ISO 27018 Requirements Explained

ISO 27018 is the code of practice for protecting personally identifiable information in public clouds. Here is the overlay — twelve requirement areas layered on top of ISO 27001 Annex A — and what each one asks for in evidence.

Scoping first

ISO 27018 is not a standalone certification. Before you touch any overlay control, confirm the scope and the ISMS prerequisite.

Scope boundary

ISO 27018 applies to the parts of your platform that act as a cloud PII processor. Define the boundary — product lines, systems, data stores — before Stage 1.

Prerequisite ISMS

ISO 27018 cannot be issued without ISO 27001. Build or confirm the ISMS first, then layer 27018 on the same scope.

Customer vs sub-processor PII

The standard governs customer PII. Employee PII and business-contact PII fall outside — handle those under your general privacy programme.

DPA alignment

Your Data Processing Agreement template is the primary artefact ISO 27018 asks about. Lead with it, not with policies.

The 12 overlay requirement areas

ISO 27018 extends the ISO 27001 Annex A controls with cloud-PII-specific obligations. The auditor samples your ISMS evidence against these areas during the Stage 2 audit.

✍️

Consent and choice

PII processed only per the customer contract. No secondary use, no profiling without the customer’s instruction.

🔎

Purpose legitimacy

Document the specific purposes for which PII is processed. Changes require customer notification.

📉

Collection and minimisation

Collect only the PII required to deliver the service. Scope temporary files, logs and backups to purpose.

🕒

Retention and deletion

Retain PII only as long as the contract permits. Customer-triggered deletion is supported and provable.

📬

Transparency

Publish what customer PII is processed, which sub-processors are used, and where data may be located.

🤝

Sub-processor flow-down

Every sub-processor is bound to the same obligations. Notify customers before engaging new sub-processors.

🛟

Breach notification SLA

Document the customer notification timing and content. Rehearsed and measurable.

🗺️

Data location

Disclose storage and processing locations. Notify customers before transferring to new regions.

👤

Data subject support

Help customer controllers respond to access, correction and deletion requests from data subjects.

🔐

Strong technical controls

Access control, MFA, encryption at rest and in transit, logging — the baseline ISMS controls, tightened for PII.

👩‍💼

Workforce controls

Confidentiality agreements, training on PII handling, background checks where legally permitted.

🔁

Return and disposal

At contract end, return or securely dispose of customer PII and prove it to the customer.

How ISO 27018 overlays ISO 27001

Think of ISO 27018 as a lens on your ISMS, not a parallel system. Every 27018 requirement maps back to one or more Annex A controls:

Policies and governance — your Information Security Policy references 27018 obligations.
Access control, encryption, logging — the same technical controls, with sampling focused on systems handling customer PII.
Supplier relationships — your sub-processor register and contract clauses are the single most inspected artefact.
Incident management — your runbook adds the customer breach-notification SLA.
Compliance review — your SoA references 27018 controls with evidence pointers.

The Data Processing Agreement

The customer DPA is the primary artefact ISO 27018 asks about. The auditor will trace clauses in the DPA back to controls in the ISMS. A good 27018-aligned DPA covers:

Purposes for which customer PII may be processed, and the customer-driven instruction model.
Sub-processor list with 30-day notification process for additions and changes.
Breach notification SLA (hours or days) with the content commitments.
Data location disclosure and the mechanism for notifying customers of changes.
Return and disposal of customer PII at contract end.
Audit cooperation — scope and frequency of customer-initiated audits.

What the auditor will sample

Stage 2 is evidence sampling. Expect the auditor to walk:

The DPA template plus one or two signed customer contracts.
The sub-processor register and the latest customer notification record.
Access logs covering PII systems for a sampled quarter.
Encryption posture for one PII store at rest and one PII flow in transit.
Breach runbook with the most recent tabletop or incident record.
Data-location transparency statement, including any recent region change.
Customer deletion / return workflow — pick one closed customer account and walk the deletion evidence.

Relationship to GDPR and ISO 27701

If you are a controller (not just a processor), ISO 27701 is a stronger fit — it covers controller obligations end-to-end. If you are a pure cloud processor, ISO 27018 is lighter weight and audits with your existing ISMS. GDPR is the law behind both; ISO 27018 and ISO 27701 are the audit frameworks that help you demonstrate GDPR processor obligations in evidence.

Frequently asked questions

Is ISO 27018 a certification?

Not on its own. ISO 27018 is a code of practice. Certification bodies issue it alongside an ISO 27001 certificate — the auditor samples your ISMS against ISO 27001 and the 27018 overlay in the same engagement.

Who does ISO 27018 apply to?

Public cloud providers acting as PII processors on behalf of their customers. SaaS, PaaS and IaaS all qualify when the customer-owned data they process includes personally identifiable information.

How does ISO 27018 relate to GDPR?

ISO 27018 operationalises many of the GDPR processor obligations under Article 28 — sub-processor flow-down, transparency, data location, breach notification, data subject support. GDPR is the law; ISO 27018 is the audit-friendly way to demonstrate parts of it.

How does ISO 27018 relate to ISO 27701?

ISO 27701 is a broader privacy information management system (PIMS) covering both controllers and processors. ISO 27018 is narrower — processors only, cloud only. Teams needing controller obligations typically pick 27701; teams narrowly focused on cloud-processor obligations pick 27018.

Does ISO 27018 require specific data-location commitments?

Yes. The code of practice requires you to disclose the countries where customer PII may be stored or processed, and to notify customers before changes. Many providers publish this on their trust centre.