Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (Information security, cybersecurity and privacy protection), published by ISO and IEC
- Latest version
- ISO/IEC 27018:2025 (Edition 3), Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors. It replaces ISO/IEC 27018:2019, which is withdrawn.
- Effective
- 26 August 2025
- Official text
- www.iso.org ↗
What is ISO/IEC 27018?
ISO/IEC 27018, often searched as ISO 27018, is the international standard giving guidance on protecting personally identifiable information (PII) in public cloud services. ISO and IEC publish it through JTC 1/SC 27. It applies to public cloud providers acting as PII processors, and to organisations that evaluate cloud providers or outsource data processing.
The current version is ISO/IEC 27018:2025 (Edition 3), Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors. It replaces ISO/IEC 27018:2019, which is withdrawn. ISO's standard page holds the abstract.
The standard builds on ISO/IEC 27002. The purpose of ISO 27018, in ISO's words, is to help cloud providers meet their legal, contractual and ethical duties for PII. The full text is paid for, so this entry stays at the level of ISO's public summary and does not list the controls.
Why it matters
A customer hands you personal data to process in the cloud and asks how you protect it. "We are ISO 27001 certified" is a start, not the whole answer.
ISO/IEC 27018 fills that gap. It extends ISO/IEC 27002 with controls adapted for cloud-based PII processing, so a provider can point to a recognised control set written for exactly this role. For the customer, it gives a yardstick for judging a provider before signing.
ISO/IEC 27018 supports your UK GDPR duties. It does not prove them.
Who it applies to
Two groups use it: cloud providers that process personal data for their customers, and the customers who choose or check those providers. The 2019 edition said it suits any type or size of organisation that offers cloud processing as a PII processor under contract. Controllers may find the guidance useful too, but it does not cover the extra legal duties that fall on them.
ISO/IEC 27018 is voluntary guidance, not a regulation. A cloud provider follows it by choice, or because a customer contract asks for it.
It sits alongside ISO 27001, not in place of it. ISO describes ISO/IEC 27018 as adding to an ISO 27001 information security management system (ISMS), not as a management system standard of its own. The nearest Annex A control is A.5.34 Privacy and protection of PII.
The UK position
No UK law names ISO/IEC 27018. A UK firm meets it when it runs a public cloud service that processes personal data on behalf of customers, or when it buys from such a provider and wants a benchmark.
The UK regime behind it is the UK GDPR and the Data Protection Act 2018. A cloud provider acting as a processor must have a compliant contract with its controller and meet its own processor responsibilities, including security of processing. The ICO's guidance on contracts and liabilities between controllers and processors explains what the contract must include. The ICO notes that this guidance is under review because of the Data (Use and Access) Act.
A UK firm outside the cloud-processor role rarely meets ISO/IEC 27018 directly.
Key requirements
ISO's public pages describe the shape of the standard rather than its clauses. In outline, ISO/IEC 27018 provides:
- Control objectives, controls and guidelines for protecting PII in public cloud, in line with the privacy principles in ISO/IEC 29100 (as the 2019 edition's abstract states).
- A basis in ISO/IEC 27002. The cloud-specific PII controls extend the general information security controls rather than replacing them.
- Life-cycle coverage of PII handled by the provider: collection, storage, processing, transmission and deletion.
- A processor's viewpoint. The guidance is written for a provider acting on a customer's behalf, so it speaks to what the provider does with PII it does not own.
To see the controls themselves, read the standard. ISO's page shows only the abstract.
What changed in the 2025 edition
The 2025 edition updates the 2019 text in two ways that ISO states publicly:
- It is aligned with the updated ISO/IEC 27002:2022, for consistency across the standards.
- It adds a new Annex B of extended implementation guidance.
A cloud provider working from the 2019 edition should check its control references against ISO/IEC 27002:2022 and the current text.
Frequently asked questions
The purpose of ISO/IEC 27018 is to give public cloud providers that process personal data for customers one shared set of controls and guidelines for protecting it. ISO says it covers any PII a public cloud provider handles on a customer's behalf. That gives buyers a single yardstick to compare providers against, instead of each provider's own account of its safeguards.
ISO 27001 sets the requirements for an information security management system, and organisations are certified against it. ISO/IEC 27018 is guidelines, as its title says: cloud-specific PII controls that extend ISO/IEC 27002 and work inside a 27001-based ISMS. A cloud provider can hold ISO 27001 and use ISO 27018 to show how its controls protect the PII it processes for customers.
ISO/IEC 27017 gives information security controls for cloud services, for both cloud providers and their customers. ISO/IEC 27018 is narrower: it covers protecting personal data when a public cloud provider processes it as a PII processor. Both build on ISO/IEC 27002, so a provider can adopt the two together, using ISO 27017 for cloud security and ISO 27018 for the PII it holds for customers.
ISO's public pages do not say whether ISO/IEC 27018 can be certified on its own. Because it is guidance that works inside an ISO 27001-based ISMS, ask an accredited certification body whether it will assess ISO 27018 controls as part of, or alongside, your ISO 27001 audit, and how the result will appear on the certificate.
No. Under UK GDPR Article 28, a controller may use only processors that give sufficient guarantees of appropriate technical and organisational measures. ISO/IEC 27018 controls are evidence a controller can weigh in that test. They do not replace the written controller–processor contract, or the processor's own duties under UK GDPR that the ICO guidance sets out.