ISO/IEC 27018 · Protection of PII in public clouds acting as PII processors
ISO/IEC 27018 certification consulting for cloud privacy your customers can write into the contract.
Add the ISO/IEC 27018 cloud privacy controls to an ISO/IEC 27001 system assessed by an independent, accredited certification body, so the personal data you process for customers is protected by controls they can name in the contract and check at the audit. Sterling's expert and experienced consultants build the controls with your engineering, security and legal teams, prepare the evidence and stay with you through the assessment and the surveillance audits that follow, in 60+ countries. We ensure successful certification for our clients.
- One all-inclusive proposal for a defined scope: consulting, Effivity software, Sterling Academy access, vulnerability assessment and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cloud privacy consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO/IEC 27018 client experience
What it is
What is ISO/IEC 27018 and what is it used for?
ISO/IEC 27018 is the international guidelines standard for protecting personally identifiable information (PII) in the public cloud when the cloud service provider acts as a PII processor: it processes personal data on behalf of, and on the instructions of, the customer, who remains the PII controller. It is the standard a customer's privacy office names when it wants to know whether the service holding its people's data runs to a recognised control set.
It extends ISO/IEC 27002 in two ways: cloud PII guidance added to the ISO/IEC 27002 controls where a processor needs more, and an extended control set of its own in Annex A, organised in line with the privacy principles of ISO/IEC 29100. Those controls answer what cloud buyers ask: purpose, data location, sub-processors, return and erasure, and notice of breaches and legally binding disclosure requests. The standard has no management system requirements of its own; it is a reference for selecting controls inside an ISMS based on ISO/IEC 27001, and it is assessed alongside that ISMS.
Current edition. ISO/IEC 27018:2025, the third edition, was published in August 2025 and cancels and replaces ISO/IEC 27018:2019, withdrawn from 26 August 2025. Its text is aligned with ISO/IEC 27002:2022, so clauses 5 to 8 follow the 93 controls of that edition in four themes, and a new Annex B gives the correspondence with the 2019 edition; the title changed from "code of practice" to "guidelines". Because the standard is guidance there is no transition arrangement of the ISO/IEC 27001:2022 kind: certification bodies apply the 2025 edition under their own rules, so if your certificate references 2019, agree the update at your next audit.
Who it is for
Who needs ISO/IEC 27018 certification?
ISO/IEC 27018 applies to organisations of every type and size that provide information processing services as PII processors through cloud computing under contract to other organisations: SaaS, hosting and platform providers, cloud storage and backup services, managed service providers and outsourcers. Four situations bring them to Sterling:
- A customer's data processing agreement or vendor assessment asks for it. Enterprise and public-sector buyers list ISO/IEC 27018 beside ISO/IEC 27001 in cloud procurement, and their privacy teams check that the certificate scope names the service they are buying.
- You are the processor; your customers are controllers who answer to a regulator. Under the EU GDPR, for example, a controller may use only processors that give sufficient guarantees, under a contract covering instructions, security, sub-processors, deletion or return of the data and audits, and a processor must notify the controller of a personal data breach without undue delay. The ISO/IEC 27018 controls are the practical way to give and prove those guarantees.
- You hold ISO/IEC 27001, and it no longer closes cloud deals on its own. Buyers ask where the data is stored, who the sub-processors are and how deletion is proved. The ISMS certificate answers the security question; the ISO/IEC 27018 controls answer the privacy questions in the same audit.
- You want one programme for security, cloud and privacy assurance. ISO/IEC 27018, the cloud security controls of ISO/IEC 27017, the privacy management system of ISO/IEC 27701 and the privacy criteria of SOC 2 overlap heavily. We help you choose the combination and build one evidence base.
Business benefits
How ISO/IEC 27018 protects personal data and wins cloud contracts
The controls are worth implementing for what they change in the service and the sales cycle, not for a line on a certificate. We start from what would actually hurt a cloud provider: data used for the wrong purpose, an undisclosed sub-processor, a deletion promise the platform cannot keep.
- Contracts signed fasterData location, sub-processor, deletion and breach clauses answered from controls that exist, so the data processing agreement is not negotiated from scratch each time.
- Answers to the questions cloud buyers askWhere the data is, who touches it, what it is used for and how it comes back: documented, evidenced and assessed.
- Fewer PII incidents and a rehearsed responsePurpose limitation, access, encryption and secure erasure by design, and breach notification tested before it is needed.
- Clear roles between you and your customersProcessor and controller responsibilities written down per service, so nobody assumes the other side is handling consent, retention or requests.
- One evidence base with ISO/IEC 27001The same risk register, Statement of Applicability, internal audit and management review carry the cloud privacy controls; no second system.
- A base for ISO/IEC 27701, ISO/IEC 27017 and SOC 2The processor controls map onto the privacy management system, the cloud security controls and the SOC 2 privacy criteria.
Requirements
What are the main ISO/IEC 27018 requirements?
ISO/IEC 27018 is a guidelines standard: every part of it, including Annex A, is guidance. What becomes a requirement is what you commit to: once a control is selected in your ISO/IEC 27001 risk treatment and recorded in the Statement of Applicability, or promised to a customer in a contract, the certification body assesses whether it exists and works. The tables are a plain-language guide; the programme works from the standard's own wording.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 4 Overview | The structure and the control layout: the ISO/IEC 27002 control, the cloud PII guidance added to it, and the extended controls in Annex A | A statement of which services process PII as a processor, for which customers, and which controls apply |
| 5 Organisational controls | The 37 organisational controls of ISO/IEC 27002:2022 with cloud PII guidance where needed: policies and roles, supplier and cloud service relationships, incidents, legal and contractual requirements, privacy and protection of PII | A PII protection policy, processor roles named, customer and sub-processor contracts aligned, a PII incident process that reaches the customer, a register of laws and contracts per service |
| 6 People controls | The 8 people controls: screening, terms of employment, awareness, discipline, leavers, confidentiality agreements, remote working and event reporting, for staff who can reach customer PII | Confidentiality undertakings for everyone with tenant access, PII awareness records, leavers removed from customer environments at once |
| 7 Physical controls | The 14 physical controls: perimeters, entry, secure areas, storage media, maintenance and secure disposal or re-use, for the facilities and media that hold customer PII | Data centre and office access records, media handling rules, evidence that retired equipment and media are erased or destroyed |
| 8 Technological controls | The 34 technological controls: privileged access, authentication, information deletion, data masking, backup, logging, cryptography, secure development and test information, with cloud PII guidance where it matters | Encryption of PII in transit and at rest, deletion per tenant, logs of who accessed customer data, production PII kept out of test systems |
| Annex A Extended control set | The public cloud PII processor extended control set for PII protection, organised in line with the ISO/IEC 29100 privacy principles | The commitments in the table below, each with an owner, evidence and a place in the Statement of Applicability |
| Annex B Correspondence | The correspondence between the 2025 and 2019 editions | Used to update a Statement of Applicability or contract written against the 2019 edition |
Annex A: what the extended control set covers
| Theme | What the customer is entitled to | What the processor has to operate |
|---|---|---|
| Purpose and cooperation with the controller | PII processed only for the contracted service on the customer's instructions; no marketing or advertising use without explicit consent, never a condition of the service | Instructions captured per contract, a purpose register per service |
| Rights of the people the data concerns | The tools and cooperation the customer needs to answer access, correction and erasure requests in time | Procedures to locate, export, correct and delete an individual's PII on request |
| Retention, return and erasure | Return, transfer or secure disposal of PII within a reasonable period when the contract ends; temporary files erased securely | Deletion timelines per data type, erasure that reaches replicas and backups, and deletion evidence |
| Openness, transparency and notice | Disclosure of the countries where PII may be stored, of the sub-processors that handle it and of legally binding disclosure requests, unless the law prohibits it | A published sub-processor list with change notices, a data location statement, a legal request procedure |
| Accountability and breach notification | Prompt notification of a PII breach, records of what happened and independent review at planned intervals | A PII breach procedure with notification times, incident records, internal audit |
| PII security and sub-contracted processing | Additional PII safeguards beyond ISO/IEC 27002, and sub-contracted processing under the customer's obligations | PII-specific encryption and access restrictions, media handling rules, sub-processor contracts that carry the customer's terms |
What does useful ISO/IEC 27018 evidence look like?
A per-service map of which PII is processed for which customer and where; the Statement of Applicability showing the Annex A controls beside the ISO/IEC 27001 controls; a purpose and instruction register tied to contracts; the sub-processor list and its change notices; the data location statement; deletion records with timestamps; access logs for customer environments; PII breach records with the notification sent; internal audit reports and management review minutes. We identify the records your controls genuinely produce, and they live in Effivity from the first workshop.
ISO/IEC 27018 controls and the Annex A extended control set explainedCertification process
How do you get ISO/IEC 27018 certified?
Because ISO/IEC 27018 is guidance for controls inside an ISMS, the certificate that carries it is an ISO/IEC 27001 certificate. The independent certification body, accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1, audits the management system, assesses the ISO/IEC 27018 controls you selected in the same programme and records them on the certificate scope, on a supplementary certificate or in a statement of verification. Sterling consults, designs and prepares; the assessment and the decision stay with the body.
- 01Define the cloud services, roles and customers the certificate must cover.Which services process PII as a processor, for which customers and regions; where you are the controller instead; which hyperscaler and sub-processor dependencies sit underneath; and what the contract demands.
- 02Gap analysis: measure what exists against the 2025 edition.The gap analysis compares your ISMS, contracts and platform behaviour with the cloud PII guidance in clauses 5 to 8 and the Annex A control set, keeps what works and sets the action plan.
- 03Select the controls, align the contracts and implement.Annex A controls added to the risk treatment and the Statement of Applicability; purpose, location, sub-processor, deletion and notification commitments written into the contract and built into the platform; people trained and the vulnerability assessment carried out.
- 04Audit the controls internally and close the findings.Internal audit of the cloud privacy controls alongside the ISMS, then management review; we raise the findings first and close them with evidence before the body arrives.
- 05Pass the independent assessment alongside ISO/IEC 27001.For a new ISMS, the body's Stage 1 readiness review and Stage 2 audit cover the ISO/IEC 27001 requirements and the ISO/IEC 27018 controls together; if you are already certified, the added controls are assessed at the next surveillance or recertification audit or in a separate visit. Respond to any findings and await the decision.
- 06Keep the controls and the commitments current.Sub-processor changes notified, data location statements maintained, deletions evidenced, breach drills run, internal audits and management reviews continued, and the controls re-examined at every surveillance audit.
Check the route, not only the fee. Ask which body will issue the certificate, whether it is accredited for ISMS certification, and how the ISO/IEC 27018 controls will be recorded, then confirm each answer with the body and the customer who asked. Treat "certified in days" and "no ISO/IEC 27001 needed" as warnings. How to choose a credible ISO/IEC 27018 provider · The certification buyer's checklist
Cost
How much does ISO/IEC 27018 certification cost?
No two cloud privacy programmes cost the same, because the services, tenants and regions in scope, and whether an ISO/IEC 27001 system already exists, drive everything that follows. Sterling's commitment is a proposal with every component visible and a fee that does not move.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Whether an ISMS exists, the cloud services and regions in scope, how far contracts and platform already match the controls, and how much of the work your team carries (Design™ or Drive™) |
| Independent certification | The certification body's audit days for the ISO/IEC 27001 scope, the added time for the ISO/IEC 27018 controls, whether a supplementary certificate or statement is issued, travel, and annual surveillance |
| Internal resources and remediation | Time from engineering, security, legal and account management, training, and any platform change the controls call for, identified in the gap analysis, never assumed |
| Software, assessment and learning | Included in a Sterling engagement: Effivity, a vulnerability assessment and Sterling Academy access, with users, courses and access period confirmed in the proposal |
| Continued support | Surveillance readiness, internal audits, contract reviews, refresher learning and extensions under Sustain™ |
What moves the price
- Whether a certified ISO/IEC 27001 system exists, or both are built together
- Cloud services, tenants, regions and hyperscaler platforms in scope
- How closely your contracts and your platform already match the controls
- Health, payment or special-category data and customer-specific privacy terms
- The contract deadline and the capacity your team can commit
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, the vulnerability assessment, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO/IEC 27018 certification take?
For a provider that already holds ISO/IEC 27001, a realistic ISO/IEC 27018 programme takes two to five months from kick-off to the assessment: nearer two when contracts, deletion and sub-processor management are already close to the controls, nearer five when the platform needs changes before they can be evidenced. Building the ISMS and the cloud privacy controls together takes four to eight months. The floor is set by evidence: deletions performed, sub-processor notices sent, a breach drill run, an internal audit and a management review take calendar time.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to product, engineering and legal owners; speed of decisions on scope and on where you are processor or controller |
| Control build and contract alignment | Platform changes the controls need, the contracts and sub-processor agreements to align, and the availability of engineering and legal time |
| Operation and evidence | Controls running long enough to produce deletion records, logs, sub-processor notices and a breach drill, then internal audit and management review |
| Certification assessment | The certification body's calendar, whether the controls join a scheduled surveillance audit or need a separate visit, and time to close findings |
Bring the contract date or the customer's deadline to the first call. An assessment date promised before anyone has seen how your platform deletes data is a sales technique, not a plan.
Challenges
Common ISO/IEC 27018 implementation challenges
Cloud privacy programmes stall for predictable reasons; each has an answer.
Nobody can say precisely which PII you hold, for which customer, in which region.
We build the per-service PII map first: data types, customers, storage locations, replicas, backups and sub-processors. It becomes the scope statement, the data location disclosure and the basis of every deletion promise, and it lives in Effivity.
Roles are blurred: you are a processor for customer data and a controller for your own.
The standard addresses the processor role; your own employee, marketing and billing data sit under controller obligations it does not specify. We separate the two in scope, in the Statement of Applicability and in the policies.
Your platform runs on a hyperscaler whose certificate you cannot simply inherit.
Their ISO/IEC 27018 assessment covers their services as a processor to you; your customers contract with you. We write down the shared responsibilities, disclose the hyperscaler as a sub-processor and implement the controls that remain yours.
The contract promises what the platform cannot do.
Thirty-day deletion, single-region storage or immediate breach notice may already be in signed agreements. We compare the commitments with the platform's real behaviour and fix the platform or correct the wording before an auditor finds the gap.
You are ISO/IEC 27001 certified, but the Statement of Applicability was written for the auditor, not the cloud service.
We rebuild the risk treatment around the services and tenants that matter, add the Annex A controls with real owners and keep what works, so the extension is assessed on controls that operate.
Your engagement
What your ISO/IEC 27018 engagement includes
Your agreed scope covers everything operating cloud privacy controls and a prepared team need. Many providers hand over a checklist and leave the rest to you; a Sterling engagement carries the whole programme, one team, one all-inclusive proposal.
Scope, gap analysis and implementation plan
Cloud services, roles, regions and customers defined, the gap against the 2025 edition measured, and a plan with owners, dates and decision points.
Control selection, contract alignment and documentation
Annex A controls added to the risk treatment and the Statement of Applicability, contract terms aligned, and PII protection policies and procedures on Sterling's template sets, adapted to your platform.
Effivity ISO & GRC software
Your ISMS and its cloud privacy controls run in Effivity from day one, included with the engagement at no additional cost.
Vulnerability assessment
A vulnerability assessment within the engagement, its findings fed into the treatment plan and followed to closure.
Learning for the whole workforce
Internal auditor training for your audit team, as applicable to your standard, plus preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit, management review and assessment support
Conducted or facilitated as agreed, findings closed with evidence, then preparation and support for the certification body's assessment, at Stage 1 and Stage 2 or at the surveillance audit that adds the controls.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO/IEC 27018 implementation
Every ISO/IEC 27018 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. How much of the work your team carries is your choice; the method, software and accountability stay the same.
- 01Design™Guided implementation: your teams implement with Sterling's structure, control templates, PII mapping workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed work, from the PII map to the Statement of Applicability and assessment preparation, with your control owners.
- 03Sustain™Post-certification operation: contract reviews, deletion evidence, breach drills, internal audits, surveillance readiness and new-hire awareness, year after year.
- 04Automate™The controls running in Effivity: the PII map, risks, the Statement of Applicability, sub-processors, incidents, audits and management review in one workspace.
- 05Revise™Extensions and changes: ISO/IEC 27017, ISO/IEC 27701, SOC 2, new services, regions or platforms, and future editions of the standard.
Often combined with
Standards organisations pair with ISO/IEC 27018
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
Effivity · ISO/IEC 27018 software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO/IEC 27018:2025.
Every Sterling ISO/IEC 27018 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the PII map, risks, the Statement of Applicability, the Annex A controls, sub-processors, deletion records, incidents and audits sit in one place. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Services, roles and the PII map
Each cloud service with its processor or controller role, the customers and regions it serves, the PII it holds and the sub-processors underneath.
Policies, contracts and sub-processors
The PII protection policy, processor roles, customer instructions and contract commitments per service, and a sub-processor register with change notices.
PII incidents and legal requests
PII breaches logged, assessed and notified to the affected customers with times recorded; legally binding disclosure requests handled by a procedure that notifies the customer where the law allows.
Confidentiality, awareness and access to tenants
Confidentiality undertakings and PII awareness records for everyone who can reach customer environments, linked to Sterling Academy.
Facilities, media and secure disposal
Access records for the facilities and media that hold customer PII, and erasure or destruction evidence for equipment leaving service.
Deletion, backup and logging per tenant
Deletion and secure erasure procedures with timestamps that reach replicas and backups, access logs for customer data, and monitoring per tenant.
Cryptography, development and test data
Encryption of PII in transit and at rest, secure development and change records, and production PII kept out of test environments.
Control ownership and evidence, control by control
Each Annex A control with its owner, status, linked policy, contract clause and evidence beside the ISO/IEC 27001 controls in the Statement of Applicability, ready to map to ISO/IEC 27701 or SOC 2.
What this means at the audit
At the assessment the auditor asks for the Statement of Applicability with the Annex A controls, the PII map, the sub-processor list, the deletion records, the incident log, the internal audit and the management review minutes. In Effivity each is a live screen with dates, owners and evidence attached. After certification, Sustain™ continues in the same workspace.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your PII map, risk register, SoA and policies migrated, not retyped
- Admin and user training for your team
- Modules for PIMS, QMS, BCMS, PCI DSS and more when you integrate standards
ISO/IEC 27018 client experience
Client letters on file, available on request.
Signed client letters for ISO/IEC 27018 are available on request. The client feedback wall lists every letter by standard.
Programmes with ISO/IEC 27018 in scope
How the standard runs inside a wider programme.
- 01How an integrated programme runs
Cloud service providers: security, cloud and privacy assurance as one programme
ISO/IEC 27001 with the cloud controls of ISO/IEC 27017 and ISO/IEC 27018, and ISO/IEC 27701 for the privacy management system, is the combination cloud providers ask about most. In such a programme the scope, risk method, Statement of Applicability, internal audit and management review are shared; the cloud security and PII processor controls join the treatment plan, assessed in one audit programme.
Sterling Academy · ISO/IEC 27018 e-learning
Train everyone who can reach customer data, not only the security team.
Most PII incidents in a cloud service begin with a person: an export nobody authorised, a deletion promise nobody checked. Sterling Academy delivers e-learning for the whole workforce and for the people who run the controls: video lessons with checkpoints, a final exam and a numbered Certificate of Completion, verifiable online. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their consultant, including complimentary awareness training for their people as part of the engagement.
- ISO/IEC 27018 awareness for every employee, the PII awareness evidence the people controls ask for
- Practitioner courses for the ISMS lead, the privacy lead and the control owners
- Internal auditor training for the people who will audit the controls, as applicable to your standard, as part of the engagement
- Learner progress by team and a training status report for the auditor
- New hires and contractors trained as they arrive, so awareness evidence is current at every audit
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for an ISO/IEC 27018 programme
Who learns what in a cloud privacy programme.
Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018)
What the standard requires of a cloud provider and of each person: what counts as PII, processor versus controller, processing only on the customer's instructions, handling deletion and access requests, and reporting a suspected breach at once.
View the courseDocumented Information Management
Creating, approving, controlling and retiring the PII protection policies, procedures, sub-processor lists, data location statements and records the controls depend on, so what the auditor reads is current and owned.
View the courseNonconformity Management
Raising, investigating and closing nonconformities from internal audits, PII incidents, customer audits and certification assessments: root cause, correction, corrective action and evidence that the fix worked.
View the courseRisk Management
Risk assessment and treatment for a PII processor: criteria, the PII map as the asset view, consequence to the customer and to the people the data concerns, control selection from ISO/IEC 27002 and Annex A.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the cloud privacy controls, with exercises on your own PII map and contracts, and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO 9001, ISO 22301, ISO 14001, ISO 45001, ISO 22000 and HACCP, ISO 13485 and more, so one workforce trains on one platform.
See all coursesConsulting clients get access through their Sterling consultant. A Sterling Academy certificate evidences training; certification of your ISMS and the assessment of its cloud privacy controls remain with the independent certification body.
Keep exploring
Explore more about ISO/IEC 27018
Watch a video on how to implement ISO 27018 here.
Watch a video on ISO 27018 requirements here.
ISO/IEC 27018 resources
Services for ISO/IEC 27018
Why Sterling
Want successful ISO/IEC 27018 certification? Come to Sterling.
Whether you run one SaaS product from one region or a platform across several regions and jurisdictions, Sterling helps you build one set of cloud privacy controls with clear ownership, so the certificate covers what your customers need.
Cloud, security and privacy programmes in 60+ countries
Information security and privacy implementations for SaaS companies, hosting and platform providers and BPOs, with one engagement team accountable wherever you operate, and offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, the vulnerability assessment, training and Academy access in one proposal; certification-body fees shown separately. No surprises, ever.
Controls your engineers can live with
Deletion, disclosure and notification controls designed with the people who run the platform, proportionate to the risks and running in Effivity, so privacy becomes part of operating the service.
Expert and experienced consultants
Consultants who have advised on information security and privacy management systems across sectors and countries since 2003, and who build your controls properly the first time.
The Sterling Promise
What our ISO/IEC 27018 certification success guarantee means
We stay with you until the agreed ISO/IEC 27018 outcome is achieved: through the PII map, the control build, the contract alignment, the internal audit and the resolution of any findings the body raises. Plain explanations, practical delivery, included software and workforce learning turn the investment into a capability, not a line on a certificate.
The engagement sets out the standard, the scope, the outcome and who does what. Your organisation provides accurate information, gives access to the services in scope and operates the agreed controls. The independent certification body assesses conformity; its decision is its own. Our commitment covers the agreed assessment support; it is not a warranty that no incident will occur, that every customer will accept the record, or that any law has been complied with, which is a matter for your legal advisers.
After certification
What happens after ISO/IEC 27018 certification?
The record follows the ISO/IEC 27001 certificate's three-year cycle: a surveillance audit at least once a calendar year, the first within twelve months of the certification decision, and recertification before the certificate expires, with the cloud privacy controls examined at each visit. Between visits the controls have to keep producing evidence: sub-processor changes notified, data location statements kept true, deletions recorded, breach drills run, internal audits and management reviews held.
Customers, platforms and data protection law change faster than any three-year cycle. Under Sterling OS™ Sustain™ we review the contracts and the sub-processor list with you, keep the PII map and the Statement of Applicability current, and run the internal audits and surveillance preparation.
FAQs
Frequently asked questions about ISO/IEC 27018
Can we be certified to ISO/IEC 27018 on its own, or do we need ISO/IEC 27001?
Not on its own. ISO/IEC 27018 is a guidelines standard with no management system requirements, a reference for selecting PII protection controls inside an ISMS based on ISO/IEC 27001. Certification bodies assess its controls alongside the ISO/IEC 27001 audit and record the result on the certificate scope, on a supplementary certificate or in a statement of verification; some treat an ISO/IEC 27001 certificate as a prerequisite, and some also ask for the ISO/IEC 27017 cloud controls in the same audit. If you are already certified, the controls are added at the next surveillance or recertification audit or in a separate visit; if you hold neither, both are built together and assessed in the same Stage 1 and Stage 2.
What is the difference between ISO/IEC 27018 and ISO/IEC 27701?
ISO/IEC 27701:2025 is a certifiable management system standard for privacy, for PII controllers and processors of any kind. ISO/IEC 27018 is a control set for one role, the public cloud PII processor, applied inside an ISMS. A cloud provider often holds both: ISO/IEC 27018 answers the cloud contract; ISO/IEC 27701 governs privacy as a management system across everything it does.
And the difference between ISO/IEC 27018 and ISO/IEC 27017?
ISO/IEC 27017:2026 adds cloud-specific information security guidance and controls for cloud service customers and providers; ISO/IEC 27018 adds guidance and controls for the personal data a provider processes for its customers. They complement each other, many providers implement both, and some certification bodies assess them together.
Our platform runs on a hyperscaler that is itself ISO/IEC 27018 certified. Does that cover us?
No. Their record covers their services as a processor to you. Your customers contract with you, so the purpose, access, deletion, disclosure and notification controls for their data are yours to operate, and the hyperscaler is a sub-processor you disclose. You can rely on their assessed controls for the parts of the stack they run.
Does ISO/IEC 27018 make us GDPR compliant?
No standard does. ISO/IEC 27018 gives a recognised, independently assessed way to evidence the guarantees a controller must obtain from its processors: processing on instructions, sub-processor control, security, deletion or return of data and breach notification. Legal compliance remains a matter for your advisers; the record issued is not a compliance mark.
Our certificate references ISO/IEC 27018:2019. What changes with the 2025 edition?
The 2025 edition aligns the text with ISO/IEC 27002:2022, so the clauses now follow the 93 controls in four themes, and Annex B maps it to the 2019 edition; the processor commitments continue. Because the standard is guidance there is no formal transition deadline; your certification body applies the 2025 edition under its own rules, usually at the next audit. Ask for the timetable and update your Statement of Applicability and contract references with Annex B.
Is the ISO/IEC 27018 certificate accredited?
Accreditation applies to the ISO/IEC 27001 certificate, issued by a body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 for ISMS certification under Global ACI, which replaced the IAF MLA and ILAC MRA. A supplementary ISO/IEC 27018 certificate or statement may be issued outside that accreditation, and bodies differ; ask what the record will say and under which arrangement, and confirm that your customer accepts it.
Does Sterling issue the ISO/IEC 27018 record?
No. Sterling consults, trains and prepares. An independent certification body assesses the ISMS and the cloud privacy controls and decides what it records. Consulting and the certificate on one invoice is a sale of paper.
What do you need to prepare an ISO/IEC 27018 proposal?
The cloud services and regions to be covered, whether you are the processor for them, the platforms and main sub-processors underneath, approximate headcount, whether an ISO/IEC 27001 certificate exists, the contract behind the enquiry, and your deadline. That is enough for a scoped, all-inclusive proposal; no PII map or policy set is needed first.
Before the first call
Prepare a useful ISO/IEC 27018 readiness brief
You do not need a PII map or a policy set before the first conversation; a short account of which services process personal data, where and for whom is enough. Seven questions:
- Who is asking for ISO/IEC 27018, and what exactly does the contract or tender require: which services, regions and edition, and how must the record be issued?
- For which services are you the processor, and for which data are you the controller?
- Which cloud platforms and sub-processors sit underneath each service, and in which countries is customer data stored?
- How is customer data deleted or returned today, and can you prove it?
- Do you hold ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27701 or a SOC 2 report, and what did the last audits say?
- Who can take decisions on scope, contracts and platform changes, and who can give time to implementation?
- Is there a contract date, a scheduled surveillance audit or a certificate renewal to plan around?
Those seven answers are enough to scope the work and prepare a realistic proposal. They open a conversation, not a scored assessment or a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO/IEC 27018 certification.
An ISO/IEC 27018 record is worth something when it sits on an accredited ISO/IEC 27001 certificate whose scope names the cloud service your customers use, and when the controls behind it can be examined. The market also sells the other kind: "certified" badges with no ISO/IEC 27001 behind them, certificates from bodies nobody accredits, and claims borrowed from the hyperscaler underneath. They are cheaper, until a customer's privacy team checks.
How to choose a credible ISO/IEC 27018 provider
- Ask which body will issue the record and how, on the ISO/IEC 27001 certificate scope, a supplementary certificate or a statement of verification, and check the certificate on its public register.
- Confirm that the body is accredited for ISMS certification under ISO/IEC 27006-1 with the accreditation body itself, and ask whether the ISO/IEC 27018 record is issued under that accreditation.
- Ask how the PII map and the Statement of Applicability will be built. Annex A controls ticked before anyone has listed which data you process for whom are a template.
- Ask what happens to the contracts and the platform. A credible programme aligns the contract with what the platform can actually do about deletion, location and notification.
- Ask what your people will be taught and where the records will live. No training and no system of record means the controls stop when the consultant leaves.
- Walk away from "certified in 7 to 10 days", "no ISO/IEC 27001 needed" and one invoice for consulting and certificate. The controls have to operate and be audited internally before an assessment has anything to examine.
Keep exploring
More on ISO/IEC 27018 and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your ISO/IEC 27018 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice