ISO/IEC 27018:2025

Overview

ISO/IEC 27018:2025 is an international standard that provides guidelines for protecting personally identifiable information (PII) when processed in public cloud environments by organizations acting as PII processors. It aligns privacy principles from ISO/IEC 29100 with information security controls based on ISO/IEC 27002:2022, and is applicable to public and private companies, government entities and not‑for‑profits of all sizes that provide cloud‑based information processing services. The guidance is also relevant to organizations acting as PII controllers who contract cloud providers.

Key topics and technical requirements

The standard organizes controls into practical domains and highlights control objectives and guidelines tailored to public cloud processing of PII. Major topics include:

• Organizational controls: policies, roles and responsibilities, segregation of duties, supplier and contract management, regulatory and contractual compliance, and privacy governance.
• People controls: staff screening, confidentiality agreements, training, remote working and incident reporting.
• Physical controls: data centre perimeters, secure areas, equipment siting, media handling and secure disposal.
• Technological controls: access control, identity management, privileged access, secure authentication, encryption/cryptographic use, data deletion, data masking, data leakage prevention (DLP), logging, monitoring and vulnerability management.
• Cloud‑specific considerations: security of cloud services, ICT supply chain management, cloud incident response, PII processing agreements and multi‑tenant risk mitigation.
• Operational resilience: backups, redundancy, business continuity and evidence collection for investigations.

The document specifies control layout and implementation guidance rather than prescriptive technical settings, enabling organizations to adopt measures consistent with their risk environment.

Practical applications - who should use it

ISO/IEC 27018:2025 is intended for:

• Cloud service providers (CSPs) and managed service providers acting as PII processors.
• Security architects, privacy officers and compliance teams designing cloud controls and contractual clauses.
• Procurement and legal teams drafting cloud service agreements that address PII protection.
• Auditors and assessors evaluating cloud privacy controls against internationally accepted guidelines.

Adoption helps demonstrate compliance with privacy requirements, reduce regulatory risk, strengthen customer trust, and provide a consistent framework for contractual obligations and third‑party assessments.

Related standards

• ISO/IEC 27002:2022 - information security controls guidance referenced by 27018.
• ISO/IEC 29100 - privacy framework and privacy principles used as the foundation for PII protection guidance.

Keywords: ISO/IEC 27018:2025, PII protection, public cloud, cloud privacy, cloud security, ISO/IEC 27002, ISO/IEC 29100, PII processors, data protection, cloud service providers.