ISO 27018

Overview

ISO/IEC 27018 establishes commonly accepted control objectives, controls, and guidelines for protecting Personally Identifiable Information (PII) in public cloud computing environments. It builds on ISO 27002 with cloud-specific privacy controls addressing data location, sub-processor transparency, government access disclosure, and data portability. CodeMiners applies ISO 27018 controls to all cloud-hosted client environments.

Governing Body

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

Scope of Certification

Applies to organizations that process PII in public cloud environments. Covers data location transparency, notification of government access requests, data portability and deletion, sub-processor controls, and marketing consent requirements.

Audit and Assessment Process

Assessed as part of the ISO 27001 audit cycle with additional verification of cloud-specific PII controls. Auditors verify implementation of data processing agreements, sub-processor inventories, data location documentation, and PII handling procedures.

Key Requirements

1. Transparency about data processing locations and sub-processors
2. Purpose limitation for PII processing
3. Data portability and deletion on contract termination
4. Notification of government access requests
5. Prohibition of PII use for marketing without explicit consent
6. Encryption of PII in transit and at rest in cloud environments

Compliance Entitlements

• Cloud-specific PII protection controls beyond ISO 27001
• Addresses data location, transfer, and sub-processor transparency
• Supports cloud customer privacy compliance requirements
• Establishes trust for clients with cloud-hosted personal data

Client Benefits

• Provides assurance that PII is protected specifically in cloud hosting environments
• Addresses cloud-specific privacy risks that ISO 27001 alone does not cover
• Simplifies client compliance with cloud data protection requirements

Related Certifications