ISO/IEC 27018:2025 – Enhanced Protection of Personal Data in the Cloud
A
.jpg)
ugust 2025 – The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have published the third edition of the standard ISO/IEC 27018:2025 Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors. The new edition contains updated guidelines for the protection of Personally Identifiable Information (PII) in public cloud environments, where the provider acts as a PII processor.The standard is part of the ISO/IEC 27000 family and builds upon ISO/IEC 27001 and ISO/IEC 27002, adding specific control mechanisms and best practices for Cloud Service Providers (CSPs) that process PII on behalf of their customers. Its primary goal is to ensure that organizations protect the information assets entrusted to them by their clients in a manner that is secure, transparent, and aligned with international best practices.
Key Features of ISO/IEC 27018:2025
- Alignment with ISO/IEC 27002:2022 – the new edition is synchronized with the 2022 update to ensure a unified structure and terminology.
- Annex A – a set of additional controls and guidance designed to address public cloud data protection requirements not covered by the existing ISO/IEC 27002 control set, organized in accordance with the privacy principles of ISO/IEC 29100.
- New Annex B – an expanded implementation guide providing additional practical guidance for more effective application of controls.
- Stronger focus on the "privacy by design" principle – embedding data protection from the design stage.
- Greater transparency and accountability in the handling of PII.
Why Do These Changes Matter?
- Easier integration – the structural alignment with ISO/IEC 27002:2022 supports the development of compatible ISMS systems and control frameworks.
- More practical application – the new Annex B improves audit readiness and implementation efficiency.
- Demonstration of commitment – transitioning to the latest edition signals a commitment to modern and recognized best practices.
Applicability to PII Processors and PII Controllers
The standard's primary focus is on cloud service providers (PII processors) that handle PII on behalf of their customers. However, a large portion of the control mechanisms and guidance is also applicable to PII controllers. In most cases, they have additional obligations that are not covered by ISO/IEC 27018:2025.
Key benefits of implementing the standard include:
- increased customer trust;
- clear definition of responsibilities between controllers and processors;
- easier achievement of compliance with regulatory and contractual requirements;
- promotion of the "privacy by design" principle.
👉 CONSEJO has extensive experience in the field of cybersecurity and ISO standards and supports organizations in implementing international standards and best practices. Our team will assist you in a smooth transition to ISO/IEC 27018:2025, including readiness and compliance assessments, to ensure regulatory compliance, maximize the value from the standard, and build lasting trust in the digital environment.
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
