ISO/IEC 27018:2019

Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

apartmentPublishing Organization:International Organization for Standardization (ISO)

Global Technology Services Finance & Banking Healthcare

Standard Introduction

ISO/IEC 27018:2019 is an active standard published by International Organization for Standardization (ISO). It is commonly used across Technology, Services, Finance & Banking, Healthcare and applies in Global.

Use this page to review the official documentation, current status, and the certification or assessment bodies most commonly associated with ISO/IEC 27018:2019.

privacy_tip

PII Processor Focus

Specifically designed for public cloud providers acting as PII processors — establishing controls for handling personal data on behalf of cloud customers (PII controllers).

do_not_disturb_on

No Secondary Use

Cloud providers must not process PII for advertising or marketing purposes unless expressly instructed by the cloud customer — a key protection against data monetization.

delete_forever

Data Deletion Guarantees

Requires cloud providers to have policies and procedures for the timely return, transfer, and secure disposal of PII when the service agreement ends.

list_alt Key Privacy Controls

Consent and choice for PII processing purposes
Purpose limitation — PII processed only as instructed
No use of PII for advertising or marketing without consent
Transparent sub-processor disclosure requirements
Data breach notification obligations to cloud customers
PII return, transfer, and secure disposal procedures
Geographic location disclosure for PII storage
Regular compliance auditing and verification

Who Needs to Comply?

groups

Public cloud service providers that process personally identifiable information on behalf of their customers. Also relevant for organizations evaluating cloud providers for PII processing compliance, particularly in regulated industries.

Key Requirements

Purpose Limitation

Process PII only for the purposes specified by the cloud service customer. Do not use PII for advertising, marketing, or any secondary purpose without explicit customer authorization.

Sub-Processor Transparency

Disclose all sub-processors involved in PII processing before engagement. Provide cloud customers with the ability to approve or object to sub-processor changes.

Breach Notification

Implement processes to notify cloud service customers without undue delay in the event of a data breach involving their PII. Provide sufficient information for customers to meet their own notification obligations.

Data Location and Transfer

Disclose the countries and geographic regions where PII may be stored or processed. Ensure international transfers comply with applicable legal frameworks and customer requirements.

Penalties & Enforcement

warning

No direct legal penalties — ISO/IEC 27018 is a voluntary code of practice. However, adherence demonstrates due diligence for GDPR, CCPA, and other privacy regulations. Cloud providers without ISO 27018 attestation may lose contracts with privacy-conscious customers.