GuideGlobalISO/IEC 27018

ISO/IEC 27018 Public Cloud PII Processor Scope

Decide whether the service, provider activity, and customer relationship fit ISO/IEC 27018's public-cloud PII processor scope before assigning controls.

ISO/IEC 27018:2025 is the current edition. The role and control details below come from the withdrawn 2019 edition and must be checked against the edition named in a contract, certification scope, or assurance report. Applicable law and contracts can impose separate duties.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

ISO/IEC 27018 applies when an organization provides public-cloud information processing under contract and acts as a by processing PII on behalf of and according to a customer's instructions. Scope the purpose and operation, not the company, because the same provider can determine separate purposes for customer-account or other processing.

Section 1

Is this a public-cloud PII processor activity?

Apply three tests. First, the offering must be a public-cloud service supplied under contract. Second, it must process PII, meaning information that can identify or be linked to a natural person; the provider may need customer context to recognize it. Third, the provider must process that PII on behalf of and according to the cloud customer's instructions. If any test fails, the activity is outside the standard's direct processor target, though other security, privacy, legal, or contractual requirements can still apply.

The customer retains authority over the processing and use of customer PII. The provider can choose technical methods needed to deliver the service, such as allocating storage or processing capacity, without changing role if those methods remain consistent with the customer's objectives and instructions.

Record the answer per service and processing purpose. A company-wide label such as "processor" is too broad when the provider determines separate purposes for account administration, security analytics, product improvement, or marketing.

In scope: public-cloud collection, storage, use, transmission, backup, restoration, and deletion performed for the customer's stated purposes.
Outside the direct scope: processing for the provider's independently chosen purposes and additional controller obligations that do not apply to processors.
Borderline case: a technical implementation choice needed to achieve the customer's objective can remain processor activity. A new provider-selected objective, reuse of customer PII for product improvement or marketing, or an instruction that does not cover the operation requires a separate role and legal assessment before processing.
Output: a dated scope record naming the service, customer type, PII categories, operations, purposes, locations, subprocessors, instruction source, control owner, exclusions, and approving role.

Sources for this answer

ISO/IEC 27018:2025 standard page

ISO identifies ISO/IEC 27018:2025 as the published third edition and describes its target as public-cloud providers acting as PII processors.

ISO/IEC 27018:2019 standard page

ISO's withdrawn 2019 listing states that the standard applied to organizations providing cloud information-processing services as PII processors under contract and excluded additional controller obligations.

Section 2

Which customer, controller, provider, processor, and user roles apply?

The cloud service customer has the contract with the provider and authority over customer-PII processing. The customer can be an individual processing their own PII or an organization acting as PII controller, and it can authorize cloud users to use the service.

The provider is the public cloud only for instructed processing. Map each activity to the party that sets its purpose, the documented instruction, the operational owner, and the evidence that the service follows that instruction.

Customer evidence: contract, data-processing terms, service configuration, documented instructions, authorized-user model, and change approvals.
Provider evidence: service description, data-flow map, processing inventory, country list, subprocessor register, access-control records, logs, deletion design, and incident procedure.
Role split: identify provider-controlled purposes separately and do not present ISO/IEC 27018 coverage as proof that those controller activities comply with applicable law.
Approval: name the privacy or legal reviewer, service owner, decision date, unresolved assumptions, and the change that will force reassessment.

Sources for this answer

ISO/IEC 27018:2019 standard page

ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.

GDPR consolidated text

Where the GDPR applies, Articles 4 and 28 separately define controller and processor roles and regulate processing by a processor; ISO/IEC 27018 does not replace those binding rules.

Section 3

What belongs inside the service and processing boundary?

Draw the boundary around the contracted service and every system that can store, transmit, access, restore, or delete customer PII. Include management interfaces, support tooling, telemetry containing PII, temporary files, backups, disaster-recovery copies, and sub-contracted processing.

For each component, state the PII categories, processing operation, customer purpose, responsible party, possible storage countries, retention or deletion rule, and evidence source. Mark customer-managed components and shared controls so neither party assumes the other operates them.

Include: production data, replicas, support access, diagnostic logs containing PII, temporary files, backups, and exports.
Trace: customer instruction -> service operation -> system or subprocessor -> country -> control -> retained evidence.
Exclude only with a reason, an owner, and evidence. A component is not outside scope merely because a different team or supplier operates it.

Sources for this answer

GDPR consolidated text

Where applicable, GDPR Article 28 requires processor terms to describe processing and governs the processor's handling of personal data on documented instructions.

ISO/IEC 27018:2025 standard page

Primary ISO listing for the 2025 edition of ISO/IEC 27018.

Section 4

What sits outside ISO/IEC 27018's direct scope?

Provider processing for an independently chosen purpose is not covered as processor activity. The 2019 edition specifically notes that a provider can act as PII controller for cloud-customer account data and does not cover the additional obligations that attach to that controller role.

ISO/IEC 27018 is guidance, not a universal data-processing agreement or a legal determination. Identify the governing law and contract separately. A certification or assurance report also has its own organization, service, location, system, control, and time-period boundaries.

Do not assume every cloud provider activity is processor activity.
Do not treat de-identified, anonymized, or telemetry data as outside scope without documenting the method, residual identifiability, and intended use.
Do not use an ISO/IEC 27018 claim to imply compliance with every privacy law or every clause in a customer's contract.

Sources for this answer

ISO/IEC 27018:2025 standard page

Primary ISO listing for the 2025 edition of ISO/IEC 27018.

ISO/IEC 27018:2019 standard page

ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.

Section 5

Which changes require a new scope decision?

Reassess before a new purpose, PII category, service component, support route, subprocessor, processing country, retention rule, customer instruction, or contract term takes effect. Also reassess after a material incident or a finding that shows the recorded boundary was wrong.

When the cited standard edition changes, compare the new criteria with the existing control map rather than silently relabeling old evidence. ISO states that the 2025 edition aligns with ISO/IEC 27002:2022 and adds Annex B implementation guidance.

Keep the prior decision, the changed fact, the reviewer, the new conclusion, and the effective date.
Update the data flow, processing inventory, customer notice, contract schedule, country list, subprocessor register, and control evidence affected by the change.
Escalate a proposed independent purpose or unresolved role conflict for a separate legal and privacy assessment before processing begins.

Sources for this answer

ISO/IEC 27018:2019 standard page

ISO's withdrawn 2019 listing identifies the prior edition; its detailed clauses remain relevant only when that edition is the stated criterion.

GDPR consolidated text

Binding EU data protection regulation used for ISO/IEC 27018 comparison.

Recommended next step