ISO/IEC 27018 is the international code of practice for protecting personally identifiable information (PII) in public clouds when the provider is acting as a PII processor on behalf of customers. The current edition is 27018:2025, which superseded the 2019 version. It works as a layered extension on top of ISO 27001 plus 27002 and is built around the privacy principles of ISO/IEC 29100.
What does ISO 27018 actually require of a cloud provider?
The standard adds PII-processor-specific guidance to 27002 controls plus an annex of public-cloud privacy controls covering consent and audit rights.
The annex covers obligations like processing PII only on documented customer instructions, returning or deleting PII at contract end, disclosing sub-processor identities, and notifying the customer of any law-enforcement disclosure request (ISO). The 2025 edition retitles the standard as "Guidelines for protection of PII" and aligns clause numbering to 27002:2022.
How is ISO 27018 different from ISO 27701?
ISO 27018 is a cloud-only PII-processor code of practice; ISO 27701 is a full Privacy Information Management System covering the whole organization.
In practice, a multi-tenant SaaS holds 27018 as part of a combined ISO 27001 + ISO 27017 + 27018 cloud certificate, and adds ISO 27701 only when the privacy program covers offline data, employee data, and processes outside the cloud product (ISO 27701). The two are complementary, not alternatives.
Why does ISO 27018 keep showing up in EU vendor reviews?
EU buyers reading the GDPR Article 28 processor checklist want a third-party-audited artifact that maps cleanly to their controller obligations.
Most teams selling SaaS into EU healthcare, financial services, or public sector find 27018 on the standard checklist alongside GDPR controls and a SOC 2 Type 2. Carrying it cuts back-and-forth on Article 28 DPA negotiation, which is the slowest stage of most EU deals.
Related terms
These adjacent terms cover the base ISMS, the broader privacy standard, and the GDPR contract artifacts that travel with a 27018 certificate.