ISO/IEC 27018 · PII IN THE CLOUD
ISO 27018: prove you protect personal data in the cloud
Add privacy controls for personal data to your ISO 27001 ISMS and give customers confidence in how you process their users' data.
What is ISO 27018?
ISO/IEC 27018 is a code of practice for protecting personally identifiable information (PII) in public clouds where the provider acts as a PII processor. It extends ISO 27001 and ISO 27002 with privacy controls on consent, purpose limitation, transparency, return and deletion of data, and disclosure of sub-processors.
Your customers are trusting you with their users' data.
When you process personal data for customers in the cloud, they need proof that you only use it as instructed, tell them about sub-processors, and delete it when asked. ISO 27018 gives that proof in a form auditors and enterprise buyers recognise.
Clear processor commitments customers can rely on
Controls that support DPDP Act and GDPR processor duties
Assessed alongside your ISO 27001 audit
What our ISO 27018 service covers
PII inventory
What personal data you process, where and why.
Consent & purpose
Processing only on customer instructions.
Transparency
Sub-processor list and location disclosures.
Return & deletion
Data return and secure deletion procedures.
Breach notification
Processes to notify customers of PII incidents.
Audit support
Assessment with your ISO 27001 certification.
How we get you there
Data mapping
Find and classify PII across systems.
Gap assessment
Against ISO 27018 controls.
Implement
Privacy controls, contracts and procedures.
Evidence
Records of processing and deletion.
Audit
Assessment with ISO 27001.
ISO 27018 vs ISO 27701 vs DPDP Act
| Dimension | ISO 27018 | ISO 27701 | DPDP Act, 2023 |
|---|---|---|---|
| What it is | Cloud PII code of practice | Privacy information management system | Indian data protection law |
| Who it's for | Public cloud PII processors | Controllers and processors | Data fiduciaries and processors in India |
| Mandatory? | Voluntary | Voluntary | Yes, by law |
Note: ISO 27018 supports, but does not replace, legal compliance with the DPDP Act or GDPR.
What you get
Who needs ISO 27018?
SaaS providers processing customer users' data
HR, health, fintech and ed-tech platforms
Companies serving EU or enterprise customers
Cloud providers already ISO 27001 certified
Why teams choose HostX for ISO 27018
Privacy + security
One team for both.
Practical
Controls your engineers can run.
DPDP-aware
Aligned with Indian law expectations.
Tracked
Live in the Compliance Tool.
Related services
Frequently asked questions
Show customers their users' data is safe with you.
Book a consultation to add ISO 27018 to your ISO 27001 scope.