OneClickComply
    ISO/IEC 27018:2025Supported in OneClickComply

    Protect customer PII in the cloud with ISO 27018, without the overhead

    ISO 27018 (ISO/IEC 27018:2025) is the international guideline for protecting personally identifiable information in public clouds where the provider acts as a PII processor. It extends the ISO/IEC 27002 controls with cloud privacy guidance and adds an extended control set covering consent, purpose, transparency, disclosure, return and deletion of personal data. The 2025 edition, published in August 2025, replaces the 2019 edition and aligns with ISO/IEC 27002:2022.

    See the ISO 27018 requirements
    ISO 27018 Aligned
    Automated Evidence
    OneClickFix Enabled
    Continuous Monitoring
    In-House Audit Team
    Who needs ISO 27018

    Is ISO 27018 right for your organisation?

    ISO 27018 is for public cloud service providers, including SaaS, PaaS and IaaS businesses, that process personal data on behalf of their customers. It is voluntary, but enterprise and public sector buyers often ask for it during procurement as proof that their personal data is protected. Providers usually adopt it alongside ISO 27001, adding the ISO 27018 controls to the scope of their existing ISMS.

    Adopting it is voluntary, though customers and auditors often expect it.

    ISO 27018 at a glance
    Issued by
    ISO and IEC, through joint committee ISO/IEC JTC 1/SC 27
    Latest version
    ISO/IEC 27018:2025, third edition, published August 2025
    Replaces
    ISO/IEC 27018:2019
    Applies to
    Public cloud providers acting as PII processors
    Builds on
    ISO/IEC 27002:2022 controls and ISO/IEC 29100 privacy principles
    Assessment route
    Assessed as an extension of an ISO/IEC 27001 certification scope
    Type
    Standard (voluntary)
    Region
    Global
    In OneClickComply
    Supported today
    How we help

    OneClickComply makes it simple

    ISO 27018:2025 is mapped in OneClickComply's control library and available on request. Because it follows the ISO/IEC 27002:2022 structure, controls and evidence you already hold for ISO 27001 count towards ISO 27018, and automated evidence collection, AutoComplete policies and continuous monitoring cover the cloud and identity controls that protect customer PII. Our in-house audit team and Ask an Auditor help you interpret the Annex A privacy controls for your service.

    Requirements covered

    Cloud PII guidance on the 93 ISO/IEC 27002:2022 controls across clauses 5 to 8 (organisational, people, physical and technological), plus an Annex A extended control set for PII protection and an Annex B correspondence table to the 2019 edition.

    Already working towards another framework?

    Evidence you collect once counts towards every framework it applies to.

    Manual ISO 27018 vs. OneClickComply

    Manual ISO 27018
    • Interpreting ISO 27002 controls for cloud PII processing by hand
    • Tracking sub-processors and data locations across spreadsheets
    • Rewriting privacy policies to match the 2025 control numbering
    • Collecting screenshots from every cloud console before each audit
    • Answering customer privacy questionnaires from scratch every time
    With OneClickComply
    • ISO 27018 controls mapped and explained with auditor guidance
    • Vendor records keep sub-processors and their risk in one place
    • Policies generated from your real environment and current controls
    • Evidence collected automatically and reused across ISO 27001 and 27018
    • Questionnaire automation answers privacy questions from your evidence
    Capabilities

    Everything you need for ISO 27018

    ISO 27018 controls mapped to your existing ISO 27001 control set

    Automated evidence from cloud, identity and device tools

    AutoComplete policies for PII handling, retention and deletion

    Continuous monitoring of controls protecting customer PII

    Vendor risk management for sub-processors handling PII

    Trust centre to share ISO 27018 status with customers

    How it works

    Three steps to ISO 27018 compliance

    01

    Connect & scan

    Connect your cloud, identity and SaaS tools. OneClickComply checks them against ISO 27018 and shows you exactly where you stand.

    02

    Fix & generate

    OneClickFix remediates technical gaps in one click, and AutoComplete generates ISO 27018-aligned policies from your real environment.

    03

    Monitor & evidence

    Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

    Requirements

    ISO/IEC 27018:2025 requirements

    The 93 ISO/IEC 27002:2022 controls in clauses 5 to 8 that ISO 27018:2025 extends with cloud PII guidance, plus the Annex A extended control set for PII protection.

    ReferenceRequirement
    5.1Policies for information security
    5.2Information security roles and responsibilities
    5.3Segregation of duties
    5.4Management responsibilities
    5.5Contact with authorities
    5.6Contact with special interest groups
    5.7Threat intelligence
    5.8Information security in project management
    5.9Inventory of information and other associated assets
    5.10Acceptable use of information and other associated assets
    5.11Return of assets
    5.12Classification of information
    5.13Labelling of information
    5.14Information transfer
    5.15Access control
    5.16Identity management
    5.17Authentication information
    5.18Access rights
    5.19Information security in supplier relationships
    5.20Addressing information security within supplier agreements

    Always check the official ISO 27018 text for the exact wording.

    ISO 27018 FAQs

    What is ISO 27018?

    ISO/IEC 27018 is an international guideline for protecting personally identifiable information (PII) in public clouds where the provider acts as a PII processor. Published by ISO and IEC, it adds cloud privacy guidance to the ISO/IEC 27002 controls and an extended control set in Annex A built on the ISO/IEC 29100 privacy principles. The 2025 edition is the third edition and replaces ISO/IEC 27018:2019.

    What changed in ISO 27018:2025?

    The main change is that ISO/IEC 27018:2025 is realigned with ISO/IEC 27002:2022, so its guidance now follows the organisational, people, physical and technological control themes in clauses 5 to 8. It keeps Annex A, the extended control set for PII protection, and adds Annex B, which maps the new edition to the 2019 edition so existing implementations can transition.

    Who needs ISO 27018?

    ISO 27018 is aimed at public cloud service providers that process personal data on behalf of their customers, such as SaaS, PaaS and IaaS providers. It is voluntary, but customers, especially in regulated sectors, often ask for it in procurement and contracts as evidence that a provider protects their personal data, supports their privacy obligations and is transparent about sub-processors and data location.

    Can you get certified to ISO 27018?

    ISO 27018 is not a standalone management system standard, so organisations do not certify to it on its own. It is normally implemented as an extension of an ISO/IEC 27001 information security management system, and certification bodies can assess the ISO 27018 controls within the scope of an ISO 27001 certification audit. Check with your certification body how it reports this.

    How does ISO 27018 relate to ISO 27001 and ISO 27017?

    ISO 27018 sits on top of ISO 27001: the ISMS provides the management framework and ISO 27018 adds privacy controls for cloud providers that process PII. ISO/IEC 27017 is its sibling for general cloud security controls. Many cloud providers implement all three together, using one set of controls and evidence that serves each standard.

    Does ISO 27018 help with UK GDPR and EU GDPR?

    Yes, ISO 27018 supports GDPR compliance for cloud processors, but it does not guarantee it. Its controls cover processor duties such as acting on customer instructions, supporting data subject rights, notifying breaches, disclosing sub-processors, returning and deleting data, and recording disclosures. You still need to meet the specific legal requirements of UK GDPR or EU GDPR, including Article 28 contracts.

    How long does ISO 27018 take to implement?

    How long ISO 27018 takes depends mainly on whether you already run an ISO 27001 ISMS. With a working ISMS, ISO 27018 extends existing controls, policies and evidence to cover PII processing, which is far less work than starting from nothing. Without one, you need to build the ISMS first. Your scope, cloud architecture and contract terms also affect the timeline.

    Does OneClickComply support ISO 27018:2025?

    ISO 27018:2025 is mapped in OneClickComply's control library and is available on request. Because its controls align with ISO/IEC 27002:2022, the evidence, policies and monitoring you use for ISO 27001 can count towards ISO 27018 too. Contact the team to enable it, and use Ask an Auditor for guidance on the Annex A privacy controls.

    Related standards

    All standards

    Products that power ISO 27018 compliance

    OneClickFix

    Auto-remediate technical controls

    AutoComplete Policies

    AI-generated compliance policies

    Continuous Monitoring

    24/7 drift detection & alerting

    Automated Evidence

    Evidence from 13,000+ integrations

    Get ISO 27018 ready, not stressed

    Automate controls, gather evidence continuously and stay audit-ready, all on one platform.