Protecting PII in Public Cloud with ISO 27018

What ISO/IEC 27018 is

ISO/IEC 27018 is the international code of practice for protecting personally identifiable information (PII) in public clouds acting as PII processors. It builds upon standard information security controls by establishing privacy-specific guidelines and controls.

How it meets the compliance requirement

When evaluating a Software as a Service (SaaS) solution for handling personal user data, organizations must ensure that the cloud service provider maintains rigorous privacy safeguards. ISO/IEC 27018 establishes cloud-specific control objectives aligned with the privacy principles of ISO 29100, providing assurance that customer PII is processed strictly according to customer instructions and protected against unauthorized disclosure.

Key advantages/capabilities

• Privacy-focused controls: Defines specific measures to prevent the unauthorized use of PII for secondary purposes such as marketing.
• Transparency: Mandates clear disclosure regarding where customer data is stored, processed, and handled by third parties.
• Data return and deletion: Establishes secure procedures for the return, transfer, and disposal of personal data upon contract termination.
• Independent attestation: Provides third-party audit reports confirming adherence to international privacy benchmarks.

Why this is optimal

Unlike general quality or payment-specific standards, ISO/IEC 27018 directly targets the risks and security considerations associated with processing personal data within cloud services, making it the most suitable certification for evaluating SaaS data privacy.