In August 2025, the third edition of the standard ISO/IEC 27018:2025 – "Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors" – was published. This international standard provides updated guidelines for the protection of personally identifiable information (PII) in public cloud environments, where the cloud service provider acts as a PII processor.
 
What Is ISO/IEC 27018?
ISO/IEC 27018 is designed to ensure effective control and management of personal data stored and processed in the cloud. It is based on ISO/IEC 27002, adapting the general information security principles and controls to the specific characteristics of cloud services. The standard ensures that public cloud service providers process PII in a responsible, transparent, and secure manner, in accordance with international and local regulations.
 
Importance of the Standard
With the growing use of cloud services in both the business and public sectors, protecting personal data in the cloud has become critical. ISO/IEC 27018:

• Helps cloud service providers meet their legal, contractual, and ethical obligations regarding PII.
• Facilitates compliance with the requirements of different jurisdictions.
• Enhances customer trust through clearly defined data protection practices.
• Provides a framework for transparency, verification, and accountability in the processing of PII.

 
Key Changes in ISO/IEC 27018
The new, third edition of ISO/IEC 27018 includes several key updates:

1. Alignment with ISO/IEC 27002:2022 – the text of the standard has been synchronized with the latest edition of ISO/IEC 27002 to ensure consistency and integration of control measures.
2. Addition of Annex B – a new annex providing additional guidance and examples for implementing PII protection in cloud environments.

These changes reflect the evolution of cloud technologies and the growing global requirements for personal data protection.
 
Context and Purpose of the Standard
ISO/IEC 27018 is intended for public cloud providers that process PII on behalf of their customers. Depending on the contract and legal jurisdiction, the obligations of the PII processor may vary, but the primary goal is always to ensure the security and confidentiality of personal data.
The standard also emphasizes the distinction between:

• PII controller – the organization that determines the purposes and means of processing personal data.
• PII processor – the cloud service provider that processes PII in accordance with the controller's instructions.

This distinction is important for the clear definition of responsibilities and for compliance with applicable legislation.
 
Controls and Guidelines for PII Protection
ISO/IEC 27018 provides guidance on selecting and applying controls in cloud environments, extending the standard controls from ISO/IEC 27002. The key elements include:

1. Transparency and accountability – the cloud service provider must be transparent about its PII processing practices, enabling customers to make informed decisions.
2. Contractual frameworks – the standard supports the definition of clear contractual obligations between the cloud provider and the customer.
3. Monitoring and auditing – providing mechanisms for monitoring and oversight of PII processing in a multi-tenant environment.
4. Risk-based assessment – the selection of controls is based on a risk assessment and the specific business needs of the organization.
5. Privacy by design – integrating personal data protection measures from the design stage of services and information systems is recommended.

 
Key Sources of PII Protection Requirements
Organizations applying ISO/IEC 27018 should be guided by three primary sources:

1. Legal and contractual requirements – laws, regulations, and contractual obligations.
2. Risk assessment – identification, evaluation, and management of risks to PII.
3. Corporate policies – internal standards and practices that may exceed minimum legal requirements.

 
PII Lifecycle and Protection
ISO/IEC 27018 emphasizes that personal data follows a natural lifecycle – from creation, processing, and storage through to deletion. The standard requires the application of appropriate PII protection measures at every stage of this lifecycle.
 
Benefits of Implementing ISO/IEC 27018:2025
Implementing the standard offers numerous advantages for cloud providers and their customers:

• Strengthens trust through alignment with global privacy principles.
• Clarifies roles and responsibilities between providers and customers.
• Facilitates compliance with legal and contractual requirements.
• Improves transparency and audit capabilities.
• Supports the adoption of privacy-by-design in the development of cloud services.

 
ISO/IEC 27018:2025 provides an updated, comprehensive framework for the protection of personal data in public cloud environments. The third edition reflects current trends in information security and cybersecurity, offering a practical and reliable foundation for cloud providers seeking to ensure the safety and confidentiality of their customers' personal information.
Implementing this standard not only supports regulatory compliance, but also strengthens trust in cloud services — a critical factor in today’s global digital landscape.