a contract or assurance report. ISO/IEC 27018 is voluntary guidance, while applicable law and contracts can impose separate or stricter duties.
ISO/IEC 27018 gives public-cloud providers guidance for protecting when they process it on behalf of customers and according to customer instructions. Start by confirming that processor role, each processing purpose, the service and data in scope, the edition used by the contract or assurance report, and any binding law. The current edition is 2025; the detailed clause examples on these pages come from the withdrawn 2019 edition and should not be treated as a substitute for the current text.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
How to assess ISO/IEC 27018 audit evidence by edition, service scope, criteria, audit period, exceptions, and independent assurance.
ISO/IEC 27018 breach support: when a cloud PII processor should notify a customer, what the contract should define, and what incident records to keep.
What counts as a customer instruction under ISO/IEC 27018, how a cloud PII processor should validate it, and what evidence shows it was followed.
How ISO/IEC 27018 can support GDPR processor controls without replacing Article 28 terms, controller accountability, transfers, or breach duties.
How ISO/IEC 27018 addresses legally binding law-enforcement requests: validation, customer consultation or notice, limited disclosure, and records.
How to plan and prove PII return, transfer, deletion, anonymization, or archival across live systems, backups, temporary files, and subprocessors.
What ISO/IEC 27018 expects from a public-cloud PII processor: customer instructions, purpose limits, security, transparency, incident support, and disposal.
What an ISO/IEC 27018 subprocessor notice should disclose, when customers should receive it, and what evidence should support consent and objections.
It directly targets organizations of any type or size that provide information-processing services as processors through public cloud computing under contract. A provider is acting as a PII processor when it processes PII on behalf of and according to the instructions of a PII controller.
The same provider may act as a controller for account, billing, fraud-prevention, or other data it processes for its own purposes. That controller activity falls outside ISO/IEC 27018's processor scope and needs its own legal and control analysis.
Confirm the service model and responsibility split. Application-layer access, backup, logging, and deletion responsibilities can differ across software, platform, and infrastructure services, so the contract should assign each responsibility.
Sources (2)
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
The 2019 edition covers instructions and independent-purpose limits, express consent for marketing use, customer support for rights, security and confidentiality, access and logs, subprocessors and processing countries, legally binding disclosures, breach notice, return and disposal, and independent assurance.
Control selection depends on risk, the contract, applicable law, and the provider's actual role. When the standard is used with ISO/IEC 27001, omitted controls need a documented justification; additional controls may also be required.
Sources (2)
ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
Binding EU data protection regulation used for ISO/IEC 27018 comparison.
protection of natural persons with regard to the processing of personal data
It is voluntary guidance, not privacy law. ISO lists ISO/IEC 27018:2025 as the current third edition and ISO/IEC 27018:2019 as withdrawn. Verify the edition, audit criteria, legal entity, public-cloud service, processor scope, period, exclusions, and assurance scheme before describing what a certificate or report covers.
ISO/IEC 27018 can support an ISO/IEC 27001 control environment, but an ISO/IEC 27018 reference does not by itself prove GDPR compliance, create a lawful basis, or satisfy a contract.
Sources (2)
Binding EU data protection regulation used for ISO/IEC 27018 comparison.
protection of natural persons with regard to the processing of personal data
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
Ask for the provider's role and service scope, relevant contract terms, responsibility and control mappings, current independent evidence, operating samples, subprocessor and country records, breach and disclosure handling, deletion outcomes, open findings, and customer responsibilities.
Match each item to the customer's service and review period. A certificate outside the service boundary, a report covering another period, or a generic policy cannot answer a service-specific control question without additional evidence. Keep ISO guidance separate from binding legal and contractual duties.
Sources (2)
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
Record the provider role, service boundary, cited edition, contract term, control owner, current evidence, exception, and next review date.
Convert the relevant answer into scoped control tasks, evidence requests, exceptions, and review dates.
Review your current scope, evidence gaps, and next implementation steps.
Open the focused answers for processor duties, customer instructions, subprocessor notice, government access, breach support, return and deletion, audit evidence, and GDPR overlap. Each page identifies the decision, evidence, exceptions, and review triggers for that topic.
Reuse evidence across customer assurance, internal audit, supplier governance, incident review, and legal mapping only when its service, period, criteria, and limitations still match the new use.
Sources (2)
ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
Binding EU data protection regulation used for ISO/IEC 27018 comparison.
protection of natural persons with regard to the processing of personal data
It supplies public-cloud processors with privacy-oriented controls and implementation guidance to use alongside an information security management system. Topics include customer instructions and purpose limits, security, subprocessors and processing countries, third-party disclosures, breach support, customer rights support, and return or disposal. The standard is voluntary unless a contract or other requirement makes it a criterion.
Use records from the actual service: customer instructions and contract terms, the provider-customer responsibility map, selected-control rationale, subprocessor and country notices, access and event logs, breach and disclosure records, deletion or return results, exceptions, and independent assurance. Each item should identify the service, period, owner, and outcome it supports.
Review the control mapping before processing starts and when purposes, services, data, roles, customer terms, subprocessors, processing countries, incidents, or applicable law change. Also review it when the cited ISO/IEC 27018 edition or assurance scope changes; a 2019 mapping does not automatically establish conformity with the 2025 edition.
Assign owners by duty: privacy and legal interpret roles and terms; security and cloud operations run technical controls; supplier management handles subprocessors; incident response handles breach facts; and the service owner keeps customer commitments aligned. ISO/IEC 27018 also calls for a customer contact for processing under the contract.
No. ISO/IEC 27018 directly targets processing performed through a public-cloud service on behalf of and according to a customer's instructions. A provider-controlled purpose, such as its own account administration, billing, fraud prevention, product analytics, or marketing, needs a separate controller-role and legal analysis. Classify each purpose and operation; do not label the whole provider as a processor.
No. The 2019 guidance said a contract should define the maximum delay for notifying a customer of a qualifying breach, but it did not prescribe one number. It also called for a documented return, transfer, or disposal policy and a post-termination retention period. Applicable law, contract terms, risk, system design, and the current 2025 criteria determine the actual timings; record backup, business-continuity, subprocessor, legal-retention, and customer-managed exceptions.
Only when the certificate and supporting assessment evidence cover the relevant provider entity, public-cloud service, locations, period, control criteria, and processor activities. ISO/IEC 27001 is the certifiable information security management system requirements standard; ISO/IEC 27018 supplies cloud- guidance. A certificate outside the service boundary, or one whose supporting criteria do not include ISO/IEC 27018, does not establish that coverage.
ISO published edition 3 on 26 August 2025 and withdrew the 2019 edition. ISO says the 2025 edition aligns with ISO/IEC 27002:2022 and adds Annex B with extended implementation guidance. A contract, questionnaire, control map, or report that cites 2019 remains evidence about that stated historical criterion; it should be reconciled to the 2025 structure and criteria before anyone describes it as 2025 coverage.
"protection of natural persons with regard to the processing of personal data"
"Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors"
"Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors"
Review cloud data-processing terms for instructions, purpose limits, controls, subprocessors, disclosures, incidents, rights support, and deletion.
Build a controlled government-access case record showing request authentication, legal review, notice, approval, minimized disclosure, transfer, and closure.
Triage a government request for customer PII, validate authority, decide notice and challenge options, minimize disclosure, and preserve the decision record.
A public-cloud PII processor checklist using ISO/IEC 27018:2019 control examples, with owners, evidence, exceptions, and checks against the 2025 edition.
Decide whether a service fits ISO/IEC 27018's public-cloud PII processor scope, separate processor and controller activities, and document the boundary.
Build subprocessor evidence that proves who processed customer PII, where, under which terms and controls, after which notice and approval, and with what exit result.
Assess and approve a cloud subprocessor, disclose its use and countries before processing, handle customer objections, and retain operating and exit evidence.
Contract guide for ISO/IEC 27018 public-cloud PII processing: scope, instructions, security, subprocessors, disclosures, incidents, rights support, audits, and exit.
Compare ISO/IEC 27018 cloud-processor guidance with GDPR legal duties, including scope, Article 28 contracts, breaches, transfers, evidence, and assurance limits.
Compare ISO/IEC 27018:2025 cloud-processor guidance with the independent ISO/IEC 27701:2025 privacy management system, including scope, evidence, and assurance.
Compare ISO/IEC 27018 cloud-processor guidance with a SOC 2 examination that includes Privacy, including scope, Type 1 vs Type 2, evidence, and limits.
Decide whether ISO/IEC 27018:2025 applies to a public-cloud PII processor, how it fits an ISMS, what evidence to keep, and which claims the evidence supports.