Framework Information Security & Privacy
ISO/IEC 27018:2019 is a code of practice for protecting personally identifiable information (PII) in public clouds when the provider acts as a PII processor.
It adapts the ISO/IEC 27002 controls for that role and adds a set of PII-specific controls drawn from the ISO/IEC 29100 privacy principles: processing only on customer instructions, no use of customer data for advertising without consent, notifying customers of legally binding disclosure requests, breach notification to the customer, secure return and deletion, disclosure of sub-processors and locations, and independent verification of controls.
Like ISO 27017, it cannot be certified alone. It is audited as an extension of an ISO/IEC 27001 certification, so the provider needs a certified ISMS plus documented PII processing policies, customer-facing terms that reflect the 27018 commitments, records of sub-processors and data locations, breach notification procedures and evidence that the extended controls appear in the Statement of Applicability.
The 2019 edition replaced the 2014 edition.
Voluntary. Public cloud providers processing customer PII, especially those selling into regulated sectors or the EU market where GDPR Article 28 processor duties apply. No statutory trigger, though it is often cited in vendor due diligence.
Valid ISO 27001 certificate and Statement of Applicability extended with the 27018 controls; PII processing policy and customer instructions process; customer contracts and privacy terms; sub-processor and data location register; breach notification procedure and records; data return and deletion procedures with evidence; access and encryption controls for PII; records of law enforcement disclosure requests; staff confidentiality agreements and training.
Assessors
An accredited ISO/IEC 27001 certification body that includes ISO/IEC 27018 in the audit scope and issues a certificate or statement referencing it. Accredited by National accreditation bodies (ANAB, UKAS and peers) under the certification body's ISO/IEC 27001 accreditation; practice for listing 27018 on certificates varies by body.
Public register of assessors: https://www.iafcertsearch.org/
No firm has claimed a ISO 27018 assessor listing yet. Claim yours →
Consultants
ISO 27001 and privacy consultancies add 27018 scope to an ISMS program: mapping processor obligations, drafting PII policies and customer terms, extending the risk assessment and Statement of Applicability, and preparing evidence. Usually a modest add-on to an ISO 27001 or ISO 27701 project.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.