Use ISO/IEC 27018 for focused public-cloud processor controls and ISO/IEC 27701 for an organization-wide ; combine them when both scopes matter.
Both standards have current 2025 editions. ISO/IEC 27701:2025 is an independent management-system standard, while the withdrawn 2019 edition was an extension to ISO/IEC 27001 and ISO/IEC 27002. Check every clause, certificate, and transition claim against the named edition.
Choose ISO/IEC 27018:2025 when the decision centers on controls for a public-cloud provider acting as a PII processor. Choose ISO/IEC 27701:2025 when the organization needs an independent for PII controller and processor activities. Use both when the broader PIMS includes public-cloud processor services, but keep each standard's scope, controls, evidence, and assurance claim separate.
Side-by-side comparison
ISO/IEC 27018 vs ISO/IEC 27701: scope, duties, evidence, and decision rule
Compare the focused cloud-processor controls in ISO/IEC 27018:2025 with the independent PIMS requirements in ISO/IEC 27701:2025. Use the withdrawn 2019 editions only when a historical contract, certificate, or assessment names them.
Focused guidance for protecting customer PII in public-cloud processor services; it does not itself create a management system, legal duty, or universal certification claim.
Second framework
ISO/IEC 27701
An independent for controller and processor activities. The 2025 edition can be used alone; the withdrawn 2019 edition depended on an ISMS extension model.
ISO/IEC 27018 vs ISO/IEC 27701: scope, duties, evidence, and decision rule
Public-cloud providers processing customer PII under instruction; separate provider-controller activity and additional controller duties remain outside the direct scope.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701:2025 establishes an independent PIMS for organizations acting as PII controllers, processors, or both. It can span products, services, functions, and processing beyond public cloud.
ISO states that the current edition is an independent PIMS management-system standard for PII controllers and processors.
Privacy information management systems — Requirements and guidance
Use the service role and management-system boundary to choose focused cloud guidance, a broader PIMS, or both. Do not apply the withdrawn 2019 dependency model to the 2025 edition.
Provider privacy, security, legal, cloud operations, supplier, incident-response, and service owners operate the controls; customers retain authority over instructed processing.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
Top management and assigned privacy, risk, legal, security, procurement, operations, internal-audit, and control owners run the PIMS across its controller and processor scope.
Adopt when a public-cloud processor and customer need a recognized privacy-control baseline, or when a contract or assurance request names the standard.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
Selected when an organization wants a governed PIMS across roles, processing, risks, objectives, operations, evaluation, and improvement. It is not limited to public cloud.
ISO describes ISO/IEC 27701:2025 as an independent PIMS standard that applies to PII controllers and processors.
Privacy information management systems — Requirements and guidance
A request for cloud-processor controls does not automatically require a PIMS, and a PIMS claim does not show that a public-cloud service was assessed against ISO/IEC 27018.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
The 2025 edition sets PIMS requirements and guidance for establishment, implementation, maintenance, and continual improvement. The 2019 edition's ISMS-extension structure is historical.
Scope and role records, control applicability, contracts, operating samples, subprocessor and country notices, disclosure and incident records, deletion evidence, findings, and corrections.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
No statutory adoption deadline. Review follows the PIMS lifecycle, material changes, risk, monitoring, internal audit, management review, corrective action, and the applicable assurance cycle.
Voluntary guidance can support internal audit, customer assurance, or a defined independent audit or certification arrangement; claims must name the service and criteria.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
As an independent management-system standard, ISO/IEC 27701:2025 can be the stated criterion for a defined assessment or certification scheme. Any claim remains limited to its certificate, scope, edition, and scheme.
ISO describes the 2025 edition as an independent management-system standard; any third-party certification claim still depends on the applicable scheme and certificate.
Privacy information management systems — Requirements and guidance
Verify the certificate or report, entity, boundary, sites, edition, dates, exclusions, certification body, accreditation context, and transition status.
Service inventories, contracts, controls, tickets, logs, supplier records, incidents, deletion results, and audit evidence can be reused where scope and criteria match.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
Governance, inventories, role maps, risk, contracts, suppliers, incidents, audits, corrective actions, and management review can support the wider PIMS.
Choose it when the primary problem is protecting customer PII in a public-cloud processor service and making that control operation understandable to customers.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
Choose it when the primary need is a privacy management system spanning controller and processor activities, governance, risk, operation, evaluation, and improvement.
ISO describes the current standard as a PIMS for controllers and processors that can be used independently.
Privacy information management systems — Requirements and guidance
Use both when the PIMS includes public-cloud processor services. Preserve separate editions, applicability decisions, control references, evidence, and assurance claims.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Scope and covered activity
ISO/IEC 27018
Public-cloud providers processing customer PII under instruction; separate provider-controller activity and additional controller duties remain outside the direct scope.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
ISO/IEC 27701:2025 establishes an independent PIMS for organizations acting as PII controllers, processors, or both. It can span products, services, functions, and processing beyond public cloud.
ISO states that the current edition is an independent PIMS management-system standard for PII controllers and processors.
Privacy information management systems — Requirements and guidance
Operational implication
Use the service role and management-system boundary to choose focused cloud guidance, a broader PIMS, or both. Do not apply the withdrawn 2019 dependency model to the 2025 edition.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Who must act
ISO/IEC 27018
Provider privacy, security, legal, cloud operations, supplier, incident-response, and service owners operate the controls; customers retain authority over instructed processing.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
Top management and assigned privacy, risk, legal, security, procurement, operations, internal-audit, and control owners run the PIMS across its controller and processor scope.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Trigger or threshold
ISO/IEC 27018
Adopt when a public-cloud processor and customer need a recognized privacy-control baseline, or when a contract or assurance request names the standard.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
Selected when an organization wants a governed PIMS across roles, processing, risks, objectives, operations, evaluation, and improvement. It is not limited to public cloud.
ISO describes ISO/IEC 27701:2025 as an independent PIMS standard that applies to PII controllers and processors.
Privacy information management systems — Requirements and guidance
Operational implication
A request for cloud-processor controls does not automatically require a PIMS, and a PIMS claim does not show that a public-cloud service was assessed against ISO/IEC 27018.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
The 2025 edition sets PIMS requirements and guidance for establishment, implementation, maintenance, and continual improvement. The 2019 edition's ISMS-extension structure is historical.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Evidence and records
ISO/IEC 27018
Scope and role records, control applicability, contracts, operating samples, subprocessor and country notices, disclosure and incident records, deletion evidence, findings, and corrections.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
No statutory adoption deadline. Review follows the PIMS lifecycle, material changes, risk, monitoring, internal audit, management review, corrective action, and the applicable assurance cycle.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Enforcement or assurance route
ISO/IEC 27018
Voluntary guidance can support internal audit, customer assurance, or a defined independent audit or certification arrangement; claims must name the service and criteria.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
As an independent management-system standard, ISO/IEC 27701:2025 can be the stated criterion for a defined assessment or certification scheme. Any claim remains limited to its certificate, scope, edition, and scheme.
ISO describes the 2025 edition as an independent management-system standard; any third-party certification claim still depends on the applicable scheme and certificate.
Privacy information management systems — Requirements and guidance
Operational implication
Verify the certificate or report, entity, boundary, sites, edition, dates, exclusions, certification body, accreditation context, and transition status.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Overlap and reuse
ISO/IEC 27018
Service inventories, contracts, controls, tickets, logs, supplier records, incidents, deletion results, and audit evidence can be reused where scope and criteria match.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
Governance, inventories, role maps, risk, contracts, suppliers, incidents, audits, corrective actions, and management review can support the wider PIMS.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Practical decision rule
ISO/IEC 27018
Choose it when the primary problem is protecting customer PII in a public-cloud processor service and making that control operation understandable to customers.
Primary ISO listing for the 2025 edition of ISO/IEC 27018.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27701
Choose it when the primary need is a privacy management system spanning controller and processor activities, governance, risk, operation, evaluation, and improvement.
ISO describes the current standard as a PIMS for controllers and processors that can be used independently.
Privacy information management systems — Requirements and guidance
Operational implication
Use both when the PIMS includes public-cloud processor services. Preserve separate editions, applicability decisions, control references, evidence, and assurance claims.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
Practical decision rule
How should teams decide between ISO/IEC 27018 and ISO/IEC 27701?
Choose ISO/IEC 27018:2025 for public-cloud PII processor controls involving customer instructions, sub-contractors, disclosures, incidents, locations, deletion, and processor evidence.
Choose ISO/IEC 27701:2025 for an independent PIMS spanning controller and processor governance, risk, operation, evaluation, and continual improvement.
Use both when the PIMS boundary includes public-cloud processor services; map shared evidence but retain each standard's edition, clause, scope, result, and assurance boundary.
ISO describes the current edition as an independent PIMS standard for controllers and processors.
Privacy information management systems — Requirements and guidance
1
Section 1
Which standard fits the primary objective?
ISO/IEC 27018:2025 provides guidance for protecting PII in public-cloud services when the provider acts as a processor. It builds on ISO/IEC 27002 and focuses on the provider-customer relationship, cloud-specific responsibilities, transparency, and PII controls.
ISO/IEC 27701:2025 sets requirements and guidance for establishing, implementing, maintaining, and continually improving a . It applies to PII controllers and processors and can be used alone as an independent management-system standard.
Do not carry the 2019 dependency model into a 2025 decision. ISO/IEC 27701:2019 was an extension to ISO/IEC 27001 and ISO/IEC 27002 for organizations processing PII within an information security management system (ISMS); ISO marks that edition withdrawn and replaced.
Choose ISO/IEC 27018 for cloud-service controls involving customer instructions, rights assistance, disclosures, sub-contractors, incidents, processing locations, and disposal.
Choose ISO/IEC 27701 for a governed PIMS with organizational scope, privacy risks, objectives, roles, operation, evaluation, corrective action, and continual improvement.
Use both when the PIMS boundary includes public-cloud processor services; map overlaps but retain separate applicability decisions and evidence references.
ISO identifies ISO/IEC 27701:2025 as an independent PIMS management-system standard for PII controllers and processors, published in October 2025.
Privacy information management systems — Requirements and guidance
2
Section 2
When is ISO/IEC 27018 the direct control guide?
Use ISO/IEC 27018 when a public-cloud provider needs specific control guidance for PII processed on a customer's instructions. Confirm the service category, shared-responsibility boundary, customer authority, provider-controlled processing outside that authority, sub-contractors, and countries where PII can be stored.
The withdrawn 2019 edition provides detailed examples for rights assistance, marketing restrictions, disclosure requests and records, sub-contractor notices, breach support, contract measures, return or disposal, and processing locations. Use those examples only as historical grounding until they are checked against ISO/IEC 27018:2025.
Scope evidence: service boundary, PII flows, processor role, customer instructions, locations, sub-contractors, and responsibility matrix.
Control evidence: access reviews, logs, disclosure records, incident files, restoration controls, deletion tests, and rights-assistance tickets.
The withdrawn edition contains the detailed cloud-processor controls cited here; ISO's lifecycle record shows it has been replaced by the 2025 edition.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO describes the current standard's cloud-processor scope, relationship to ISO/IEC 27002, and alignment with ISO/IEC 27002:2022.
Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors
3
Section 3
When is ISO/IEC 27701 the broader system choice?
Use ISO/IEC 27701:2025 when the organization needs a PIMS spanning governance and operational privacy work across controller and processor roles. The management-system boundary can cover more than cloud services and should identify the organizational units, products, processing, interested parties, legal and contractual requirements, risks, and interfaces within scope.
ISO states that the 2025 edition can be used alone. It also aligns with existing ISO/IEC 27001 systems, so an organization can coordinate them without treating ISO/IEC 27001 as a prerequisite for the current PIMS.
Define the PIMS boundary, controller and processor roles, PII processing, internal and external interfaces, and applicable requirements.
ISO's withdrawn 2019 listing documents the former extension to ISO/IEC 27001 and ISO/IEC 27002 and identifies the 2025 replacement.
Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
4
Section 4
Which evidence can be coordinated?
Coordinate PII inventories, role maps, risk assessments, policies, legal and contractual requirements, supplier records, incidents, internal audits, findings, corrective actions, and management review. Add the cloud-specific instructions, locations, sub-contractor notices, disclosures, deletion tests, and shared-responsibility evidence needed for ISO/IEC 27018.
Keep one evidence inventory if that reduces duplicate collection, but label the standard, edition, clause or criterion, organizational and service scope, control owner, evidence period, sampling limits, and result for every use.
Do not infer that a PIMS-wide record covers a cloud service that is outside the PIMS boundary.
Do not infer that a cloud control proves organization-wide governance, performance evaluation, or continual improvement.
Record exclusions, failed tests, open corrective actions, accepted risks, and evidence that predates a material change.
How should edition and assurance claims be checked?
Verify the exact standard and edition, legal entity, sites, services, PIMS or control boundary, exclusions, assessment dates, certification body or assurance provider, accreditation context, transition status, and scheme rules. An ISO/IEC 27701:2025 claim does not automatically include ISO/IEC 27018:2025, and the reverse is also false.
A certificate or report supports only its stated scope and criteria. It does not establish compliance with every privacy law, contract, customer requirement, or processing activity.
Reject an edition-free badge or statement when the underlying certificate or report is unavailable.
Document the move from ISO/IEC 27701:2019 to 2025 because the current edition changed from an ISMS extension to an independent management-system standard.
Recheck mappings after changes to roles, services, processing, suppliers, countries, management-system boundaries, standards, or assurance schemes.
ISO's current listing identifies the 2025 edition as an independent privacy information management system standard for PII controllers and processors.
ISO identifies ISO/IEC 27701:2025 as an independent PIMS management-system standard for PII controllers and processors, published in October 2025.
ISO describes the current edition as an independent PIMS standard for controllers and processors that can be used alone.
Show 8 more
ISO identifies the current edition as an independent PIMS standard and links the withdrawn 2019 predecessor.
ISO states that the current edition is an independent PIMS management-system standard for PII controllers and processors.
ISO describes ISO/IEC 27701:2025 as an independent PIMS standard that applies to PII controllers and processors.
ISO states that the current edition sets requirements for establishing, implementing, maintaining, and continually improving a PIMS.
ISO lists the 2025 edition as the published current edition and the 2019 edition as withdrawn.
ISO describes the 2025 edition as an independent management-system standard; any third-party certification claim still depends on the applicable scheme and certificate.
ISO describes the current standard as a PIMS for controllers and processors that can be used independently.
ISO describes the current edition as an independent PIMS standard for controllers and processors.
"Privacy information management systems — Requirements and guidance"
ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.
ISO marks the 2019 cloud-control edition withdrawn; historical clause references must be reconciled with the current edition.
The withdrawn edition contains the detailed cloud-processor controls cited here; ISO's lifecycle record shows it has been replaced by the 2025 edition.
"Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors"