Sign in

ISO 27018

ISO/IEC 27018 Protection of PII in Public Clouds — ISO/IEC JTC 1/SC 27

Also known as: ISO/IEC 27018, ISO 27018:2025, ISO 27018:2019, ISO IEC 27018

Official site Official change log Subscribe to ISO 27018 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
ISO/IEC 27018:2025
Published 26 August 2025. source
Status
In force
Next deadline
None announced
Who must comply
Organizations of all types and sizes that process personal data (PII) as processors in a public cloud under contract to other organizations. source
How it is assessed
In Italy, assessed as an extension of an ISO/IEC 27001 certification, with extra audit time, rather than with a separate certificate. source
Written by
Published jointly by ISO and IEC (committee ISO/IEC JTC 1/SC 27) as voluntary guidance. source source
Enforced by
A voluntary standard; it sets no contractual, legal or statutory requirements. source
Last change
None recorded yet

Guidelines for protecting personally identifiable information in public clouds, addressed to cloud providers acting as processors of that information.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. ISO/IEC 27018:2025 is published and the 2019 edition is withdrawn

Version history

  1. ISO/IEC 27018:2025 Major versionCurrent

    Third edition, with guidelines based on ISO/IEC 27002:2022 and a title changed from "Code of practice" to "Guidelines". source

  2. ISO/IEC 27018:2019 Major version

    Second edition; withdrawn on 26 August 2025. source

  3. ISO/IEC 27018:2014 Major version

    First edition. source

Who it applies to

Public cloud providers that act as processors of personal data. It is voluntary guidance that some public buyers require.

Who it is for
Public and private companies, government entities and not-for-profits that provide information processing services as PII processors via cloud computing under contract. source
Controllers
The guidelines can also be relevant to organizations acting as PII controllers. source
Basis
Control objectives, controls and guidelines in line with the privacy principles of ISO/IEC 29100, taking into account regulatory requirements for PII protection. source
Legal status
ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source
Italy, public sector
Italy's cybersecurity agency (ACN) requires ISO/IEC 27001 certification with the ISO/IEC 27017 and 27018 extensions from IT services sold to public bodies through the central marketplace. source

How compliance is assessed

In Italy, assessed as an extension of an ISO/IEC 27001 certification, with extra audit time, rather than with a separate certificate.

Extension
Clarifications issued in mid-2025 in Italy stated that ISO/IEC 27017 and 27018 are ISO/IEC 27001 extensions and certification bodies should not issue specific certificates for them. source
Audit time in Italy
Accredia, Italy's accreditation body, requires one extra audit day for each extension and each certification phase. source

Enforcement and penalties

A voluntary standard; it sets no contractual, legal or statutory requirements.

Legal force
ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

Documents

  1. Standard ISO/IEC 27018:2025 (catalogue entry; paid standard)
  2. Standard ISO/IEC 27018:2019 (withdrawn edition, catalogue entry)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to ISO 27018 (RSS)