ISO/IEC 27018

What is ISO/IEC 27018?

ISO/IEC 27018 is guidance for public cloud providers that process personal information on behalf of their customers, in the role privacy laws usually call a processor. It builds on the controls of ISO/IEC 27002 and adds guidance and controls that help a provider handle that personal information responsibly, openly and securely.

The third edition was published in August 2025. It replaced the 2019 edition, which ISO has withdrawn, so check that contracts and audit scopes refer to the current version.

What does it cover?

ISO describes the standard as helping cloud providers handle personal information responsibly, transparently and securely. Earlier editions set this out as commitments customers most often need from a provider that holds their customers’ or employees’ data, such as:

• processing personal information only for the customer’s purposes and on its instructions, and not using it for the provider’s own marketing;
• helping customers respond when individuals exercise their rights;
• telling customers about subcontractors and where data is processed;
• notifying customers of breaches involving their data;
• returning or securely deleting data when the contract ends;
• being open about any disclosure requests from authorities, where the law allows.

Check the 2025 edition for the exact controls it now contains.

Who uses it?

Cloud providers use it to show customers, often through a certification, that their service is designed for processing personal data. Customers who act as controllers use it to check that a provider can support their own legal duties.

Can you certify to it?

There is no separate certificate to ISO/IEC 27018 alone. Providers usually have it assessed as part of an ISO/IEC 27001 certification, with its controls included in the scope.

How does it relate to other frameworks?

ISO/IEC 27701 is the broader privacy management system standard, covering controllers as well as processors and any kind of processing, while ISO/IEC 27018 focuses on public cloud processors. Neither replaces data protection law such as the GDPR, but both help an organisation show how it meets processor duties in practice.