FREE CHECKLIST
ISO 27018 Compliance Checklist
The twelve-area ISO 27018 overlay checklist for cloud PII processors preparing a combined ISO 27001 + 27018 audit.
The 12 overlay areas
🧭
Scope and prerequisite
- ✓ISO 27001 certificate in place (or planned alongside)
- ✓ISMS scope covers the systems processing customer PII
- ✓Scope boundary defined for the ISO 27018 overlay
- ✓Statement of Applicability references 27018 controls
✍️
Consent and purpose
- ✓Customer DPA restricts PII processing to the contract purposes
- ✓No secondary use or profiling without customer instruction
- ✓Changes to processing purposes trigger customer notification
- ✓Marketing use of customer PII is explicitly off-limits
📉
Collection and minimisation
- ✓PII inventory per product line
- ✓Only the PII needed for the service is collected
- ✓Logs and temporary files scoped to purpose
- ✓Backups aligned to retention commitments
🕒
Retention and deletion
- ✓Retention schedule documented per PII category
- ✓Customer-triggered deletion flow is implemented
- ✓Deletion is proven to the customer on request
- ✓Backups age out in line with the retention schedule
📬
Transparency
- ✓Trust centre lists sub-processors and purposes
- ✓Data locations disclosed per product
- ✓Customer notified before new sub-processors are engaged
- ✓Customer notified before data moves to new regions
🤝
Sub-processor flow-down
- ✓Sub-processor register maintained and public
- ✓Contract clauses mirror ISO 27018 obligations downstream
- ✓Right-to-audit flow-down to sub-processors
- ✓30-day change notification process in place
🛟
Breach notification
- ✓Customer notification SLA documented in the DPA
- ✓Breach runbook includes customer-facing templates
- ✓Tabletop exercise run in the last 12 months
- ✓Lessons captured feed the next DPA review
🗺️
Data location
- ✓Data-location transparency statement published
- ✓Primary and backup regions listed per product
- ✓Region change triggers customer notification
- ✓Trust centre reflects live region posture
👤
Data subject support
- ✓Customer runbook for responding to access requests
- ✓Customer runbook for correction and deletion requests
- ✓Service workflow supports data subject requests end-to-end
- ✓Response SLA aligned to GDPR Article 15–22
🔐
Technical controls on PII systems
- ✓MFA on all accounts with access to PII systems
- ✓Encryption at rest for PII stores
- ✓TLS 1.2+ for every PII flow in transit
- ✓Access logs retained per DPA commitments
👩💼
Workforce
- ✓Confidentiality agreements signed before PII access
- ✓Role-based training on PII handling
- ✓Background checks where legally permitted
- ✓Access provisioned via SSO with least-privilege roles
🔁
Return and disposal
- ✓Contract-end return / disposal workflow documented
- ✓Secure disposal procedure for storage media
- ✓Customer gets a written confirmation of disposal
- ✓Disposal records retained for audit sampling
Prefer this as a PDF?
Download the full ISO 27018 checklist alongside the DPA clause pack for cloud PII processors.