Compliance Assessment
ISO/IEC 27018:2019 Implementation
Implementing the ISO/IEC 27018 code of practice for protecting personally identifiable information (PII) processed in public cloud services.
- Area
- Compliance Services
- Covers
- ISO 27018, PII, Cloud privacy
What an ISO/IEC 27018 implementation covers
ISO/IEC 27018:2019 sets out controls for public cloud providers that process PII on behalf of their customers. It extends ISO/IEC 27001 and 27002 with privacy-specific requirements.
What you get
What the engagement leaves you with.
Evidence of PII protection that enterprise and regulated customers ask for
A documented split of privacy controls between cloud provider and customer
Controls designed for distributed, multi-tenant cloud environments
One compliance program combined with your ISO/IEC 27001 ISMS
Frequently asked questions
What is ISO/IEC 27018:2019?
ISO/IEC 27018:2019 is an international standard that provides guidelines for protecting personally identifiable information (PII) in public cloud computing environments. It establishes a framework of controls specifically addressing the privacy requirements of cloud service providers acting as PII processors.
Is ISO/IEC 27018:2019 certification mandatory?
No, it is not legally required. Certification gives independent verification of your cloud privacy practices, and many enterprise customers now ask their cloud providers for ISO/IEC 27018:2019 certification or compliance.
What's the difference between ISO/IEC 27018:2019 and ISO/IEC 27701?
Both address privacy. ISO/IEC 27018:2019 covers public cloud providers that process PII. ISO/IEC 27701 defines a broader privacy information management system for both controllers and processors in any environment, not only the cloud.
What are the key requirements of ISO/IEC 27018:2019?
Key requirements include: transparent PII processing, disclosure of subcontractors, data breach notification processes, restrictions on marketing use of PII, data deletion protocols, geographic restrictions on data storage, and clear documentation of privacy responsibilities between providers and customers.
Related services
Request a quote for ISO/IEC 27018
Tell us about your cloud service and the PII it processes, and we will scope the gap analysis and implementation.