Protecting personal data as a public cloud processor. The 2025 third edition replaced the 2019 version and realigned it to ISO 27002:2022.
What is ISO 27018?
ISO/IEC 27018 sets out controls for protecting personally identifiable information in public cloud services where the provider acts as a processor. It answers the question every enterprise buyer eventually asks a cloud vendor: what exactly do you do with our customers\u2019 personal data, and can anyone other than you confirm it.
The current edition is ISO/IEC 27018:2025, the third edition, which replaced the 2019 version. It has been realigned to the ISO 27002:2022 control set and adds an extended implementation guidance annex. Anyone quoting the 2019 edition as current, including a certification body or a competitor, is working from stale information.
Like ISO 27017, it is audited as an extension of an ISO 27001 ISMS rather than certified alone. The commercial case is straightforward: it converts a contractual promise about personal data into something a third party has tested, which shortens the privacy section of a security questionnaire considerably. It sits alongside ISO 27701 rather than replacing it, since 27701 covers the management system and 27018 covers the processor controls.
Compliance requirements
Processor-side obligations, most of which a customer will otherwise try to impose through the contract.
PII is processed only as the customer instructs, with any other use requiring their agreement rather than a clause buried in your terms.
Customer personal data is not used for your own marketing or advertising without express consent, which cannot be a condition of the service.
Legally binding requests for PII are recorded and, unless prohibited, the customer is told. Buyers ask about this more than any other control.
A documented policy for returning, transferring and securely disposing of PII, including at the end of the contract.
Disclosure of any sub-processors and the countries where PII may be processed, before the customer commits.
Prompt notification of any incident involving PII, with enough detail for the customer to meet their own regulatory clock.
The technical means for the customer to meet data subject requests, since the customer holds the obligation but you hold the data.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
ISO 27018 is audited as an extension of ISO 27001, so we confirm your ISMS is in place, or implement it concurrently, before adding the PII scope.
We map what personal data you process on behalf of customers, where it goes, and which sub-processors touch it.
We assess against the 2025 edition, not the 2019 one, and identify where your contracts promise more than your controls deliver.
Your compliance manager implements the processor controls, the disclosure register and the return and disposal policy.
We produce the sub-processor disclosure and responsibility documentation that answers the privacy section of a security questionnaire.
We manage the certification body, normally folding the scope into your existing ISO 27001 audit cycle.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone