ISO 27018
International code of practice for protecting personally identifiable information in public clouds acting as PII processors.
ISO/IEC 27018, first published in 2014 and revised in 2019, is the ISO code of practice that extends ISO 27001 Annex A with cloud-PII-specific controls. It targets public cloud providers — SaaS, PaaS and IaaS — that process customer PII on behalf of their customers. ISO 27018 is not a standalone certification: it is audited as an overlay on an ISO 27001 engagement, with the certification body issuing both references. The additional controls focus on consent and choice, transparency, data minimisation, sub-processor flow-down, breach notification SLAs and the data subject rights that EU and GDPR-conscious buyers increasingly demand.
Examples
- →A B2B SaaS platform adds ISO 27018 to its ISO 27001 engagement to unblock EU procurement.
- →An IaaS provider publishes an ISO 27018-aligned sub-processor list with 30-day customer notification on changes.
Common mistakes
- ✗Treating ISO 27018 as a standalone certification. It is only issued alongside an ISO 27001 certificate.
- ✗Scoping ISO 27018 beyond PII processors — the standard is specifically for public cloud processors, not for every cloud workload.
How LowerPlane handles it
LowerPlane tags your ISO 27001 evidence against the ISO 27018 overlay controls so the same artefact (encryption, access logs, DPA templates) populates both Statements of Applicability. Combined audit, one engagement.