ISO 27018: personal data in the cloud
ISO 27018 is the international guidance for public cloud providers that process personal data on behalf of their customers. In GDPR terms, the cloud provider is the processor and the customer is the controller. ISO 27018 adds privacy commitments to the security controls in ISO 27002. Examples are not using customer data for your own purposes, and reporting data breaches to the customer.
The current version is ISO/IEC 27018:2025, the third edition, published in August 2025 by ISO . It replaces the 2019 version and is aligned with ISO 27002:2022. Like ISO 27017, you usually have ISO 27018 assessed as an extension of your ISO 27001 certificate.
In short: ISO 27017 covers cloud security in general. ISO 27018 covers the personal data that a cloud provider stores and processes for its customers. Many providers have both assessed.
ISO 27018 at a glance
| Full name | ISO/IEC 27018:2025, code of practice for protection of personal data in public clouds acting as PII processors |
| Previous version | ISO/IEC 27018:2019 |
| For whom | Public cloud providers that process personal data on behalf of customers |
| Type of document | Guidance, not a standalone requirements standard |
| Can you get certified? | Not on its own. In practice as an extension of ISO 27001 |
| Related | ISO 27701 for a complete privacy management system |
What does ISO 27018 contain?
ISO 27018 has two layers. The first layer follows ISO 27002 and adds explanation for some of the controls, applied to personal data in the cloud. The second layer is an annex with an extensive set of controls for the cloud provider as processor. These controls are based on the privacy principles in ISO 29100.
In practice, they come down to commitments that you as a processor make to your customer and then keep:
| Topic | What you do as a cloud provider |
|---|---|
| Customer instructions | Process personal data only for the purpose the customer sets |
| No own use | Do not use customer data for marketing or advertising without consent |
| Rights of data subjects | Help the customer with access, correction and erasure |
| Sub-processors | Disclose which sub-processors you use and where |
| Data breaches | Inform the customer as quickly as possible of a breach |
| Requests from authorities | Inform the customer of requests for data, unless the law forbids it |
| Return and deletion | Return data and delete it at the end of the contract, including temporary files |
| Location | Record in which countries data can be stored |
Example: ISO 27018 translated into a data processing agreement
An HR software SaaS provider processes employee data for 400 employers. For ISO 27018, it includes the following commitments in its standard data processing agreement, for example:
| Commitment in the agreement | ISO 27018 topic | Evidence for the auditor |
|---|---|---|
| ”We process your data only to deliver the HR service.” | Customer instructions, no own use | Contract text, internal policy, no link with marketing tools |
| ”An up-to-date list of sub-processors is on our website.” | Sub-processors | Published list, procedure for changes |
| ”We report a data breach within 24 hours of discovery.” | Data breaches | Incident procedure, notification from a test or a real incident |
| ”After the contract ends, we delete your data within 30 days.” | Return and deletion | Deletion procedure, log of deletions |
The time limits in this example are the provider’s choices. ISO 27018 does not set a fixed time limit. For what the AVG requires for breach notification, see reporting a data breach.
How does ISO 27018 relate to the AVG?
ISO 27018 is not an AVG certificate. The AVG sets requirements for processors in Article 28, and ISO 27018 helps you make those requirements concrete and demonstrable. An auditor who assesses you against ISO 27018 does not judge whether you fully comply with the AVG.
For Dutch customers, this distinction matters. An ISO 27018 statement is a strong argument in a purchasing conversation, but your data processing agreement and your own AVG documentation are still required. You can read more about the link between security and privacy at AVG and ISO 27001.
ISO 27018 or ISO 27701?
Both cover personal data, but they differ in scope.
| ISO 27018 | ISO 27701 | |
|---|---|---|
| What is it? | Guidance with additional controls | Privacy information management system (PIMS) |
| For whom | Public cloud providers as processors | Any organisation, as processor or controller |
| Certificate | As an extension of ISO 27001 | Can be certified on its own since the 2025 version |
| When to choose | You are a cloud provider and customers ask about privacy in the cloud | You want your whole privacy approach certified |
If you want to go beyond the cloud, look at what ISO 27701 is.
What the auditor wants to see for ISO 27018
- Contracts and data processing agreements in which the ISO 27018 commitments appear.
- An up-to-date list of sub-processors and the procedure for informing customers of changes.
- An incident procedure with a step to inform customers.
- Evidence of deletion at the end of a contract, including back-ups and temporary files.
- A register of requests from authorities and how you handled them.
Common mistakes with ISO 27018
- Announcing ISO 27018 if you are not a public cloud provider. The standard is written for processors in the public cloud.
- Putting the commitments in the standard but not in the contract. The customer must find them in their agreement.
- Forgetting back-ups when deleting. Record how long data stays in back-ups.
- Continuing to show an old statement based on 2019 without knowing when your certification body will switch to 2025.
Frequently asked questions about ISO 27018
What has changed in ISO 27018:2025?
The main change is the alignment with ISO 27002:2022. The control numbers and the division into four themes now follow the new ISO 27002. If you still work with the 2019 version, mainly the numbering in your Statement of Applicability changes. Read the standard itself for the exact differences per control.
Does ISO 27018 apply to a private cloud?
The standard is written for public cloud providers. Many of its commitments, such as no own use of customer data and a list of sub-processors, also make sense for other forms of hosting. A certification body does assess ISO 27018 against the public cloud context it was written for.
Is ISO 27018 enough to comply with the AVG?
No. ISO 27018 helps you demonstrate your obligations as a processor, but it does not cover everything. A DPIA (data protection impact assessment) or a record of processing activities, for example, sits with your customer or within your own organisation, and is not part of ISO 27018.
Is ISO 27018 mandatory for cloud providers?
No, it is voluntary. It becomes a requirement when a customer includes it in its purchasing conditions or tender. So check what your most important customers ask for before you start.
More information
- ISO 27017: cloud security in general
- What is ISO 27002?: the basis for ISO 27018
- Processors and controllers: who is who
- ISO 27001 for SaaS companies: why customers ask for certificates