hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Implementation walkthrough

How to implement ISO/IEC 27018: video walkthrough

A walkthrough of implementing ISO/IEC 27018 protections for personal data processed in the public cloud, for providers acting as PII processors.

  • Implementation walkthrough
  • 3 min 15 s

Key takeaways

  • ISO/IEC 27018 applies when a cloud provider processes personal data as a PII processor.
  • The customer remains the PII controller.
  • Annex A adds controls built on the ISO/IEC 29100 privacy principles.
  • Controls cover purpose, data location, sub-processors, return and erasure, and breach notice.
  • It is assessed alongside the ISO/IEC 27001 audit, not certified on its own.

Protecting customers' personal data in the public cloud

ISO/IEC 27018 is the international guidelines standard for protecting personally identifiable information in the public cloud when the cloud service provider acts as a PII processor: it processes personal data on behalf of, and on the instructions of, the customer, who remains the PII controller. It is the standard a customer's privacy office names when it wants to know whether the service holding its people's data runs to a recognised control set.

It extends ISO/IEC 27002 in two ways: cloud PII guidance added to the controls where a processor needs more, and an extended control set of its own in Annex A, organised around the ISO/IEC 29100 privacy principles. This short film walks through how a cloud provider implements it.

Implementation inside an ISO/IEC 27001 system

Define the cloud services, roles and customers the certificate must cover: which services process personal data as a processor, and for which customers. The relevant controls are then selected in the ISO/IEC 27001 risk treatment and recorded in the Statement of Applicability, or committed to customers in contracts; once selected or promised, they are what the certification body assesses.

The controls answer the questions cloud buyers ask: the purpose for which data is processed, data location, the use of sub-processors, the return and erasure of data at the end of a contract, and notice of breaches and of legally binding requests for disclosure. Policies, procedures and records are put in place, people are trained and evidence builds up as the service runs. Because ISO/IEC 27018 is guidance for controls inside an ISMS, the certificate that carries it is an ISO/IEC 27001 certificate: an accredited certification body audits the system, assesses the selected ISO/IEC 27018 controls in the same programme and records them on the certificate scope, a supplementary certificate or a statement of verification.

Sterling's expert and experienced consultants design and implement the controls with your teams under Sterling OS™. The current edition is ISO/IEC 27018:2025, aligned with ISO/IEC 27002:2022.

ISO/IEC 27018 at a glance

Purpose
Protecting the personally identifiable information (PII) a public cloud service processes for its customers: ISO/IEC 27002 controls with cloud guidance, plus an extended control set built on the ISO/IEC 29100 privacy principles
Relevant to
SaaS, hosting, cloud storage and backup, platform and managed service providers: any organisation processing personal data in the public cloud under contract, as a PII processor
Edition
ISO/IEC 27018:2025, third edition, published August 2025 and aligned with ISO/IEC 27002:2022; the 2019 edition is withdrawn
Certification
Guidelines, not a management system standard: assessed alongside your ISO/IEC 27001 audit by an independent certification body and recorded on the certificate scope, a supplementary certificate or a statement of verification
Sterling's role
Consulting with your team, Effivity, training, vulnerability assessment, internal audit and readiness, then Sustain™
Cost and timing
Total investment for ISO/IEC 27018 cloud privacy controls depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 2 to 5 months alongside an existing ISO/IEC 27001 system, or 4 to 8 months when both are built together

ISO/IEC 27018: the complete guide →

ISO/IEC 27018: questions people ask

Can we be certified to ISO/IEC 27018 on its own, or do we need ISO/IEC 27001?

Not on its own. ISO/IEC 27018 is a guidelines standard with no management system requirements, a reference for selecting PII protection controls inside an ISMS based on ISO/IEC 27001. Certification bodies assess its controls alongside the ISO/IEC 27001 audit and record the result on the certificate scope, on a supplementary certificate or in a statement of verification; some treat an ISO/IEC 27001 certificate as a prerequisite, and some also ask for the ISO/IEC 27017 cloud controls in the same audit. If you are already certified, the controls are added at the next surveillance or recertification audit or in a separate visit; if you hold neither, both are built together and assessed in the same Stage 1 and Stage 2.

What is the difference between ISO/IEC 27018 and ISO/IEC 27701?

ISO/IEC 27701:2025 is a certifiable management system standard for privacy, for PII controllers and processors of any kind. ISO/IEC 27018 is a control set for one role, the public cloud PII processor, applied inside an ISMS. A cloud provider often holds both: ISO/IEC 27018 answers the cloud contract; ISO/IEC 27701 governs privacy as a management system across everything it does.

And the difference between ISO/IEC 27018 and ISO/IEC 27017?

ISO/IEC 27017:2026 adds cloud-specific information security guidance and controls for cloud service customers and providers; ISO/IEC 27018 adds guidance and controls for the personal data a provider processes for its customers. They complement each other, many providers implement both, and some certification bodies assess them together.

Our platform runs on a hyperscaler that is itself ISO/IEC 27018 certified. Does that cover us?

No. Their record covers their services as a processor to you. Your customers contract with you, so the purpose, access, deletion, disclosure and notification controls for their data are yours to operate, and the hyperscaler is a sub-processor you disclose. You can rely on their assessed controls for the parts of the stack they run.

Does ISO/IEC 27018 make us GDPR compliant?

No standard does. ISO/IEC 27018 gives a recognised, independently assessed way to evidence the guarantees a controller must obtain from its processors: processing on instructions, sub-processor control, security, deletion or return of data and breach notification. Legal compliance remains a matter for your advisers; the record issued is not a compliance mark.

More ISO/IEC 27018 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on ISO/IEC 27018

Start with the ISO/IEC 27018 page, or go straight to the guide you need.

On the ISO/IEC 27018 page

Often combined with ISO/IEC 27018

More videos: Information security, cyber and cloud

All videos

Talk to a consultant

Plan your ISO/IEC 27018 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice